Render playlist configs directly in-app; retire regen.sh and playlists.json (R3)

The app owns every input to a playlist's sldl .conf (playlists in its DB,
credentials in its encrypted store), so the old
DB -> playlists.json -> regen.sh subprocess -> regex credential patch-back
chain was three serialization hops for no reason. Collapse it:

- credential_service.render_playlist_confs(db) renders each <playlist>.conf
  from _template.conf in one pass: path placeholders substituted as literal
  text, then the four credential lines set, written 0600. This is now the
  single source of .conf rendering.
- playlist_service loses _write_playlists_json and regenerate_confs; _sync_to_disk
  just calls render_playlist_confs and syncs the scheduler. No subprocess, no
  intermediate JSON file.
- render_scope for spotify/soulseek re-renders confs via the same function
  (spotify still also writes _spotify.env for the python scripts). The dead
  _patch_conf_field / _every_playlist_conf helpers are removed.
- Delete pipeline/configs/regen.sh and drop it from the Dockerfile chmod;
  update _template.conf's comments.

Nothing outside playlist_service consumed regen.sh or playlists.json (verified).
Also closes the last remnants of the S2/S3 injection surface: names are
re-validated and path/credential values are substituted as literals, never
through sed or a shell.

Verified: end-to-end render in a throwaway DB (paths, creds incl. a password
with shell metacharacters, 0600, bad-name rejection) and a live re-render of
all 17 playlist configs with credentials preserved.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pipeline/configs/_template.conf

@@ -4,15 +4,17 @@
 # sldl runs as a subprocess inside the alembic container (same container as
 # beets, on gluetun's network namespace for VPN-routed Soulseek P2P).
 
+# This is a TEMPLATE. The app renders one <playlist>.conf per playlist from it
+# (credential_service.render_playlist_confs), substituting PLAYLIST_NAME,
+# SPOTIFY_URL, SLDL_DROPBOX_ROOT and the credential lines below in one pass.
+# The placeholder values here are overwritten at render time; edit the
+# non-placeholder settings (quality, timeouts, ports) to change every playlist.
+
 # ==== Soulseek credentials ====
-# Substituted by the app's credential_service (not regen.sh) whenever the
-# soulseek secret is saved/updated — every rendered <playlist>.conf gets
-# re-patched at that point, independent of playlist add/remove.
 user = SOULSEEK_USER
 pass = SOULSEEK_PASS
 
 # ==== Spotify API credentials ====
-# Substituted by credential_service the same way, on the spotify secret.
 spotify-id = SPOTIFY_CLIENT_ID
 spotify-secret = SPOTIFY_CLIENT_SECRET
 
@@ -21,8 +23,8 @@ input = SPOTIFY_URL
 input-type = spotify
 
 # ==== Output paths ====
-# SLDL_DROPBOX_ROOT is substituted by regen.sh at render time from
-# $MUSIC_DATA_DIR (sldl's own config format has no env-var expansion).
+# SLDL_DROPBOX_ROOT is substituted at render time from $MUSIC_DATA_DIR
+# (sldl's own config format has no env-var expansion).
 path = SLDL_DROPBOX_ROOT/PLAYLIST_NAME
 playlist-path = SLDL_DROPBOX_ROOT/PLAYLIST_NAME/_sldl.m3u8
 write-playlist = true

pipeline/configs/regen.sh

@@ -1,72 +0,0 @@
-#!/bin/bash
-# regen.sh — regenerate per-playlist sldl configs from _template.conf.
-#
-# Source of truth is $ALEMBIC_CONFIG_DIR/pipeline/playlists.json, written by
-# the alembic app's playlist_service whenever a playlist is added/edited/
-# removed via the UI. This script never edits that source of truth — it only
-# renders it. Run automatically by the app before each playlist sync, or
-# manually: regen.sh
-#
-# playlists.json shape: a JSON array of objects, each with at least
-# {"name": "...", "spotify_url": "...", "active": true, "no_m3u": false}.
-# Inactive playlists still get a .conf rendered (so a manual run is always
-# possible) but are skipped by the scheduler.
-
-set -euo pipefail
-
-ALEMBIC_CONFIG_DIR="${ALEMBIC_CONFIG_DIR:-/config}"
-MUSIC_DATA_DIR="${MUSIC_DATA_DIR:-/data/music}"
-PIPELINE_DIR="${PIPELINE_DIR:-/app/pipeline}"
-
-CONFIG_OUT_DIR="$ALEMBIC_CONFIG_DIR/pipeline"
-PLAYLISTS_JSON="$CONFIG_OUT_DIR/playlists.json"
-TEMPLATE="$PIPELINE_DIR/configs/_template.conf"
-SLDL_DROPBOX_ROOT="$MUSIC_DATA_DIR/sldl-dropbox"
-
-if [[ ! -f "$PLAYLISTS_JSON" ]]; then
-  echo "ERROR: $PLAYLISTS_JSON not found — nothing to regenerate." >&2
-  echo "       This file is written by the alembic app; run its playlist" >&2
-  echo "       import/seed step first if this is a fresh setup." >&2
-  exit 1
-fi
-
-mkdir -p "$CONFIG_OUT_DIR"
-
-# Render each playlist's .conf entirely in Python. The playlist name and URL
-# are substituted as LITERAL text (single-pass regex replace, never re-scanned),
-# not fed to `sed` — an earlier sed-based version let a crafted playlist name
-# execute shell via GNU sed's `e` flag. Names are also re-validated here as
-# defense in depth even though the app validates them before writing the JSON.
-python3 - "$PLAYLISTS_JSON" "$TEMPLATE" "$CONFIG_OUT_DIR" "$SLDL_DROPBOX_ROOT" <<'PY'
-import json, os, re, sys
-
-playlists_json, template_path, out_dir, dropbox_root = sys.argv[1:5]
-
-with open(playlists_json) as f:
-    playlists = json.load(f)
-with open(template_path) as f:
-    template = f.read()
-
-SAFE_NAME = re.compile(r"^[A-Za-z0-9 _-]{1,64}$")
-
-for p in playlists:
-    name = p.get("name", "")
-    url = p.get("spotify_url", "")
-    if not SAFE_NAME.match(name):
-        print(f"WARNING: skipping playlist with unsafe name: {name!r}", file=sys.stderr)
-        continue
-    mapping = {
-        "PLAYLIST_NAME": name,
-        "SPOTIFY_URL": url,
-        "SLDL_DROPBOX_ROOT": dropbox_root,
-    }
-    pattern = re.compile("|".join(re.escape(k) for k in mapping))
-    rendered = pattern.sub(lambda m: mapping[m.group(0)], template)
-    out_path = os.path.join(out_dir, name + ".conf")
-    with open(out_path, "w") as f:
-        f.write(rendered)
-    # Holds the Soulseek password and Spotify secret once credentials are
-    # patched in, so keep it owner-only from the moment it is created.
-    os.chmod(out_path, 0o600)
-    print(f"Generated {out_path}")
-PY