media_stack: capture london-b sonarr.service unit in repo (PESO-140)

sonarr was the only *arr service without its systemd unit in the repo —
it was treated as package-managed and never captured, so a london-b
rebuild would lose the unit. Capture the running unit (APT/mono Sonarr
v3) into ansible/services/sonarr/sonarr.service and have the media_stack
role deploy it to /etc/systemd/system like radarr/lidarr/prowlarr,
overriding the package-owned copy. Move sonarr out of the
package-managed enable loop into the custom-unit deploy + enable loops.

ansible/roles/media_stack/tasks/main.yml

@@ -12,6 +12,7 @@
     mode: '0644'
   loop:
     - radarr
+    - sonarr
     - prowlarr
     - lidarr
     - whisparr
@@ -25,6 +26,7 @@
     enabled: true
   loop:
     - radarr
+    - sonarr
     - prowlarr
     - lidarr
     - ollama
@@ -59,7 +61,6 @@
     state: started
     enabled: true
   loop:
-    - sonarr
     - jellyfin
     - plexmediaserver
     - transmission-daemon

ansible/services/sonarr/README.md

@@ -6,13 +6,26 @@ TV series management and automated downloading.
 
 - **Host:** london-b
 - **Install method:** APT package (`sonarr` v3, mono-based)
-- **Service:** `sonarr.service` (package-managed unit file — do not override)
+- **Service:** `sonarr.service` (in this directory, deployed to
+  `/etc/systemd/system/` by the `media_stack` role)
 - **Data directory:** `/var/lib/sonarr`
 - **Web UI:** `sonarr.pez.sh` (proxied via Caddy on helsinki-a)
-- **Managed by:** `media_stack` Ansible role (ensures service is enabled and started)
+- **Managed by:** `media_stack` Ansible role (deploys the unit, then ensures it
+  is enabled and started)
 
 ## Notes
 
-Unlike radarr/lidarr/prowlarr (which use manually installed binaries with custom unit files), sonarr is installed via APT and its systemd unit is owned by the package. Use `dpkg-reconfigure -plow sonarr` to change User/Group/UMask settings rather than editing the unit file directly.
+The APT package ships its own unit at `/usr/lib/systemd/system/sonarr.service`.
+The unit here was captured from that running unit and is deployed to
+`/etc/systemd/system/sonarr.service`, which overrides the package copy so the
+unit lives in IaC alongside the other *arr services (radarr / lidarr /
+prowlarr). Because of the override, package updates to the unit no longer apply
+automatically — re-capture this file if the package unit changes.
 
-The `media_stack` role also sets up a midnight cron restart (`systemctl restart sonarr`).
+Unlike radarr/lidarr/prowlarr (manually installed `/opt` binaries), Sonarr is
+mono-based, so `ExecStart` runs `Sonarr.exe` via `/usr/bin/mono`. To change
+User/Group/UMask/-data, edit `sonarr.service` here rather than running
+`dpkg-reconfigure -plow sonarr`.
+
+The `media_stack` role also sets up a midnight cron restart
+(`systemctl restart sonarr`).

ansible/services/sonarr/sonarr.service

@@ -0,0 +1,23 @@
+# Managed by the pez-infra media_stack Ansible role.
+# Captured from the running sonarr v3 (APT/mono) unit on london-b.
+# Unlike radarr/lidarr/prowlarr (manually installed /opt binaries), Sonarr is
+# the APT package, so ExecStart runs the mono-based Sonarr.exe. Deploying this
+# to /etc/systemd/system overrides the package-owned unit in
+# /usr/lib/systemd/system so the unit is captured in IaC.
+[Unit]
+Description=Sonarr Daemon
+After=network.target
+
+[Service]
+User=root
+Group=root
+UMask=0002
+
+Type=simple
+ExecStart=/usr/bin/mono --debug /usr/lib/sonarr/bin/Sonarr.exe -nobrowser -data=/var/lib/sonarr
+TimeoutStopSec=20
+KillMode=process
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target