From 6a461267a2121216a0ecb586b4e4b655085038ab Mon Sep 17 00:00:00 2001 From: rope Date: Sat, 12 Sep 2026 17:34:10 +0100 Subject: [PATCH] arr-interconnect: record why qBittorrent's localhost auth is off Co-Authored-By: Claude Opus 5 --- services/arr-interconnect.nix | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/services/arr-interconnect.nix b/services/arr-interconnect.nix index 9bdd9df..90f0341 100644 --- a/services/arr-interconnect.nix +++ b/services/arr-interconnect.nix @@ -201,6 +201,20 @@ let ########################################################################## # Sonarr → qBittorrent (download client for TV) + # + # username/password are deliberately empty: qBittorrent's runtime config + # has `WebUI\LocalHostAuth=false`, so connections from 127.0.0.1 skip auth. + # Every consumer here reaches it as host "localhost", and Shelfarr does too + # because it runs --network=host, so loopback covers all of them. Don't + # re-enable localhost auth without putting real credentials in these two + # blocks first, or downloads silently stop being grabbed. + # + # qBittorrent also has `WebUI\AuthSubnetWhitelistEnabled=true` covering + # 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Nothing here needs that — + # it only hands the unauthenticated admin API (setPreferences included, so + # autorun_program, so command execution) to every LAN device and every + # container. Safe to turn off; the loopback bypass above is the load-bearing + # half. ########################################################################## if [ -n "$SONARR_KEY" ]; then if ! exists_by_name "$BASE:8989/api/v3/downloadclient" "$SONARR_KEY" "qBittorrent"; then