From b85429fb76247f7072a5af74e246794f512b114b Mon Sep 17 00:00:00 2001 From: rope Date: Thu, 3 Sep 2026 10:43:29 +0100 Subject: [PATCH] nginx: stop stripping cookies on qbittorrent vhost qBit 5.2 caches uploaded .torrent metadata in the session; without QBT_SID the follow-up torrents/add fails 400. Co-Authored-By: Claude Opus 5 --- services/nginx.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/services/nginx.nix b/services/nginx.nix index 3c71eca..554913f 100644 --- a/services/nginx.nix +++ b/services/nginx.nix @@ -129,12 +129,12 @@ in # qBit's CSRF check rejects any request whose Referer origin differs # from the Host — after Authelia's redirect the Referer is # auth.nordhammer.it, which trips the check. Strip it so qBit skips. - # Cookie stripped too so cached SID cookies don't fight localhost-bypass. + # Cookies must pass through: qBit 5.2 caches an uploaded .torrent's + # metadata in the session, so parseMetadata and the following + # torrents/add need the same QBT_SID or the add fails 400. "torrent.nordhammer.it" = lib.recursiveUpdate (protectedProxy 8080) { locations."/".extraConfig = autheliaAuthConfig + securityHeaders + '' proxy_set_header Referer ""; - proxy_set_header Cookie ""; - proxy_hide_header Set-Cookie; ''; }; "camera.nordhammer.it" = protectedProxy 1984;