---
name: arr-auth-posture-probe
description: "Verify a self-hosted *arr-style service's real auth posture by behavioral API probes instead of config-flag inference; includes the sed-masks-a-miss pitfall and wrong-host probe pitfall"
---

# Arr-auth posture probe

Ground truth for "is this arr/gate open?" comes from behavior, not config flags. `AuthenticationMethod=None` + `AuthenticationRequired=Enabled` in `config.xml` is ambiguous on paper; on the wire it means a login screen with **zero users** — first-account-wins.

## Recipe
1. Confirm which host runs the service before probing (`podman ps` on the target, not the box you ssh'd into first — arrs live on Dankserver, chat/searxng on Dankclaw).
2. Probe an API endpoint that bypasses the SPA shell, locally and through the vhost:
   `curl -s -o /dev/null -w "%{http_code}" http://<host>:<port>/api/v3/system/status`
   - SPA roots (`/`) always serve a 200 shell — never conclude "open" or "gated" from `/`.
   - 401 = gated; 200 + JSON = API fully open (anyone on the net can drive it with curl).
3. For config truth, dump the whole file (`podman exec <svc> cat /config/config.xml`), not a piped `grep | sed -n 2p`: **`sed -n Np` exits 0 on zero matches**, so the pipeline hides a miss and you conclude "empty field" when the grep itself failed.
4. API keys from config.xml are local-only secrets; they stop being secret the moment a vhost serves the API unauthenticated.

## Decision framing for the user
When posture = gated-with-zero-users, present it as a decision menu (None behind the front-door wall vs External/authentikarr), not a silent change — first-account-wins means whoever logs in first owns the instance.