docs(arr-chain): Prowlarr feed contract cracked, qB PBKDF2 persistence recipe, chain proof

serverAppConfigs-docs/Dankserver/qbittorrent.md

@@ -15,10 +15,39 @@ qBittorrent is the torrent download client for the *arr stack on Dankserver. It
 
 ## Configuration
 
-1. Change the default Web UI password (Settings → Web UI).
-2. Enable "No auth mode for LAN" for arr app connectivity (Settings → Web UI → uncheck "HTTP authentication required for clients").
-3. Create download categories: `movies`, `tv`, `music`, `books`.
-4. Set max active downloads: Settings → Downloads (recommended: 5 global, 3 per category).
+1. Keep Web UI authentication ON (LAN bypass not needed — the arr apps
+   authenticate with the API) and give them a permanent password.
+2. Create download categories per app (`radarr`, `sonarr`, `lidarr`,
+   `readarr`): the arr download clients route category-per-app, and Prowlarr
+   feeds hand grabs to each app's own client.
+3. Set max active downloads: Settings → Downloads (recommended: 5 global,
+   3 per category).
+
+## Persistent WebUI credentials (verified 2026-08-30)
+
+qBittorrent 5 mints a **new temporary password at every start** unless a
+password is stored in `qBittorrent.conf`. That rotation silently breaks every
+arr download client after each reboot. The Web-API has no password endpoint
+any more (`/api/v2/app/setPassword` was removed), and the linuxserver image
+has no `WEBUI_AUTH` handling — so persistence must be written to the conf
+directly, in qb's own `salt:hash` format (`src/base/utils/password.cpp`:
+PBKDF2-HMAC-SHA512, 100 000 iterations, 16-byte salt = 4×uint32, then
+`base64(salt) + ":" + base64(hash)` as the raw value):
+
+```python
+import base64, hashlib, os
+salt = os.urandom(16)
+h = hashlib.pbkdf2_hmac("sha512", password.encode(), salt, 100000, 64)
+val = (base64.b64encode(salt) + b":" + base64.b64encode(h)).decode()
+# with the container STOPPED, in [Preferences]:
+#   WebUI\Username=admin
+#   WebUI\Password_PBKDF2=<val>
+```
+
+Then `podman start qbittorrent` and confirm login survives a
+`podman restart` — the temp-password rotation stops the moment stored
+credentials verify. (The classic `@ByteArray(salt+hash)` form is WRONG for
+qb5: login 401s on it; verify() base64-decodes the two halves separately.)
 
 ## Docker Compose
 
@@ -41,9 +70,14 @@ qbittorrent:
   networks: [appnet]
 ```
 
-## Gotchas
+## Gotchas (verified live)
 
-- qBittorrent Web UI password changes on first run (check `config/qBittorrent.conf`).
+- Temporary-password rotation on every boot is the default state of an
+  untouched qb5 — see the persistence recipe above; without it, all arr
+  download clients silently fail queue adds ("Couldn't add release … to
+  download queue" in the arr logs) after any restart.
+- API login from `curl` needs a `Referer: http://<host>:<port>/` header
+  (CSRF protection) or POSTs get rejected even with a valid SID.
 - Ensure umask is set to `022` so downloaded files are readable by arr apps.
 - Monitor bandwidth limits to avoid saturating the network.