From 808349bc2b255d0f3ff3ead755feb79c68b642a0 Mon Sep 17 00:00:00 2001 From: Frank Date: Sat, 29 Aug 2026 08:19:39 -0700 Subject: [PATCH] docs(arr): chain complete 4/4 + auth-config pitfall (v1 DryIoc 500 sprawl) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit All four arr roots live: /tv, /movies via API; /music, /books created after v1 validator layers peeled back (quality/metadata profile ids must reference existing profiles; v1 has no /api/v1/profile endpoint). Auth pitfall: the literal AuthenticationRequired=Disabled string throws DryIoc.ScopedItemException in v1 AuthorizationMiddleware on every request — the valid no-auth state is ABSENCE of the key. Fixed live on four containers, verified boot clean. --- serverAppConfigs-docs/Dankserver/ARR-Stack.md | 32 +++++++++++++------ 1 file changed, 22 insertions(+), 10 deletions(-) diff --git a/serverAppConfigs-docs/Dankserver/ARR-Stack.md b/serverAppConfigs-docs/Dankserver/ARR-Stack.md index a4ea237..ad3231c 100644 --- a/serverAppConfigs-docs/Dankserver/ARR-Stack.md +++ b/serverAppConfigs-docs/Dankserver/ARR-Stack.md @@ -364,16 +364,28 @@ per-arr qBittorrent clients (category = app name) → import**. and hand off to their own qB download client (category routing). Mappings materialize at grab time — zero mappings right after wiring is expected, not a fault. -**Chain completion (same day):** Sonarr and Radarr root folders created via -API (`/tv`, `/movies` → 201). Lidarr/Readarr roots deferred to their first-run -wizard (v1 API validators demand quality-profile ids that don't exist yet — two -clicks in the UI, not an API guess). The blocker under all of it: LSIO images -run as `PUID=1000`, which under rootless podman's userns maps to host uid -**101000 — a phantom user owning nothing**; Sonarr's own validator refused -`/tv` with "not writable by user 'abc'" (placeholder name for the unknown -uid). Fix: `PUID=0/PGID=0` on the arr stack + qbittorrent + prowlarr -(container-root = host's `dank`, which owns every media dir; mapping- -independent by construction). calibre-web and jellyfin untouched — not broken. +**Chain complete (same day):** all four arr roots live — Sonarr `/tv`, +Radarr `/movies` (201), and Lidarr `/music` + Readarr `/books` created via +API after the v1 validator layers peeled back one at a time +(`defaultQualityProfileId`/`defaultMetadataProfileId` must reference an +*existing* profile id on v1 apps; v1 has no `/api/v1/profile` endpoint — +probe endpoints by status code, empty body = absent). + +**Auth-config pitfall (found same day):** all five arrs shipped with +`AuthenticationMethod=None` **plus** `AuthenticationRequired=Enabled`. On the +v1 (.NET) apps that combo is self-contradictory — UI Save is permanently +disabled and any settings save throws +`DryIoc.ScopedItemException` inside `AuthorizationMiddleware` (500 sprawl on +every page after restart). The valid representation of "no auth" in v1 is +**absence of the `` key**, not the literal string +`Disabled` — readarr's config (key absent) booted clean while its three +siblings (key=`Disabled`) 500-sprawled, which is how it was caught. Fix +applied live: key deleted on sonarr/radarr/lidarr/prowlarr, containers +restarted, all five verified serving. Posture = zero-auth arrs on LAN and +WAN; the Anubis wall guards homepage/search/hermes/prometheus/romm/files +but **not** the arrs — if WAN exposure of `/sonarr`, `/radarr` etc. is +undesired, guard them in the Anubis policy or flip auth to `External` +(needs an IdP first; auth method choice remains an operator decision). ## Disk Layout