docs: rename frank-default-large/small/sightsound to frank-large/small/npu across vault
Mechanical identity rename across the knowledge base, AGENTS.md, README, the
hermes config example, and homepage services.json. No behavior change; served
aliases on the LLM endpoints change with the deploy of commit 69f87c8.
This commit is contained in:
Frank committed
1 parent
5a083eee6c
commit
8212d4451a
68 files changed
+1053
-1207
No files matched your search
@@ -1,27 +1,44 @@
|
||||
---
|
||||
type: reference
|
||||
title: qBittorrent
|
||||
description: qBittorrent download client for the *arr stack — pinned 4.6.7 on FrankBook-Pro, shares the Gluetun WireGuard netns, PBKDF2 WebUI credential recipe.
|
||||
tags: [qbittorrent, arr-stack, frankbook-pro, gluetun]
|
||||
timestamp: 2026-09-03T00:00:00Z
|
||||
---
|
||||
|
||||
# qBittorrent
|
||||
|
||||
qBittorrent is the torrent download client for the *arr stack on Dankserver. It receives download requests from Sonarr, Radarr, Lidarr, and Readarr via category tagging.
|
||||
qBittorrent is the torrent download client for the *arr stack. The stack runs on
|
||||
**FrankBook-Pro** (the Mac mini) as quadlet units inside its podman machine —
|
||||
not on Dankserver. It receives download requests from Sonarr, Radarr, Lidarr,
|
||||
and Readarr via category tagging.
|
||||
|
||||
**Host:** Dankserver — **Hostname:** `qbittorrent.dankserver.local` — **Docs:** https://www.qbittorrent.org
|
||||
**Host:** FrankBook-Pro (podman machine) — **Access:** WebUI on port `8080`,
|
||||
published by the [[Gluetun]] unit because qBittorrent shares that container's
|
||||
network namespace (a netns-sharer publishes no ports of its own).
|
||||
|
||||
## Facts
|
||||
|
||||
| Item | Value |
|
||||
|------|-------|
|
||||
| Image | `lscr.io/linuxserver/qbittorrent:latest` |
|
||||
| Port | 8080 (host) → 8080 (container) |
|
||||
| Min RAM | 512 MB |
|
||||
| Auth | Web UI username/password; LAN mode available |
|
||||
| Image | `lscr.io/linuxserver/qbittorrent:4.6.7` — **pinned**, see the pin rationale below |
|
||||
| Network | `Network=gluetun.container` (torrent egress exits via the WireGuard/ProtonVPN tunnel) |
|
||||
| Ports | 8080 (WebUI) and 6881 TCP+UDP published on the gluetun unit |
|
||||
| Env | `PUID=0`, `PGID=0`, `TZ=America/Los_Angeles`, `UMASK_SET=022` |
|
||||
| Volumes | `/Volumes/COMPLETE/qbittorrent-data:/config`, plus `/Volumes/COMPLETE` and `/Volumes/INCOMPLETE` mounted at identical paths |
|
||||
| Auth | Web UI username/password (`admin` + generated password); LAN bypass not used |
|
||||
|
||||
## Configuration
|
||||
## Why the 4.6.7 pin exists (2026-09-01)
|
||||
|
||||
1. Keep Web UI authentication ON (LAN bypass not needed — the arr apps
|
||||
authenticate with the API) and give them a permanent password.
|
||||
2. Create download categories per app (`radarr`, `sonarr`, `lidarr`,
|
||||
`readarr`): the arr download clients route category-per-app, and Prowlarr
|
||||
feeds hand grabs to each app's own client.
|
||||
3. Set max active downloads: Settings → Downloads (recommended: 5 global,
|
||||
3 per category).
|
||||
Readarr's abandoned qBittorrent client rejects qB ≥ 5's **204 empty-body login
|
||||
success** as `Authentication failure` — a runtime break, not just an API-create
|
||||
issue. The fleet pins `lscr.io/linuxserver/qbittorrent:4.6.7` while Readarr is
|
||||
in the stack. **Never unpin to `latest` while Readarr is in the fleet.**
|
||||
|
||||
Second trap on any version flip: qB 5.x's shutdown conf rewrite leaves a
|
||||
`WebUI\Password_PBKDF2=@ByteArray(...)` line that 4.6.7 rejects — every login
|
||||
then returns "invalid credentials" (the arrs included). Fix = rewrite the same
|
||||
conf line with the same password while qB is stopped.
|
||||
|
||||
## Persistent WebUI credentials (verified 2026-08-30)
|
||||
|
||||
@@ -46,31 +63,34 @@ val = (base64.b64encode(salt) + b":" + base64.b64encode(h)).decode()
|
||||
|
||||
Then `podman start qbittorrent` and confirm login survives a
|
||||
`podman restart` — the temp-password rotation stops the moment stored
|
||||
credentials verify. The chosen value lives host-local in
|
||||
`/home/dank/.qbpass` (mode 600, owner `dank`) — never in git; every arr
|
||||
download client and `prowlarr.md` reference it. (The classic
|
||||
`@ByteArray(salt+hash)` form is WRONG for qb5: login 401s on it; verify()
|
||||
base64-decodes the two halves separately.)
|
||||
credentials verify. The chosen value lives host-local in `/home/dank/.qbpass`
|
||||
(mode 600, owner `dank`) — never in git; every arr download client and
|
||||
[[Prowlarr]] reference it. (The classic `@ByteArray(salt+hash)` form is WRONG
|
||||
for qb5: login 401s on it; verify() base64-decodes the two halves separately.)
|
||||
|
||||
## Docker Compose
|
||||
## Deployment (current)
|
||||
|
||||
```yaml
|
||||
qbittorrent:
|
||||
image: lscr.io/linuxserver/qbittorrent:latest
|
||||
container_name: qbittorrent
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- PUID=1000
|
||||
- PGID=1000
|
||||
- TZ=America/New_York
|
||||
- UMASK_SET=022
|
||||
volumes:
|
||||
- /opt/qbittorrent/config:/config
|
||||
- /mnt/media/downloads:/downloads
|
||||
- /mnt/media/downloads/incomplete:/downloads/incomplete
|
||||
ports:
|
||||
- "8080:8080"
|
||||
networks: [appnet]
|
||||
Quadlet unit `qbittorrent.container` from this repo
|
||||
(`frankbook-pro/qbittorrent/quadlet/`), installed inside the podman machine at
|
||||
`/home/core/.config/containers/systemd/qbittorrent.service` by the
|
||||
frankbook-pro handler in `scripts/deploy-remote.sh`:
|
||||
|
||||
```ini
|
||||
[Container]
|
||||
ContainerName=qbittorrent
|
||||
Image=lscr.io/linuxserver/qbittorrent:4.6.7
|
||||
Network=gluetun.container
|
||||
Environment=PUID=0
|
||||
Environment=PGID=0
|
||||
Environment=TZ=America/Los_Angeles
|
||||
Environment=UMASK_SET=022
|
||||
Volume=/Volumes/COMPLETE/qbittorrent-data:/config
|
||||
Volume=/Volumes/COMPLETE:/Volumes/COMPLETE
|
||||
Volume=/Volumes/INCOMPLETE:/Volumes/INCOMPLETE
|
||||
|
||||
[Service]
|
||||
TimeoutStartSec=900
|
||||
Restart=always
|
||||
```
|
||||
|
||||
## Gotchas (verified live)
|
||||
@@ -81,9 +101,17 @@ qbittorrent:
|
||||
download queue" in the arr logs) after any restart.
|
||||
- API login from `curl` needs a `Referer: http://<host>:<port>/` header
|
||||
(CSRF protection) or POSTs get rejected even with a valid SID.
|
||||
- Cookie-name quirk by version: qB 5.x names its WebUI session cookie
|
||||
`QBT_SID_<port>`; 4.6.7 uses plain `SID`. Any automation must parse the
|
||||
cookie generically (e.g. `grep -oE '[A-Za-z_]*SID[A-Za-z0-9_]*=[^;[:space:]]*'`)
|
||||
instead of hard-coding a port-suffixed name, or it fails with 403 cascades
|
||||
that never reach qB as failed logins.
|
||||
- Egress verification for this stack must run **inside the gluetun container**
|
||||
(`podman exec gluetun wget -qO- https://ipinfo.io/json`); running the same
|
||||
probe one ssh-context out returns the residential IP — a false leak alarm.
|
||||
- Ensure umask is set to `022` so downloaded files are readable by arr apps.
|
||||
- Monitor bandwidth limits to avoid saturating the network.
|
||||
|
||||
## See Also
|
||||
|
||||
- [[ARR-Stack]] — full *arr stack documentation
|
||||
- [[Gluetun]] — the WireGuard tunnel this container shares
|
||||
Reference in new issue
Block a user