From e4644de722923349272060efa61f6255f323e0f5 Mon Sep 17 00:00:00 2001 From: Frank Date: Sat, 29 Aug 2026 04:58:33 -0700 Subject: [PATCH] =?UTF-8?q?docs(arr):=20record=20live=20auth=20posture=20?= =?UTF-8?q?=E2=80=94=20zero-user=20login=20gate,=20first-account-wins?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Verified live: AuthenticationMethod=None + AuthenticationRequired=Enabled on all five arrs; unauthenticated API probes return 401 both locally and through the vhosts. Also records the as-built divergences (entropy mounts, LA timezone, readarr tag pin, prowlarr mount fix) that supersede the design compose. --- serverAppConfigs-docs/Dankserver/ARR-Stack.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/serverAppConfigs-docs/Dankserver/ARR-Stack.md b/serverAppConfigs-docs/Dankserver/ARR-Stack.md index 7c57474..a18854c 100644 --- a/serverAppConfigs-docs/Dankserver/ARR-Stack.md +++ b/serverAppConfigs-docs/Dankserver/ARR-Stack.md @@ -320,6 +320,25 @@ Profile: Music - Standard | Resource usage | Minimal | Moderate | Use Copyparty for curated file collections. Use *arr for automatic downloads. Use both together for maximum functionality — point *arr download directories at Copyparty's watched folders. +## Live State (as-built, verified 2026-08-29) + +Deployed shape differs from the design compose above — reality wins: + +- Mounts are the real array paths (`/mnt/entropy/downloads`, case-exact dirs + like `Movies`/`TVShows`), not `/mnt/media/*`; TZ is `America/Los_Angeles`. +- Readarr runs `lscr.io/linuxserver/readarr:amd64-1.0.980` — LSIO ships no + untagged `latest` for readarr; the tag was pinned after a manifest probe. +- Prowlarr's `/config` mount was missing mid-deploy (off-by-one in an edit); + restored in commit `67695cf`. +- **Auth posture: every arr runs `AuthenticationMethod=None` + + `AuthenticationRequired=Enabled`** — verified live via each config.xml and by + probing `/api/v3/system/status` unauthenticated (401 on all five, local and + through the vhost). Net effect: a login screen with **zero users defined**; + whoever creates the first account owns the instance. Decide the auth method + (`None` behind the Anubis wall vs `External` via authentik) *before* WAN + exposure — first-account-wins is the current race condition. +- API keys live in each `/config/config.xml` (``); they are local-only + secrets and stop being secret the moment a vhost serves the API unauthenticated. ## Disk Layout