From ffae9b5e214d818f58565a9917d0cb4f251ff832 Mon Sep 17 00:00:00 2001 From: Frank Date: Tue, 1 Sep 2026 18:10:32 -0700 Subject: [PATCH] qBittorrent pinned to 4.6.7; all five download clients live-verified - qB 5.x's 204 login breaks Readarr's retired client at runtime; 4.6.7 answers legacy 200+Ok. Pin recorded in the unit and documented. - Prowlarr download client created via schema template; all five clients test 200 through the podman gateway. - PBKDF2 gotcha: qB 5.x conf rewrite left a hash 4.6.7 rejects; fresh rewrite of the same line restored login. - E2E: torrent through the Panama tunnel at ~17 MB/s, completed into Finished Torrents, deleted with data. --- .../Infrastructure/FrankBook-Pro.md | 30 ++++++++++++++----- serverAppConfigs-docs/log.md | 4 +++ 2 files changed, 26 insertions(+), 8 deletions(-) diff --git a/serverAppConfigs-docs/Infrastructure/FrankBook-Pro.md b/serverAppConfigs-docs/Infrastructure/FrankBook-Pro.md index 4741b75..c712434 100644 --- a/serverAppConfigs-docs/Infrastructure/FrankBook-Pro.md +++ b/serverAppConfigs-docs/Infrastructure/FrankBook-Pro.md @@ -84,7 +84,11 @@ are unaffected. (mode 600, VM-local) for the arr wiring. The first seed wrote the hash under the legacy `WebUI\Password` key (silently ignored → every client got `Unauthenticated`); the live conf was patched and - `scripts/deploy-remote.sh` fixed to write the `_PBKDF2` key. + `scripts/deploy-remote.sh` fixed to write the `_PBKDF2` key. Gotcha + (live, 2026-09-01): after qB 5.x ran, its conf rewrite left a hash line + 4.6.7 rejects (`invalid credentials` for every login, including the arrs); + rewriting the same `@ByteArray` line fresh (same password, 100k + iterations) restored login. Any future version flip: regenerate the line. - `HostHeaderValidation=false` + `ServerDomains=*`: the socat forwarder preserves the LAN `Host` header, which would otherwise be rejected. - **Save-path convention**: `Session\DefaultSavePath=/Volumes/COMPLETE/ @@ -96,20 +100,30 @@ are unaffected. files onward; nothing writes to the entropy volume. - Categories seeded: `Finished Torrents`, `lidarr`, `radarr`, `readarr`, `tv-sonarr` (all → `Finished Torrents`). -- **Download clients** (gateway `10.88.0.1:8080`, user `admin`): sonarr - (`tv-sonarr`), radarr, lidarr created via API, live tests pass. Readarr's - was transplanted by direct `readarr.db` row insert (app stopped): its EOL +- **Download clients** (gateway `10.88.0.1:8080`, user `admin`): all five test + green against live qB — sonarr (`tv-sonarr`), radarr, lidarr, readarr + (rows pre-created in the prior session; passwords re-pushed via API), and + prowlarr (created from the `/downloadclient/schema` template — a + hand-minimal body 400s in Prowlarr's create-time test). Readarr's EOL validator (last release 2023) rejects qB ≥ 5's `204` empty login success - as "Authentication failure", so an API create can never pass; runtime - cookie auth is unaffected. Treat readarr as best-effort. + as "Authentication failure" — that kills runtime auth too, not just API + creates; the fix was pinning qB itself (below), after which readarr tests + 200 like the rest. +- **qB pinned to 4.6.7** (`Image=lscr.io/linuxserver/qbittorrent:4.6.7`, + not `latest`): `latest` resolved to 5.x, whose `204` login breaks + Readarr's frozen client; 4.6.7 answers the legacy `200` + `"Ok."` that + every client accepts. Pinned in + `frankbook-pro/qbittorrent/quadlet/qbittorrent.container`. - **Prowlarr Applications** push to sonarr/radarr/lidarr (`fullSync`, gateway ports). Readarr deliberately omitted: prowlarr's indexer-push test to readarr's `/api/v1/indexer/test` 500s (EOL schema drift). Legacy `Prowlarr-*` indexer rows carried in the migrated dankserver DBs pointed at the unresolvable hostname `prowlarr:9696` and were deleted; the current `*(Prowlarr)` entries test OK. -- **E2E proven**: qB fetched a `.torrent` through the tunnel, downloaded at - ~19 MB/s, completed into `Finished Torrents`. +- **E2E proven (2026-09-01, on 4.6.7)**: added a legal test torrent via the + API with category `Finished Torrents` — downloaded through the tunnel + (~17 MB/s), qB moved it INCOMPLETE → COMPLETE into + `/Volumes/COMPLETE/Finished Torrents`, then deleted with data. # Citations diff --git a/serverAppConfigs-docs/log.md b/serverAppConfigs-docs/log.md index f316be0..f764843 100644 --- a/serverAppConfigs-docs/log.md +++ b/serverAppConfigs-docs/log.md @@ -312,3 +312,7 @@ timestamp: 2026-09-14 - `/serverAppConfigs-docs/Dankclaw/Seerr.md`, `/serverAppConfigs-docs/index.md` — service doc + index entry. - Lessons: rootless podman uid mapping is continuous (container N → host 100000+N-1; uid 1000 → 100999 — an off-by-one chown EACCES-crash-looped first boot); new quadlet bind-source dirs must pre-exist on target (statfs 125 otherwise); new vhost TLS issues at Caddy reload (~15 s dns-01), not at first request. - Authentik outpost claim cache fixed (root cause of the persistent `/admin` 403 despite homepage-admins membership): the outpost serves per-browser-session claims from `authentik_providers_proxy_proxysession` until row expiry — akadmin's live row predated the group add and carried `["authentik Admins"]` only, and the 403 never generates an authentik event. Deleted his 4 rows; the next visit re-authorizes silently against the untouched authentik login session. Silent re-auth proven live: deleted qa-e2e-admin's 13 rows, ran the e2e admin spec against the stale storage state — 2 passed in 2.9 s, no login prompt. Mechanism + diagnosis SQL documented in `/serverAppConfigs-docs/Infrastructure/Authentik.md` (new "Outpost claim cache" section + failure-mode row); the doc's data-path references updated to the 2026-09-01 Containers layout. +- WireGuard credentials provisioned (Panama PA-12 conf → gluetun env inside the VM): tunnel egress verified (exit IP Panama, not residential), qB WebUI published per plan, and Prowlarr → qBittorrent wired — all five download clients (prowlarr, sonarr, radarr, lidarr, readarr) test 200 against live qB through the podman gateway `10.88.0.1:8080`; Prowlarr's client created via its `/downloadclient/schema` template (hand-minimal body 400s on create-time test). +- `/frankbook-pro/qbittorrent/quadlet/qbittorrent.container` — pinned `lscr.io/linuxserver/qbittorrent:4.6.7`: `latest` had resolved to qB 5.x, whose `204` empty-body login success Readarr's retired client rejects as "Authentication failure" at runtime (not just in API creates — the prior session's "runtime cookie auth unaffected" assumption was wrong); 4.6.7 answers the legacy `200` + `"Ok."`. Gotcha: after 5.x ran, its conf rewrite left a PBKDF2 line 4.6.7 rejects — every login `invalid credentials`; rewriting the same line fresh (same password, 100k iterations) fixed it. +- `/docs/Infrastructure/FrankBook-Pro.md` — wiring, pin rationale, PBKDF2 version-flip gotcha, and E2E result (test torrent through the Panama tunnel at ~17 MB/s, INCOMPLETE → COMPLETE into `Finished Torrents`, deleted with data). +- `/scripts/deploy.sh` + `/scripts/deploy-plan.py` + `/tests/dankserver_quadlet.bats` — committed earlier today (`b206f47`): dankserver quadlet standardization units/handlers/routing.