arrstack: set *arr AuthenticationMethod=External (proxy-trusted) #382

2026-08-17T22:37:11+10:00

unkin-agent commented

2026-08-17 22:37:11 +10:00

Why

The *arr UIs reached through arrproxy were prompting "Authentication Required". Sonarr v4 (and Radarr/Prowlarr on the same Servarr auth code) refuses remote access when AuthenticationMethod=None, so the web UI kept demanding a login even though arrproxy + oauth2-proxy already authenticate every user at the front door. That is a double prompt with no purpose.

Change

Extend the existing apikey-init container for sonarr / radarr / prowlarr to also idempotently enforce, in /config/config.xml:

<AuthenticationMethod>External</AuthenticationMethod>
<AuthenticationRequired>Enabled</AuthenticationRequired>

Create-or-replace both elements (same idempotent sed/printf pattern already used for <ApiKey>/<UrlBase>), without disturbing ApiKey or UrlBase. Pods use Recreate, so they roll and re-run the init container on apply.

Why this is the correct, header-less fix

In the Servarr v4 source, AddExternal() registers the identical NoAuthenticationHandler as AddNone() — External requires no username header (no X-Forwarded-User / Remote-User). It differs from None only in that it is exempt from the None remote-access block, so the UI stops prompting while remote access is permitted.

This matters because arrproxy's trustBoundary deliberately strips all inbound identity headers and forwards only the real X-Api-Key to the upstream *arr — it forwards no username header. Because External needs none, that stripping is irrelevant and no arrproxy change is required. The API path is unaffected (arrproxy injects the real key; *arr API auth is key-based regardless of AuthenticationMethod).

Validation

kustomize build --enable-helm apps/overlays/au-syd1/arrstack → OK (rendered init carries the auth logic for all 3 apps)
pre-commit (yamllint + all hooks) → Passed

Versions in scope: sonarr 4.0.19, radarr 6.3.0, prowlarr 2.5.2 (all share the Servarr v4 auth handler).

## Why The *arr UIs reached through **arrproxy** were prompting **"Authentication Required"**. Sonarr v4 (and Radarr/Prowlarr on the same Servarr auth code) refuses remote access when `AuthenticationMethod=None`, so the web UI kept demanding a login even though **arrproxy + oauth2-proxy already authenticate every user at the front door**. That is a double prompt with no purpose. ## Change Extend the existing `apikey-init` container for **sonarr / radarr / prowlarr** to also idempotently enforce, in `/config/config.xml`: - `<AuthenticationMethod>External</AuthenticationMethod>` - `<AuthenticationRequired>Enabled</AuthenticationRequired>` Create-or-replace both elements (same idempotent sed/printf pattern already used for `<ApiKey>`/`<UrlBase>`), without disturbing ApiKey or UrlBase. Pods use `Recreate`, so they roll and re-run the init container on apply. ## Why this is the correct, header-less fix In the Servarr v4 source, `AddExternal()` registers the **identical `NoAuthenticationHandler` as `AddNone()`** — `External` requires **no** username header (no `X-Forwarded-User` / `Remote-User`). It differs from `None` only in that it is **exempt from the None remote-access block**, so the UI stops prompting while remote access is permitted. This matters because arrproxy's `trustBoundary` deliberately **strips all inbound identity headers** and forwards only the real `X-Api-Key` to the upstream *arr — it forwards no username header. Because `External` needs none, that stripping is irrelevant and **no arrproxy change is required**. The API path is unaffected (arrproxy injects the real key; *arr API auth is key-based regardless of AuthenticationMethod). ## Validation - `kustomize build --enable-helm apps/overlays/au-syd1/arrstack` → OK (rendered init carries the auth logic for all 3 apps) - pre-commit (yamllint + all hooks) → Passed Versions in scope: sonarr 4.0.19, radarr 6.3.0, prowlarr 2.5.2 (all share the Servarr v4 auth handler).

unkin-agent added 1 commit 2026-08-17 22:37:12 +10:00

arrstack: set *arr AuthenticationMethod=External (proxy-trusted)

ci/woodpecker/pr/vector-test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/kubeconform Pipeline was successful

Details

66eb81b5e0

The *arr UIs behind arrproxy prompt "Authentication Required" because
Sonarr v4 refuses remote access when AuthenticationMethod=None. Since
arrproxy + oauth2-proxy already authenticate every user at the front
door, the *arr apps should defer UI auth to the proxy instead of
double-prompting.

Extend the existing apikey-init container for sonarr/radarr/prowlarr to
also idempotently enforce <AuthenticationMethod>External</AuthenticationMethod>
and <AuthenticationRequired>Enabled</AuthenticationRequired> in
/config/config.xml (create or replace, without disturbing ApiKey/UrlBase).

In Servarr v4 External registers the same NoAuthenticationHandler as None
(no username header required) but is exempt from the None remote-access
block, so it stops the UI login prompt without needing arrproxy to forward
any identity header (arrproxy's trustBoundary strips those by design).

benvin merged commit 108d1cb213 into main

2026-08-18 20:03:19 +10:00

benvin deleted branch benvin/arr-external-auth

2026-08-18 20:03:19 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/argocd-apps#382