From 4c839600354aaac7ddee3c4ac891835157b2d6d1 Mon Sep 17 00:00:00 2001 From: dtoro Date: Sat, 13 Jun 2026 11:58:21 +0200 Subject: [PATCH] =?UTF-8?q?docs:=20sab.hubris.network=20Authentik=20auth?= =?UTF-8?q?=20=E2=80=94=20update=20arriman=20+=20caddy=20pages?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- containers/121-caddy.md | 5 ++++- containers/122-arriman.md | 27 +++++++++++++++++++++------ 2 files changed, 25 insertions(+), 7 deletions(-) diff --git a/containers/121-caddy.md b/containers/121-caddy.md index 491f366..0f316e1 100644 --- a/containers/121-caddy.md +++ b/containers/121-caddy.md @@ -28,7 +28,7 @@ The reverse proxy. Terminates TLS for every `*.hubris.network` hostname on the L - `photos.hubris.network` → [mule-images (120)](120-mule-images.md) `:3000` - `proxmox.hubris.network` → [hubris host](../hosts/hubris.md) `:8006` - `qbit.hubris.network` → [arriman (122)](122-arriman.md) `:8080` -- `sab.hubris.network` → [arriman (122)](122-arriman.md) `:8081` +- `sab.hubris.network` → [arriman (122)](122-arriman.md) `:8082` (Authentik forward-auth) > **Reminder:** Caddy alone isn't enough to make a new subdomain reachable on the LAN. Each one needs an entry in [DNS split-horizon](../infrastructure/dns.md) too. @@ -65,6 +65,9 @@ Gitea webhook id 2 on `dtoro/caddy-conf`. Receiver, deploy script, install scrip ## Changelog +### 2026-06-13 — sab.hubris.network gated with Authentik forward-auth; port fixed :8081→:8082 +`sab.hubris.network` now uses `import authentik` inside a `handle` block. SABnzbd own auth disabled, `local_ranges` set for transparent proxy. Port bumped from `:8081` to `:8082` (fix from 2026-06-04) now documented. + ### 2026-06-06 — Caddyfile truncated to 43 lines; restored from origin/master + safeguards added **Symptom:** All `*.hubris.network` hosts except `photos` and `auth` (VPS-hosted) returned `tlsv1 alert internal error` or timeout. Only 3 site blocks (`photos`, `prism`, `photos2`) remained in the Caddyfile. diff --git a/containers/122-arriman.md b/containers/122-arriman.md index 2c1bf98..daeea14 100644 --- a/containers/122-arriman.md +++ b/containers/122-arriman.md @@ -56,18 +56,30 @@ via `gluetun:` (e.g. Sonarr → qBittorrent at `localhost:8080` or Path mapping: host `/mnt/library/` ↔ container `/data/media/`. Downloads: host `/mnt/library/downloads//` ↔ container `/data/torrents/` and `/data/usenet/`. -## Auth (qBit reverse-proxy + Authentik forward-auth) +## Auth (reverse-proxy + Authentik forward-auth) -qBit auto-login behind forward-auth via IP whitelist. `qBittorrent.conf` lines: -- `WebUI\AuthSubnetWhitelist=172.18.0.0/16, 172.17.0.0/16, 192.168.8.175/32` -- `WebUI\ReverseProxySupportEnabled=true` -- `WebUI\TrustedReverseProxiesList=192.168.8.175, 172.18.0.0/16` +### qBit + +Auto-login behind forward-auth via IP whitelist. `qBittorrent.conf` lines: +- `WebUI\\AuthSubnetWhitelist=172.18.0.0/16, 172.17.0.0/16, 192.168.8.175/32` +- `WebUI\\ReverseProxySupportEnabled=true` +- `WebUI\\TrustedReverseProxiesList=192.168.8.175, 172.18.0.0/16` > **Stop the container before editing `qBittorrent.conf`.** qBit writes its in-memory config on graceful shutdown and clobbers any live edits. Recipe: `docker stop qbittorrent && sed -i ... && docker start qbittorrent`. Mobile/desktop clients keep working via `/api/v2/*` path bypass on Caddy. -SABnzbd `host_whitelist`: `sabnzbd, localhost, 127.0.0.1, 192.168.8.132, sab.hubris.network` — extend before accessing SAB from a new host. +### SABnzbd + +Gated with Authentik forward-auth (applied 2026-06-13). Caddy `sab.hubris.network` block uses `import authentik` inside a `handle` block. SABnzbd's own web auth is disabled: + +- `html_login = 0` → no HTML login form +- `username` / `password` cleared → CherryPy Basic Auth not activated +- `local_ranges = 172.18.0.0/16, 192.168.8.0/24, 127.0.0.0/8` → proxied requests from Caddy (192.168.8.x) and Docker-proxy (172.18.x) pass without auth + +**API key** (`67ef5a45e4e04157994e977005a33878`) still works for internal service-to-service calls (Sonarr/Radarr/Lidarr via Docker internal networking — they talk to SAB at `localhost:8082`, not through Caddy). + +`host_whitelist`: `sabnzbd, localhost, 127.0.0.1, 192.168.8.132, sab.hubris.network` — extend before accessing SAB from a new host. ## Credentials @@ -109,6 +121,9 @@ Member of [media GID 10000](../infrastructure/media-permissions.md). The LXC has ## Changelog +### 2026-06-13 — SABnzbd gated with Authentik forward-auth +SABnzbd now uses Authentik forward-auth (same `import authentik` Caddy pattern as qBit). SABnzbd's own web auth disabled: `html_login=0`, credentials cleared, `local_ranges` extended to cover Docker bridge + homelab LAN. API key still works for internal *arr service calls. See [Auth section](#auth-reverse-proxy--authentik-forward-auth) above. + ### 2026-06-04 — all arr services moved behind gluetun VPN; SAB port conflict fixed - All services (sonarr, radarr, lidarr, bazarr, prowlarr, jellyseerr, homarr,