Skip to content

docs: consolidate community PRs and refresh Sonarr security settings - #455

Merged
thezak48 merged 17 commits into
Servarr:masterfrom
bakerboy448:docs/community-pr-consolidation
Sep 4, 2026
Merged

docs: consolidate community PRs and refresh Sonarr security settings#455
thezak48 merged 17 commits into
Servarr:masterfrom
bakerboy448:docs/community-pr-consolidation

Conversation

@bakerboy448

@bakerboy448 bakerboy448 commented Jul 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Consolidates the actionable open community PRs, resolves the reported issues, and refreshes the Sonarr Security settings docs. Every change is verified against the actual *arr source or authoritative docs, not the contributor's word, after several reported "facts" turned out to be wrong.

Security settings refresh (sonarr/settings.md)

The Security section was missing a setting and a CVE that current users need. Verified against Sonarr source (develop branch) and the published GitHub Security Advisory:

  • Adds the missing Authentication Required setting (Enabled / Disabled for Local Addresses). The existing Allowed Hosts bullet referenced it, but it was never documented on its own.
  • Documents External auth as a hidden, config/env-only method. It maps to the same no-op auth handler as None (AuthenticationBuilderExtensions.cs), so it bypasses Sonarr's own auth entirely.
  • Notes that None is no longer selectable in the UI for new configs (isDisabled in SecuritySettings.js).
  • Cross-references CVE-2026-30975 / GHSA-h5qx-5hjf-7c9r (High, patched 4.0.16.2942 nightly / 4.0.16.2944 stable). Disabled for Local Addresses without a reverse proxy listed in Trusted Networks lets a spoofed X-Forwarded-For bypass auth.
  • Documents Trust CGNAT IP Addresses, a config.xml/env-only setting not in the UI. It treats 100.64.0.0/10 (Tailscale's range) as local for the Disabled for Local Addresses check, and is inert under External.

Allowed Hosts health check and setting (all *arr apps)

Documents the Allowed Hosts Not Configured health check and the Allowed Hosts General/Host setting, both previously undocumented. Verified against upstream source (AllowedHostsCheck.cs, ConfigureHostFilteringOptions.cs, AllowedHostsParser.cs, en.json):

  • system.md: adds the Allowed Hosts Not Configured System Warning (anchor #allowed-hosts-not-configured, matching the app's own health-check link) to Sonarr, Radarr, Prowlarr, Lidarr, and Whisparr, plus the matching Table of Contents entry. The check warns when Allowed Hosts is empty and Authentication Required is not Enabled, and re-runs on startup and on config save.
  • settings.md: documents the Allowed Hosts setting under General → Host for Radarr, Prowlarr, and Whisparr (Sonarr already had it), and adds a General → Host section to Lidarr, which had none. Includes a *.internal example for Docker containers named with a .internal suffix.
  • When Authentication Required is not Enabled, the API/UI config validator (HostConfigController.cs) rejects a blank Allowed Hosts, so at least one host is required in that configuration. A blank value is accepted only when Authentication Required is Enabled, where the host filter (ConfigureHostFilteringOptions) then allows any hostname.
  • Readarr is archived and does not carry the check, so it is left undocumented.

Upstream feature PRs this documents: Sonarr/Sonarr#8905, Radarr/Radarr#11654, Prowlarr/Prowlarr#2798, Lidarr/Lidarr#5809, and Whisparr via Sonarr upstream sync Whisparr/Whisparr#1221.

Cherry-picked from open PRs

Issues resolved

Closed, verified not actionable

Closes #434
Closes #445
Closes #444
Closes #450
Closes #448
Closes #432
Closes #437
Closes #441

Audit corrections

Re-review of the earlier audit commit against the actual *arr source. Two prior "audit" edits were wrong and are corrected here:

  • Rolling log-file count restored to 51 total. ReconfigureLogging sets MaxArchiveFiles = LogRotate (default 50), so the "5/6" value reflected only the pre-config bootstrap.
  • Lidarr SQLite guidance restored. Lidarr does bundle libe_sqlite3.so (verified in running containers; SourceGear.sqlite3), so the old-OS/GLIBC root cause and the symlink workaround are the correct fix, not "just install libsqlite3-0".

Broken-link fixes

Repaired broken internal links surfaced by a wiki-wide scan: Radarr/Readarr #windows now points to the Windows install page, Radarr/Readarr/Whisparr #twitter to #twitter-connect, and the Prowlarr FAQ backup anchor. A larger pre-existing broken-link and anchor backlog remains and is out of scope here.

Deprecations

Left open (need follow-up, not closed here)

@bakerboy448
bakerboy448 force-pushed the docs/community-pr-consolidation branch from 7b5672a to 475c041 Compare July 19, 2026 18:33
@bakerboy448
bakerboy448 force-pushed the docs/community-pr-consolidation branch from 0f43172 to 54f1c93 Compare August 10, 2026 01:31
@bakerboy448 bakerboy448 changed the title docs: consolidate community PRs and resolve grounded issues docs: consolidate community PRs and refresh Sonarr security settings Aug 30, 2026
@bakerboy448

bakerboy448 commented Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

@augustuen poke as it covers the recent trusted access setting updates and various other issues

bakerboy448 and others added 13 commits September 4, 2026 16:13
@bakerboy448
docs: fix audit findings across Sonarr/Radarr/Lidarr/Prowlarr
1e757f2 
Follow-on to Servarr#452. Source-grounded corrections verified against local app
clones on the documented release branches (Sonarr main = v4; Radarr,
Lidarr, Prowlarr develop). Includes factual fixes (stylelint script name,
FreeBSD data-dir contradiction, Mono->Package headings, CONTRIBUTING
markdownlint config + workflow name), broken link/anchor fixes, and
filled stubs (Sonarr tips-and-tricks, install sections).

Whisparr is intentionally excluded (its v2 series-domain re-frame is a
separate effort). v5/dev-only claims (e.g. .NET10) were verified and NOT
applied -- the wiki documents the released line.
@bakerboy448 @Dark-Alex-17 @helliott20
docs: add Managarr and Prunerr to useful tools
b9b07e2 
Managarr is a Rust TUI/CLI for managing *arr servers (Radarr/Sonarr/Lidarr).
Prunerr is a Plex/Sonarr/Radarr library-cleanup tool with a review queue.

Both repos verified to exist and match their descriptions.

Closes Servarr#443
Closes Servarr#449

Co-authored-by: Alex Clarke <39523942+Dark-Alex-17@users.noreply.github.com>
Co-authored-by: helliott20 <112109388+helliott20@users.noreply.github.com>
@bakerboy448 @Stijnvi
fix(radarr): correct PowerShell folder-creation snippet
a7d4a70 
The leading-pipe line continuation is invalid in Windows PowerShell 5.1
(only parses in PowerShell 7+). Use a trailing pipe so the snippet works
in the shipped Windows PowerShell as the surrounding text states.

Closes Servarr#435

Co-authored-by: Stijnvi <145622904+Stijnvi@users.noreply.github.com>
@bakerboy448
docs: use X-Forwarded-Host for non-standard reverse-proxy ports
28b0125 
The non-standard-port warning told Lidarr/Readarr/Whisparr users to set the
`Host` header; the apps read the forwarded host from `X-Forwarded-Host`
(NzbDrone.Host/Startup.cs configures ForwardedHeaders.XForwardedHost), so
`Host` does not convey the external port. Match the wording already used in
the Sonarr/Radarr guides and tidy the redundant Prowlarr block.

Closes Servarr#383
@bakerboy448
docs: expand command-line DB recovery instructions
7ac9b12 
Add sqlite3 CLI install guidance (distinct from the bundled libsqlite3),
a version check with fallback to the UI method, and an integrity_check
verification step. Fix the "covered"/"recovered" typo.

Closes Servarr#438
@bakerboy448
docs(prowlarr): note podman MTU fix for Cloudflare indexer timeouts
591f534 
Under podman the CNI/netavark bridge defaults to MTU 1500, which times out
Cloudflare-protected indexers while DNS and other sites work. Document
recreating the network with a lower MTU.

Closes Servarr#428
@bakerboy448
fix: remove non-functional whisparr-v3 (eros) install option
e9d28c3 
Upstream stopped publishing native eros build artifacts (last build was
3.1.0.2116 in Jan 2026, since purged from Azure DevOps); the eros update
endpoint now 404s and no other branch serves a native Whisparr V3 build.
Whisparr V3 is Docker-only upstream, so the menu option could only ever
fail. Remove it; native installs still cover Whisparr V2 via the whisparr
option. Bump script version to 3.1.18.

Closes Servarr#439
@bakerboy448
fix: install libicu for .NET runtime on minimal Debian/Ubuntu
ccda498 
Self-contained .NET apps require system ICU, which isn't present on minimal
installs, causing the apps to fail to start. Add `libicu-dev` to the
prerequisites: it is version-agnostic and pulls the correct `libicuNN`
runtime for each Debian/Ubuntu release (libicu72 on Debian 12, libicu76 on
Debian 13, libicu70 on Ubuntu 22.04, libicu74 on 24.04, etc.), avoiding a
hardcoded version that only works on one release.

Closes Servarr#454
@bakerboy448
docs: mark Synology ARM Docker guide as deprecated
f122189 
The guide dates from 2021 and depends on an unmaintained third-party
bootstrap pinning Docker 20.10.0 and Compose v1; it hasn't been validated
against current DSM and may no longer work. Add a deprecation banner and
tag so readers are warned before following it. A validated modern rewrite
is still needed.

Refs Servarr#402
@bakerboy448
style: quote color variables in install script (SC2086)
c6b20c6 
Wrap the ANSI color variables in the `echo -e` lines so shellcheck no
longer flags SC2086. Quoting-only; no behavior change (the color codes
contain no whitespace or globs).
@bakerboy448
fix: correct rolling log-file count (Lidarr/Sonarr)
19ea9dc 
The audit commit changed the info-log count to "5 archived files" (Lidarr)
and "6 log files total" (Sonarr), reflecting only the pre-config bootstrap
value. Once config loads, ReconfigureLogging sets MaxArchiveFiles = LogRotate
(default 50), so the effective default is 51 total, matching the debug/trace
statements. Restore "51 log files total".
@bakerboy448
fix: restore Lidarr bundled-SQLite / GLIBC workaround guidance
b68c393 
The audit rewrite claimed Lidarr does not bundle SQLite and loads the
system libsqlite3.so.0, reducing the fix to "apt install libsqlite3-0".
That is wrong and dropped the root-cause nuance (old OS / old GLIBC on
EOL distros). Verified against running containers: /app/bin/libe_sqlite3.so
is bundled and no system libsqlite3.so is present. Restore the original
section documenting the bundled build, the GLIBC requirement on EOL
distros (Debian 10/11, Ubuntu 18.04/20.04, older Synology DSM), and the
symlink-the-system-library workaround (recreated after each update).
@bakerboy448
fix: repair broken internal wiki links
22ba5ea 
- Radarr/Readarr multiple-instances "already installed" links pointed at a
  non-existent #windows anchor; point them at the Windows install page
  (matching the Sonarr fix).
- Radarr/Readarr/Whisparr supported.md Twitter link used #twitter; the
  section anchor is #twitter-connect.
- Prowlarr FAQ backup link used #how-do-i-backuprestore-my-prowlarr; the
  heading anchor is #how-do-i-backuprestore-prowlarr.
@bakerboy448
bakerboy448 force-pushed the docs/community-pr-consolidation branch from dc8c3a6 to 545ae3f Compare September 4, 2026 21:32
bakerboy448 and others added 3 commits September 4, 2026 16:40
@bakerboy448
docs: clarify sqlite3 CLI note in DB recovery
4be92cd
@bakerboy448 @claude
fix(docs): add language to fenced code blocks in lidarr tips-and-tricks
e93e8fe 
CI's markdownlint MD040 rule flagged two untagged fenced blocks.

Co-Authored-By: Claude <noreply@anthropic.com>
@bakerboy448
docs(sonarr): document Authentication Required, External auth, and CV…
b6a4808 
…E-2026-30975

Adds the missing Authentication Required setting (Enabled / Disabled for
Local Addresses), documents External auth as a hidden config/env-only
method that bypasses Sonarr's own auth entirely, and cross-references
CVE-2026-30975 (GHSA-h5qx-5hjf-7c9r) with its Trusted Networks-dependent
fix. Also documents Trust CGNAT IP Addresses, a config.xml/env-only
setting not exposed in the UI.

Verified against Sonarr source (develop branch, AuthOptions.cs,
UiAuthorizationHandler.cs, ForwardedHeadersConfigurator.cs,
SecuritySettings.js, AuthenticationBuilderExtensions.cs) and the
published GitHub Security Advisory.
@bakerboy448
bakerboy448 force-pushed the docs/community-pr-consolidation branch from 545ae3f to 1a9bf3a Compare September 4, 2026 21:40
@bakerboy448
docs: document Allowed Hosts setting and health check across *arr apps
9bdad37 
Add the "Allowed Hosts Not Configured" System Warning to the system pages of
Sonarr, Radarr, Prowlarr, Lidarr, and Whisparr, and document the Allowed Hosts
General/Host setting on each settings page (creating a General/Host section for
Lidarr, which lacked one).

The check warns when Allowed Hosts is empty and Authentication Required is not
set to Enabled. In that configuration the API/UI config validator
(HostConfigController.cs) rejects a blank value, so at least one host is
required; a blank value is accepted only when Authentication Required is
Enabled, where the host filter then allows any hostname. Adds a *.internal
example for Docker containers named with a .internal suffix. Readarr is
archived and does not carry the check.

Verified against upstream source (AllowedHostsCheck.cs,
ConfigureHostFilteringOptions.cs, AllowedHostsParser.cs, HostConfigController.cs,
en.json): Sonarr/Sonarr#8905, Radarr/Radarr#11654, Prowlarr/Prowlarr#2798,
Lidarr/Lidarr#5809, and Whisparr via Sonarr sync Whisparr/Whisparr#1221.
@bakerboy448
bakerboy448 force-pushed the docs/community-pr-consolidation branch from 1a9bf3a to 9bdad37 Compare September 4, 2026 21:45
@thezak48
thezak48 merged commit 478a4cf into Servarr:master Sep 4, 2026
2 checks passed
This was referenced Sep 4, 2026
Merged
Open
@bakerboy448 bakerboy448 mentioned this pull request Oct 18, 2026
Open
@ohthehugemanatee ohthehugemanatee mentioned this pull request Oct 18, 2026
Open
This was referenced Oct 18, 2026
Open
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment