docs: source-grounding sweep of the *arr wiki (security, settings, health checks) - #466
Merged
augustuen merged 15 commits intoSep 5, 2026
Merged
Conversation
This was referenced Sep 4, 2026
bakerboy448
force-pushed
the
docs/security-settings-grounding
branch
from
September 5, 2026 00:04
bd426ac to
88e1c45
Compare
bakerboy448
changed the title
bakerboy448
marked this pull request as draft
September 5, 2026 01:00
bakerboy448
force-pushed
the
docs/security-settings-grounding
branch
from
September 5, 2026 01:07
4c0753a to
f85a8e9
Compare
bakerboy448
changed the title
bakerboy448
changed the title
jasonpatrickellykrause
left a comment
jasonpatrickellykrause
left a comment
Contributor
There was a problem hiding this comment.
Source-verified review. All changes check out against released tags except one item in sonarr/supported.md.
IMDb note needs correction
The IMDb import list was fully removed from Sonarr on 2025-02-16 (commit 33da537a6: New: Remove defunct IMDB Import Lists — deleted ImdbListImport.cs, ImdbListParser.cs, ImdbListRequestGenerator.cs, ImdbListSettings.cs). The localization strings referencing ls12345678 are stale leftovers, not evidence the feature still exists.
The current PR text reads:
Sonarr only accepts an IMDb list of the form
ls12345678. IMDb changed how those lists are served, so Sonarr can no longer read them; IMDb lists do not currently work.
This contradicts itself — "only accepts" implies the provider is still present, but the feature was removed entirely, not just broken. Suggested replacement:
The IMDb import list was removed from Sonarr (February 2025) because IMDb changed how
ls-number lists are served and the feature became defunct. Users on older versions may still see this option, but it will not function.
The {#imdblistimport} anchor should be kept for backwards compatibility with older installs.
Everything else verified correct against source
| Change | Verified against |
|---|---|
Sonarr Bluray-1080p Remux / Bluray-2160p Remux quality names |
Quality.cs lines 123–124 |
| Removed RSS anchor (comma form) | IndexerRssCheck.cs:32 emits the no-comma slug; heading generates it naturally |
| Removed interactive search anchor (long form) | IndexerSearchCheck.cs:43 emits the short slug; heading generates it naturally |
Radarr {#movies-mount-ro} (was {#movie-mount-ro}) |
Radarr MountCheck.cs:36 emits #movies-mount-ro exactly |
| Basic auth removal versions (Radarr v6.0.0, Prowlarr v2.0.0, Lidarr v3.0.0) | Consistent with PR description and source history |
Contributor
Author
|
Fixed in 7fc0c20. Reworded per your suggestion: the IMDb list was removed from Sonarr (Feb 2025), not merely broken. Kept the |
bakerboy448
marked this pull request as ready for review
September 5, 2026 15:44
augustuen
requested changes
Sep 5, 2026
|
|
||
| - Newer versions of Lidarr target .NET6 or newer. Legacy mono builds end after the 1.0 release. You are running one of these legacy builds but your platform supports .NET. | ||
|
|
||
| > This warning applies to v1 and earlier. Current releases require .NET and no longer ship a mono build. |
Collaborator
There was a problem hiding this comment.
If it only applies to a 3 year old release, it should be removed IMO.
| #### Currently installed SQLite version isn't supported | ||
|
|
||
| - Lidarr stores its data in an SQLite database. The SQLite3 library installed on your system is too old. Lidarr requires at least version 3.9.0. Note that Lidarr uses `libSQLite3.so`, which may not come with a SQLite3 upgrade package. | ||
| > This warning applies to v1 and earlier. Current releases no longer ship a mono build. |
Comment on lines
+106
to
+108
| > This warning applied to Radarr v3.2.2 and earlier running legacy mono builds and was removed from health checks after Mono support was dropped in Radarr v4.0.0. | ||
| {.is-info} | ||
|
|
Collaborator
There was a problem hiding this comment.
Suggested change
| > This warning applied to Radarr v3.2.2 and earlier running legacy mono builds and was removed from health checks after Mono support was dropped in Radarr v4.0.0. | |
| {.is-info} |
5 year old release
Comment on lines
+191
to
+193
| > This warning applied to Radarr v3.2.2 and earlier running legacy mono builds and was removed from health checks after Mono support was dropped in Radarr v4.0.0. | ||
| {.is-info} | ||
|
|
bakerboy448
added a commit
to bakerboy448/ServarrWiki
that referenced
this pull request
Sep 5, 2026
…chors to update FAQ Per review on Servarr#466: the Update to .NET version and Currently installed mono version checks (plus lidarr Mono Legacy TLS / Mono-and-x86) only fired on unsupported pre-.NET builds and were dropped from current releases. Remove the full sections and their how-to sub-sections; keep the anchors alive as stubs at the bottom of the page pointing to the update FAQ, so in-app health-check links from old installs still resolve.
Contributor
Author
|
Done in 1679547. Removed the obsolete mono/.NET legacy-build health-check sections entirely instead of annotating them:
To avoid breaking in-app health-check links from old installs that still point at these anchors, I kept the anchors as short stubs at the bottom of each page ("unsupported legacy build, see update FAQ"). markdownlint + prettier both pass. Out of scope here: the "applies to older versions" notes on non-mono checks (radarr Branch is for a previous version, sonarr No indexers are enabled, prowlarr SQLite version / Branch is for a previous version). Those aren't legacy-build checks, so I left them. Whisparr has the same mono sections but this PR didn't touch it. Happy to extend the same treatment to any of those if you want it in this PR. |
Contributor
Author
|
Extended the same cleanup in 0a232fe:
Also restored the standalone |
Document the Authentication Required, External authentication method, Trusted Networks, and Trust CGNAT IP Addresses settings across Radarr, Prowlarr, and Lidarr, matching the Sonarr security refresh. Adds a generic X-Forwarded-For spoofing warning for the Disabled for Local Addresses mode; these apps have no published CVE, unlike Sonarr (CVE-2026-30975). Creates a Security section for Lidarr, which had none; adds the missing Basic method to Prowlarr and the External method to Radarr. All three have only two Authentication Required values (Enabled, Disabled for Local Addresses); Disabled for Localhost is Sonarr/Whisparr-only and is not documented here. Verified against *arr source: AuthenticationType.cs (None/Basic/Forms/External), AuthenticationRequiredType.cs, ConfigFileProvider.cs (TrustCgnatIpAddresses), en.json (TrustedNetworksHelpText).
…onarr)
Add the explicit {#anchor} lines that the apps' in-app health-check deep-links
point at, so the links resolve. Radarr/Prowlarr/Lidarr headings lacked the
anchors Sonarr already had; their heading text slugifies differently from the
code's hardcoded lowercase anchor.
Each anchor was verified against the app's HealthCheck/Checks/*.cs on the
develop branch before writing. Also lowercases Sonarr's UI-folder anchor,
corrects Radarr movie-mount-ro to movies-mount-ro and Lidarr artist-mount-ro to
artist-mount-is-read-only, and removes three stale Sonarr indexer anchors that
no source check emits (the heading slugs already serve the real anchors).
Additive standalone-anchor syntax only; no headings or descriptions changed.
- Lidarr: the config keys are `AuthenticationMethod` and `AuthenticationRequired`, not "AuthenticationType" (that is the C# enum name). Verified in ConfigFileProvider.cs. - Prowlarr: Basic auth was removed in v2.0.0 (a `Basic` value is rewritten to `Forms` on load), not "as of v1". Verified in ConfigFileProvider.cs. - Sonarr: fix the broken DownloadDecisionComparer link (malformed `#L31-L41s` anchor) by dropping the drifting line range. Replace the stale mono SSL certificate guidance with system CA-cert guidance; Sonarr v4 targets net6.0, so mono no longer applies.
…/lidarr) Basic authentication is removed in the current released major of Radarr (v6.0.0), Prowlarr (v2.0.0), and Lidarr (v3.0.0): an existing `Basic` value in the config is converted to `Forms` on load. Update each Security method list and the Lidarr faq to say so instead of presenting Basic as a current option. Sonarr v4 still keeps Basic, so its docs are unchanged. Verified against each app's released-tag ConfigFileProvider.cs (Sonarr v4.0.19 keeps Basic; Radarr v6.3, Prowlarr v2.5, Lidarr v3.1 all coerce it to Forms).
Codex-verified against each app's released tag (Sonarr v4.0.19, Radarr v6.3,
Prowlarr v2.5, Lidarr v3.1).
- environment-variables: document SERVER__ALLOWEDHOSTS and SERVER__TRUSTEDNETWORKS
for Sonarr/Radarr/Prowlarr/Lidarr (in ServerOptions.cs). Readarr: remove three
stale LOG rows (SIZELIMIT/CONSOLEFORMAT/DBENABLED, absent from source) and add
AUTH__TRUSTCGNATIPADDRESSES and POSTGRES__CACHEDB.
- Sonarr quality: rename Remux-1080p/2160p to Bluray-1080p/2160p Remux (the
Quality.cs names), correct "movie" wording to video/episode, add WEBDL-720p.
- Radarr quality: add 11 registered qualities missing from the list (WORKPRINT,
CAM, TELESYNC, TELECINE, DVDSCR, REGIONAL, DVD-R, WEBDL-720p, Bluray-576p,
BR-DISK, Raw-HD).
- Radarr naming: correct the language-filter note; the :EN+DE suffix filter is
supported (GetLanguagesToken applies it).
- Sonarr/Radarr naming: add the {MediaInfo Video}/{MediaInfo Audio} aliases and
Sonarr's {Release Hash}.
- Lidarr naming-guide: remove stale {Preferred Words}; add 13 registered tokens
(Custom Formats, Original Title/Filename, MbId/CleanName variants, Medium Name,
Quality Proper, MediaInfo AudioBitsPerSample).
…s as stubs Verified against each app's released tag (Sonarr v4.0.19, Radarr v6.3, Prowlarr v2.5, Lidarr v3.1). ToC synced; every anchor resolves. Corrected (checks exist, descriptions were wrong): - Sonarr "New update is available": fires on a build older than 14 days with a newer version available, independent of the auto-update setting; Docker updates by repulling the image, not the in-app Install button. - Sonarr "Missing Root Folder": RootFolderCheck evaluates series paths only. - Sonarr "Enabled indexers do not support searching": renamed to the real transient message (search-capable indexers temporarily unavailable due to indexer errors). - Lidarr "Download Folder Same as Library Folder": the trigger is the download client's category auto-sorting, not a folder overlap. Added (checks present, undocumented): - UI-folder-not-writable and macOS App Translocation update checks (Radarr, Prowlarr); Kometa-deprecated and deprecated Movie Folder Format tokens (Radarr). Kept for older but still-recent versions: checks that were removed from current releases (mono/.NET migration, Database Integrity, Branch-is-for-a-previous- version, Mono TLS/x86, SQLite-version, "No indexers are enabled") stay documented as version-noted stubs, with their original anchors preserved, so in-app "Details" deep-links from older app versions still resolve. Radarr's "Could not connect to signalR" is reframed as a Reverse Proxy Websocket Configuration note (the check is gone) while keeping that anchor as a stub.
…source Verified against released tags (Sonarr v4.0.19, Radarr v6.3, Lidarr v3.1). - Radarr Custom Formats: add the Year condition (YearSpecification, min/max release-year match). - Sonarr Indexers: add Season-Pack Seed Time (Advanced), the seed-time goal applied to season-pack torrents (SeedCriteriaSettings.SeasonPackSeedTime). Sonarr-only. - Radarr Indexers: add Fail Downloads (Newznab/Torznab advanced), which marks the selected file categories (Executables, Potentially Dangerous) as failed. - Download Clients (Sonarr/Radarr/Lidarr): the per-client Remove option is two settings in source (RemoveCompletedDownloads, RemoveFailedDownloads), so split the docs into Remove Completed and Remove Failed. Add Redownload Failed from Interactive Search (AutoRedownloadFailedFromInteractiveSearch) beside the existing Redownload Failed.
…fication triggers Verified in Lidarr v3.1.4 NotificationDefinition.cs (OnDownloadFailure, OnImportFailure); the wiki trigger table omitted both.
The link used an uppercase #...-HTTPS-or-SSL-issues anchor that did not resolve to the lowercase heading slug in sonarr/faq.md.
…ntion defaults Radarr IMDb lists no longer accept custom ls-number lists/watchlists (removed due to IMDb changes, Radarr#11218); the field now takes top250, popular, or an IMDb user ID (ur#). Add the backup Interval (7 days) and Retention (28 days) defaults to Sonarr/Radarr/Prowlarr, from ConfigService.
Sonarr's IMDb import list only accepts an ls-format list ID (source help text 'IMDb list ID (e.g ls12345678)'); IMDb stopped serving those lists, so they no longer function. Same root cause as the Radarr change (Radarr#11218).
…idarr branch/SQLite) Git-history verification (git log --all -S over each app's full history) showed four restored "older-version" stubs describe health checks that never existed in that app, so their version-noted stubs are false and removed: - Radarr "Database Failed Integrity Check": no such check file or message in any Radarr commit; only the malformed-db FAQ exists. - Lidarr "Branch isn't a valid release branch" / "Branch is for a previous version": ReleaseBranchCheck.cs has zero commits in Lidarr; both messages originate from that check (added Radarr/Prowlarr in "HealthCheck for valid Branch value"), so Lidarr never had either. - Lidarr "Currently installed SQLite version isn't supported": SqliteVersionCheck.cs has zero commits in Lidarr. Kept: entries whose checks genuinely existed and were later removed (Radarr branch + SQLite + branch-previous, Lidarr mono/.NET) stay as version-noted stubs so in-app deep-links from older releases still resolve. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The IMDb import list was removed from Sonarr (Feb 2025), not merely broken.
Keep the {#imdblistimport} anchor for older-install backwards compatibility.
…chors to update FAQ The Update to .NET version and Currently installed mono version checks (plus lidarr/whisparr Mono Legacy TLS and Mono-and-x86) only fired on unsupported pre-.NET builds and were dropped from current releases. Remove the full sections and their how-to sub-sections across lidarr, radarr, and whisparr; keep the anchors as stubs at the bottom of each page pointing to the update FAQ so in-app health-check links from old installs still resolve. Also revert inaccurate 'applies to older versions' notes on checks that are still current (sonarr No indexers are enabled; prowlarr SQLite version + Branch is for a previous version; radarr Branch is for a previous version).
bakerboy448
force-pushed
the
docs/security-settings-grounding
branch
from
September 5, 2026 21:09
0a232fe to
12a50f2
Compare
augustuen
reviewed
Sep 5, 2026
Comment on lines
74
to
76
| #### Currently installed SQLite version is not supported | ||
|
|
||
| > This warning applies to older Prowlarr versions and is not present in current releases. | ||
| {.is-info} | ||
|
|
||
| - Prowlarr stores its data in an SQLite database. The SQLite3 library installed on your system is too old. Prowlarr requires at least version 3.9.0. Note that Prowlarr uses `libSQLite3.so` which may or may not be contained in a SQLite3 upgrade package. |
Collaborator
There was a problem hiding this comment.
Does this mean the warning is now back in Prowlarr?
Comment on lines
108
to
110
| #### Branch is for a previous version | ||
|
|
||
| > This warning applies to older Prowlarr versions and is not present in current releases. | ||
| {.is-info} | ||
|
|
||
| - The update branch setup in Settings/General is for a previous version of Prowlarr, therefore the instance will not see correct update information in the System/Updates feed and may not receive new updates when released. |
Verified against current Prowlarr source: there is no SqliteVersionCheck in src/NzbDrone.Core/HealthCheck/Checks (Radarr has it, Prowlarr does not), and no "branch is for a previous version" check (ReleaseBranchCheck only emits the still-current "not a valid release branch"; UpdateCheck has no previous-version path; neither string exists in Prowlarr localization). Both wiki sections described checks that do not exist in current Prowlarr. Remove them and keep the anchors as stubs at the bottom pointing to the update FAQ.
augustuen
approved these changes
Sep 5, 2026
Contributor
Author
|
Good catch, both verified against current Prowlarr source and removed in 4f0d6f6:
So no, the warnings aren't back, they were never present in current Prowlarr. My earlier note-revert on these two was wrong. Removed both sections and kept the anchors as bottom-of-page stubs pointing to the update FAQ, same pattern as the mono checks. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Grounds the *arr wiki docs to the actual *arr source. Every technical claim is verified against the source and checked against each app's released tag (Sonarr v4.0.19, Radarr v6.3, Prowlarr v2.5, Lidarr v3.1) rather than just the develop branch, so the docs match what users actually run. Follow-up to #455. Two unrelated fixes are split to #467.
The drift is concentrated in the recently-changed areas (health checks and the new security/hostname/Trusted-Networks features); the mature settings, reference, and prose pages are largely accurate, so several audits came back clean.
Security and authentication
Settings grounded to source
SERVER__ALLOWEDHOSTS+SERVER__TRUSTEDNETWORKSdocumented; Readarr stale LOG rows removed, CGNAT + Postgres cache-db added.{MediaInfo Video/Audio}aliases, 13 missing Lidarr tokens; stale{Preferred Words}removed; Radarr language-filter note corrected.Yearcondition added.Season-Pack Seed Time, RadarrFail Downloads.Remove Completed/Remove Failedsplit,Redownload Failed from Interactive Searchadded.On Download Failure+On Import Failuretriggers added.Health checks
Corrected descriptions (Sonarr New update / Missing Root Folder / Enabled indexers; Lidarr Download Folder Same as Library) and added the UI-folder, App Translocation, Kometa-deprecated, and deprecated Movie Folder Format checks. Health-check anchors were grounded so in-app deep-links resolve. Each "older-version" entry was checked against the app's full git history (
git log --all -S): checks that genuinely existed and were later removed (Radarr branch/SQLite/branch-previous, Lidarr mono/.NET) are kept as version-noted stubs with their original anchors, so deep-links from older releases still resolve. Four entries that never existed in that app (Radarr "Database Failed Integrity Check"; Lidarr "Branch isn't a valid release branch", "Branch is for a previous version", "SQLite version isn't supported") were removed as copy-paste errors.Provider lists and known issues
The supported.md provider lists (download clients, notifications, metadata, indexers, import lists) were verified against source and match. Corrected the IMDb import-list docs: IMDb removed its custom
ls-format lists, so those no longer work in Radarr or Sonarr (Radarr#11218); Radarr's field now takestop250,popular, or an IMDb user ID. Documented the backup Interval (7 days) and Retention (28 days) defaults.Prose
Fixed a broken SSL FAQ anchor in sonarr/troubleshooting. The FAQ, concepts, and troubleshooting pages otherwise verified accurate.
Remaining
The UI and Tags settings enumerations (self-explanatory toggles) are the only untouched surface, deliberately deferred as low-value. Everything grounded here is verified against each app's released tag.