App Logins

App logins

Radarr, Sonarr and the others now ask for a login by default. wranglarr can handle that for you in one of three ways. You pick one in the setup wizard, and ./scripts/init.sh applies it. The running wranglarr never changes the apps' logins; its dashboard only shows how they're set up (Logins in the toolbar).

APPS_AUTH	What you get	You sign in
apps	the same username and password in every app	to each app, always with the same login
tunnel	AuthTunnel: the apps have no login of their own; wranglarr-gate stands in front of them and asks for your wranglarr sign-in	once, to wranglarr (with its two-factor and passkeys)
manual	wranglarr leaves the apps' logins alone	to each app, with whatever you set in it

A new install defaults to apps. An existing .env without APPS_AUTH is manual, which is how it behaved before.

One login for every app (apps)

init sets APPS_LOGIN_USER / APPS_LOGIN_PASSWORD in each app, then signs in with it to check it took:

App	How
Radarr, Sonarr, Lidarr, Prowlarr	their API: the login page, asked everywhere or not on the local network (APPS_AUTH_REQUIRED)
Bazarr	its API: the login page
SABnzbd	its API: the login page
qBittorrent	written into qBittorrent.conf while it's stopped (a new install only has a temporary password, so there's no API to log in to yet)
NZBGet	the image applies NZBGET_USER / NZBGET_PASS at every start; the wizard sets them to the same login
Seerr	not set: its users are your Plex / Jellyfin / Emby accounts, and you sign in with those. Left out of AuthTunnel too, since the people requesting things have no wranglarr account

Things to know:

• The API keys don't change. wranglarr, the arrs, Prowlarr, Bazarr and mobile apps keep working.
• Use a password of its own, not wranglarr's. SABnzbd stores it in plain text in sabnzbd.ini, and Bazarr as an unsalted MD5.
• "Not on the local network" lets the arrs skip the login for private addresses. Behind Docker's port forwarding, or your reverse proxy, every visitor can look local. That makes it the same as no login, so everywhere is the default.
• Restoring an app brings back its old login. The dashboard shows it; run ./scripts/init.sh --auth again.

AuthTunnel (tunnel)

browser ──> :7878 ──> wranglarr-gate (nginx) ──> radarr:7878   (Authentication: External)
                          │
                          └── signed in to wranglarr?  no ──> wranglarr's login page, then back

• The apps' own web ports are taken away. compose.authtunnel.yaml, generated by init, publishes the same host ports on wranglarr-gate instead. Your bookmarks and your reverse proxy keep pointing at the same ports.
• Each request first asks wranglarr whether the browser is signed in (GET /api/auth/gate). If it isn't, the gate sends it to wranglarr's login page, which sends it back afterwards.
• The arrs and Prowlarr are set to External authentication; Bazarr and SABnzbd to no login. qBittorrent keeps its login (wranglarr and the arrs use it) but lets the gate's network in without it. The gate signs you in to NZBGet with its login from .env.
• Requests that carry the app's API key go straight through: the gate has wranglarr check the key against that app's real one first. So the arrs' mobile apps (nzb360, LunaSea…), Prowlarr's download links and scripts keep working, while a wrong or made-up key is sent to the sign-in page like any visitor.
• qBittorrent's mobile apps can't get past the gate: qBittorrent's API has no key, only its login.
• The apps are still reachable inside the Docker network (that's how wranglarr, the arrs and Prowlarr reach each other). Don't publish their ports another way.

Where you sign in: the cookie

The sign-in is a cookie, and a browser sends a cookie only to the address it came from, on any port, or, when told, to every name under one domain.

You open the apps at	Set
http://192.168.1.10:7878, the same address as wranglarr (http://192.168.1.10:8787)	nothing
also https://radarr.example.com, https://sonarr.example.com… through your reverse proxy	AUTH_COOKIE_DOMAIN=example.com and AUTH_LOGIN_URL=https://wranglarr.example.com; proxy wranglarr too

For wranglarr at https://myhouse.com/wranglarr and apps at sibling paths such as https://myhouse.com/radarr, use:

WRANGLARR_URL_BASE=/wranglarr
AUTH_COOKIE_DOMAIN=myhouse.com
AUTH_LOGIN_URL=https://myhouse.com/wranglarr

Choose Path on the domain for wranglarr in Dashboard → Links, and preserve its prefix in the proxy. The cookie keeps Path=/, so it reaches /radarr too. The gate still checks the bare /api/auth/gate endpoint internally. See Wranglarr at a path.

The wizard accepts a path in the login address. The domain and login address refer to your proxy, never this machine's IP: by IP and port the apps work with them blank, and keep working with them set. The gate sends you to AUTH_LOGIN_URL only when you came through the proxy (an address under AUTH_COOKIE_DOMAIN). An app opened by IP sends you to wranglarr on that IP, since a cookie set at the IP doesn't reach *.example.com, and one set at the domain doesn't reach the IP. The dashboard's links follow the same rule: opened at https://wranglarr.example.com, the apps open at https://radarr.example.com and so on; opened by IP, at IP and port. Reverse proxy writes the proxy config for you.

Changing it later

In the stack's folder:

# 1. pick the new setup (only the login keys in .env change) at the link it prints
docker run --rm -it -p 8788:8788 -v "$PWD":/stack ghcr.io/wranglarrr/wranglarr:latest wranglarr-setup --auth
# 2. apply it
./scripts/init.sh --auth

init.sh --auth does only this. The order matters, and it handles it:

• into AuthTunnel: the gate takes the ports first, then the apps drop their own logins;
• out of it: the apps get their logins back before their ports reopen, then the gate goes.

Going from tunnel straight to manual is refused, because it would leave every app on the network with no login. Go to apps first.

Re-running it is safe; an app that already has the right login is left as it is. When qBittorrent's or NZBGet's login changes, init updates their entries in every arr and in Prowlarr too.

.env

Key	Default
APPS_AUTH	manual (the wizard writes apps)	apps, tunnel or manual
APPS_LOGIN_USER, APPS_LOGIN_PASSWORD		apps: the login
APPS_AUTH_REQUIRED	enabled	apps: enabled (everywhere) or disabledForLocalAddresses
AUTH_COOKIE_DOMAIN	empty	tunnel: e.g. example.com
AUTH_LOGIN_URL	empty	tunnel: wranglarr's name on your reverse proxy, e.g. https://wranglarr.example.com, or https://example.com/wranglarr with WRANGLARR_URL_BASE=/wranglarr, used for apps opened under AUTH_COOKIE_DOMAIN; otherwise (and when empty) the address you opened the app at, port WRANGLARR_PORT
GATE_IMAGE	docker.io/nginxinc/nginx-unprivileged:1.27-alpine	tunnel: the gate's image

init writes /config/apps-auth.json (no passwords) with what it did per app; the dashboard shows it.

Troubleshooting

Symptom	Cause / fix
init: couldn't set it for an app	the run log says why; fix it and run ./scripts/init.sh --auth again
AuthTunnel: you sign in, and the app sends you to the login page again	the cookie doesn't reach the app's address: set AUTH_COOKIE_DOMAIN, and sign in at the domain name
AuthTunnel: every app answers 500	the gate can't reach wranglarr: docker compose logs wranglarr-gate, and check wranglarr is up
SABnzbd: "Access denied - Hostname verification failed"	it doesn't know the name you used. The gate and the generated proxy configs send its own name; otherwise add yours to host_whitelist (Config → Special)
Dashboard → Logins: "External (no login)" outside AuthTunnel	a leftover from the tunnel: ./scripts/init.sh --auth