Autoconfiguration

Autoconfiguration

Note

Several roles do more than start a container: they configure the application afterwards, either by editing its config file or by calling its API. This page documents what is set up for you, and just as importantly what is not.

Table of Contents

• Overview
• What each role configures
• PVR: root folders and download clients
• Download clients
• Media
• Homer
• Tinymotd
• What is not configured
• Idempotency and re-running

Overview

Roles that autoconfigure keep those tasks in a settings/ folder next to main.yml, included at the end of the deploy once the container is up. Two techniques are used:

Technique	Used for	Roles
Editing the config file on disk	Applications with no API, or settings needed before first start	qBittorrent, NZBGet, SABnzbd, Homer, Tinymotd
Calling the application API	Applications that own their config in a database	Sonarr, Radarr, Lidarr, Readarr, Kavita, Yamtrack

What each role configures

Role	What is configured
Sonarr	Root folder, NZBGet download client
Radarr	Root folder, NZBGet download client
Lidarr	Root folder, NZBGet download client
Readarr	Root folder, NZBGet download client
qBittorrent	Legal notice, Web UI credentials, listening port, CSRF and clickjacking flags
NZBGet	Control and restricted accounts, all directories, seven categories
SABnzbd	Host whitelist, complete and incomplete directories, ten categories
Kavita	Admin account, Books, Comics and Mangas libraries
Yamtrack	Django superuser account
Homer	Dashboard base config, dashboard icons repository
Tinymotd	Header, docker widget, partition filter

PVR: root folders and download clients

Each of the four PVRs waits for its API to answer, reads its own API key out of config.xml, then posts a root folder and a download client.

Role	Root folder
Sonarr	/data/media/tv
Radarr	/data/media/movies
Lidarr	/data/media/music
Readarr	/data/media/books

The download client added is NZBGet in all four cases, wired to the container by name on port 6789 using nzbget.restricted_username and nzbget.restricted_password from your settings.yml, with removeCompletedDownloads and removeFailedDownloads enabled.

Important

No torrent client is added automatically. If you use qBittorrent or ruTorrent with the PVRs, add them by hand under Settings, Download Clients. For ruTorrent you also need a remote path mapping, see Folder Structure.

Download clients

qBittorrent

The role edits qBittorrent.conf directly, before you ever log in:

Setting	Value
Legal notice	Accepted, so the container does not block on the prompt
WebUI\Username	qbittorrent.web_user
WebUI\Password_PBKDF2	Derived from qbittorrent.web_password and web_password_salt
Session\Port	qbittorrent.bittorrent_port
WebUI\CSRFProtection	false
WebUI\ClickjackingProtection	false

The password hash is produced by a small helper script using PBKDF2-HMAC-SHA512 at 100000 iterations, the format qBittorrent expects.

Note

CSRF and clickjacking protection are disabled because the Web UI is served through Traefik on a different origin than the container sees. Authelia sits in front of qBittorrent, so the Web UI is not reachable unauthenticated.

NZBGet

Setting	Value
ControlUsername, ControlPassword	Cleared
RestrictedUsername, RestrictedPassword	From settings.yml, and reused by the PVRs
Directories	MainDir, DestDir, InterDir, NzbDir, QueueDir, TempDir, ScriptDir, LockFile, LogFile
Categories	Books, Games, Movies, Music, Software, Tv, Miscellaneous

SABnzbd

Setting	Value
host_whitelist	Set so the container accepts the proxied hostname
complete_dir	/data/usenet/complete
download_dir	/data/usenet/incomplete/sabnzbd
Categories	The ten standard categories, plus * as the default mapped to misc

Media

Kavita

Kavita leaves POST /api/Account/register anonymous until the first admin exists, and it has no Authelia middleware in front of it. The role registers the admin during the play, which both sets up the account and closes that window.

It then logs in and creates three libraries:

Library	Type	Folder
Books	Book	/data/media/books
Comics	Comic	/data/media/comics
Mangas	Manga	/data/media/mangas

Yamtrack

The role checks whether any Django user exists, and only then creates the superuser through manage.py createsuperuser. The password is passed as an environment variable rather than on the command line, so it does not appear in the container's process list.

See settings.yml for how the credentials are generated and where they are stored.

Homer

Homer is started, allowed to write its default config.yml, then stopped while the role clones the dashboard-icons repository and writes the discovery base config. It is started again afterwards.

The stop is deliberate: Homer Service Discovery rewrites the config from the container labels, and the base file has to be in place before it does.

Tinymotd

Not a container. The role clones tinymotd on the host and configures the login banner: a custom header, the lxc widget swapped for docker, and the partitions widget filtered to docker.

What is not configured

Deliberately left to you:

Not configured	Where to do it
Indexers	Prowlarr, then sync to the PVRs
Torrent download clients in the PVRs	Each PVR, Settings, Download Clients
Quality profiles and naming	Each PVR
Usenet server credentials	NZBGet or SABnzbd, Settings, Servers
Jellyfin libraries	Jellyfin first-run wizard
Navidrome music folder	Scanned from /data/media/music on start
Seerr setup	Seerr first-run wizard
Bazarr providers and languages	Bazarr
Portainer admin account	Portainer, on first visit
File Browser admin account	File Browser, on first visit

Warning

Portainer and File Browser create their admin account on first visit, and neither sits behind Authelia. Log in and set your password immediately after deploying them.

Tip

Before adding indexers in Prowlarr, check the Seedbox and API compliance matrix for each tracker/indexer's seedbox-notice rules and the API query/grab limits to set.

Idempotency and re-running

The API calls accept both a success status and 400, which is what these applications return when the resource already exists. Re-running the playbook therefore does not duplicate root folders, download clients or libraries.

The config file edits use lineinfile with an anchored regex, so they rewrite the same line rather than appending a second one.

Important

Because the roles overwrite these specific keys on every run, changes you make in the web UI to a managed setting are reverted the next time you deploy. Change them in settings.yml instead. Settings the roles do not touch are left alone.