From 3218be0da08ac0f412fb0e303a153ada29715bba Mon Sep 17 00:00:00 2001 From: Patrick Singletary Date: Sun, 11 Oct 2026 09:44:16 -0400 Subject: [PATCH] docs: PLAN-MediaServer v1.3 live refresh; archive FlareSolverr/Byparr plan (not a fix for EZTV) --- docs/plans/PLAN-MediaServer.md | 29 ++- docs/plans/REGISTRY.md | 4 + .../archive/PLAN-Flaresolverr-to-bypar.md | 167 ++++++++++++++++++ 3 files changed, 199 insertions(+), 1 deletion(-) create mode 100644 docs/plans/archive/PLAN-Flaresolverr-to-bypar.md diff --git a/docs/plans/PLAN-MediaServer.md b/docs/plans/PLAN-MediaServer.md index 0c02170..39d479d 100644 --- a/docs/plans/PLAN-MediaServer.md +++ b/docs/plans/PLAN-MediaServer.md @@ -1,7 +1,14 @@ # PLAN-MediaServer.md — Mac Studio Media Stack Reconfiguration > **Handoff target:** hermes (z-ai/glm-5.3-flash via Nous Portal) -> **Prepared:** 2026-09-09 · **Status:** v1.2 — Phase 1-3 partially executed; Phase 4 documentation appended +> **Prepared:** 2026-09-09 · **Status:** v1.3 — Phase 1-3 executed; Phase 4 docs; FlareSolverr/Byparr resolved (archived) +> **Changelog v1.3 (2026-10-11):** FlareSolverr→Byparr swap attempted 2026-09-13 and ROLLED BACK — +> Byparr solves EZTV's Cloudflare challenge but Prowlarr's save-time check replays the request with +> cookies via its own HttpClient, which Cloudflare fingerprints (Prowlarr #1733 lineage). This is an +> architecture limit, not a solver problem — FlareSolverr/Byparr will NOT unblock EZTV/1337x. Both +> solver services removed from compose; stack has NO Cloudflare solver. PLAN-Flaresolverr-to-bypar.md +> archived (2026-10-11). Live state refreshed: 14 containers up, Tdarr node configured but OFFLINE, +> Tailscale app STOPPED (Funnel config persists), media volume 71% full. See §4.6/§4.8. > **Changelog v1.2 (2026-09-10):** Domain strategy changed by owner: Option A (Cloudflare NS) REJECTED → > Option 4 selected (Tailscale Funnel, no DNS changes). Phase 4 (docs + reproduction prompt) appended. > Setup ~80% complete — see §4.8 snapshot and §4.6 gaps. @@ -547,6 +554,15 @@ Order matters. Allarr/s are HTTP on localhost ports; API keys read from `/c - [x] Keychain duplicates removed — all UI credentials now single-sourced in Bitwarden - [x] Stray Tailscale TLS private key removed from git repo working tree (regenerated under ~/arrstack/, chmod 600) +**Resolved since v1.3 (2026-10-11 live refresh):** +- [x] IPTorrents fallback: COMPLETE — Prowlarr indexer 4 (cookie auth, priority 25, seedTime 20160min), synced to Radarr/Sonarr/Lidarr; delay profiles 20160min torrentDelay. Cookie expiry = recurring maintenance (re-paste browser Cookie + User-Agent). +- [x] Tdarr: server container up (2.87.01), native node "MacStudioNative" CONFIGURED (path translators /data↔/Volumes/photos library iCloud/Media + /tdarr-cache↔~/arrstack/tdarr-cache, handbrakePath set, VideoToolbox plugin stack gate14+ER01 on Movies/TV libraries, 14-day gate). **BUT node process is OFFLINE** — last ran 2026-09-12, no LaunchAgent, no running process. 652 files tracked, all processStatus=None (never dispatched). Node must be started (and ideally a LaunchAgent added) before any transcode runs. +- [x] FlareSolverr/Byparr: RESOLVED as NOT a fix — see header changelog v1.3. Both services removed from compose; Prowlarr IndexerProxy entry gone. EZTV/1337x remain unblocked; Mrs Davis S01E08 still needs IPT or a .torrent-serving TV indexer. +- [x] Prowlarr indexers now: yts(1), thepiratebay(2), LimeTorrents(5), showRSS(6), Nyaa.si(7), IPTorrents Fallback(4). No EZTV/1337x. +- [x] Tailscale: app currently STOPPED (Funnel config persists for Seerr :5055 + Plex :8443, but the app must be running for the public URLs to serve). Restart Tailscale.app to restore public access. +- [x] Media volume: 1.8 TiB, 1.3 TiB used, 548 GiB free (71%). Media/{Movies,TV,Music,Downloads} intact; Movies 94 dirs, TV 31 dirs. +- [x] Mrs. Davis series: monitored=False (S01E08 still not re-grabbed; needs a working source). + **Red-team findings (2026-09-11) — answered:** 1. **Mullvad client on macOS: NOT required.** Gluetun owns the WireGuard tunnel inside Docker; qBittorrent shares its netns and has no route without it (kill-switch verified: `docker compose stop gluetun` → qbit DNS fails; start → recovers on Mullvad IP 138.199.6.212). Host traffic (incl. Tailscale) is independent — Tailscale is a separate tunnel and unaffected. 2. **Credentials in Bitwarden: YES for all UIs.** Sonarr/Prowlarr (owner-created), Radarr/Lidarr/Bazarr/Seerr-local/qBittorrent (agent-generated, owner copied into Bitwarden). Keychain duplicates deleted. Remaining secrets NOT in Bitwarden: `~/arrstack/.env` Mullvad private key (file, chmod 600), per-app API keys in each config.xml (standard arr practice), Jellyfin API key (in Jellyfin DB). Risk accepted: config-only, all behind auth. @@ -638,3 +654,14 @@ RULES (non-negotiable, from plan): - qBittorrent: Ted Lasso + Mr. Robot both 100% seeded; old qbt.app creds in owner Bitwarden - Tailscale: installed, awaiting owner login - Backups: 1 generation at ~/Backups/arrstack/ + +## 4.9 CURRENT STACK STATE (live refresh 2026-10-11 — supersedes §4.8) + +- **Containers: 14 up** (gluetun healthy, qbittorrent, prowlarr, radarr, sonarr, lidarr, bazarr, seerr, watchtower healthy, dozzle, recyclarr, unpackerr, tdarr, homarr). **No flaresolverr, no byparr** — both removed (see header v1.3). +- **OrbStack:** Docker server 29.4.0; bridge102 .0-fix LaunchDaemon loaded (com.psingletary.orbstack-bridge-fix); media-volume-guard LaunchAgent loaded. +- **Tailscale: app STOPPED.** Funnel config persists (`tailscale funnel status` shows https://mac-studio-2022.tail09c327.ts.net → Seerr :5055 and :8443 → Plex), but the app must be running for public URLs to serve. Restart Tailscale.app to restore public access. +- **Media volume:** `/Volumes/photos library iCloud` 1.8 TiB, 1.3 TiB used, 548 GiB free (71%). Media/{Movies,TV,Music,Downloads} intact; Movies 94 dirs, TV 31 dirs, Downloads 38 dirs. +- **Prowlarr indexers:** yts(1), thepiratebay(2), LimeTorrents(5), showRSS(6), Nyaa.si(7), IPTorrents Fallback(4, cookie auth, priority 25, seedTime 20160min). No EZTV/1337x. No IndexerProxy (FlareSolverr entry gone). +- **Tdarr:** server container 2.87.01 healthy; native node "MacStudioNative" CONFIGURED (path translators, handbrakePath, VideoToolbox plugin stack gate14+ER01 on Movies/TV, 14-day gate) but **OFFLINE** — no process, no LaunchAgent, last ran 2026-09-12. 652 files tracked, all processStatus=None (never dispatched). Start the node (and add a LaunchAgent) to resume transcodes. +- **Mrs. Davis:** series monitored=False; S01E08 still not re-grabbed (needs IPT or a .torrent-serving TV indexer). +- **System changes since 09-13:** brew added harfbuzz, sevenzip, bitwarden-cli, openssl@3, python@3.14, node, yt-dlp, xorgproto, lima, sdl2-compat, sdl3, libpng, hdrhistogram_c, tailscale; casks osaurus, jellyfin, firefox, zed, signal, mullvad-browser, audacity, vlc, ungoogled-chromium, krita, epic-games, logi-options+, plex-media-server, gimp. New LaunchAgent com.valvesoftware.steamclean. diff --git a/docs/plans/REGISTRY.md b/docs/plans/REGISTRY.md index 02ade27..ecddfa7 100644 --- a/docs/plans/REGISTRY.md +++ b/docs/plans/REGISTRY.md @@ -32,3 +32,7 @@ created from them, and their status. One row per plan. | PLAN-atproto-ecosystem-skills.md | atproto-digest | ~/dev/_shared/docs/atproto-digest/ | done | 2026-08-17 | DONE 2026-08-17: 897 URLs -> 10 skills (umbrella + 9) in ~/dev/_shared/skills/, SKILLS-INDEX.md, cross-links, symlinks for Hermes + Claude Code | | PLAN-maintain.md | — | — | inbox | 2026-09-07 | ROLLING — regenerated by maintain-scan.py (launchd daily); work its checklist in place, never archive/pick up as scaffold | | PLAN-MediaServer.md | — (standalone infra, no repo) | ~/arrstack | building | 2026-09-09 | P1-P3 done, Phase 4 docs done; handoff: ~/arrstack/HANDOFF.md; open: IPT fallback, Tdarr node/flows, Mrs Davis E08, Plex web UI empty | +| PLAN-Flaresolverr-to-bypar.md | — (standalone infra) | ~/arrstack | archived | 2026-09-13 | ARCHIVED 2026-10-11: swap attempted + rolled back 2026-09-13 — Byparr solves EZTV's CF challenge but Prowlarr's save-time check replays via its own HttpClient (CF fingerprints), so FlareSolverr/Byparr does NOT unblock EZTV/1337x. Both services removed from compose. See PLAN-MediaServer.md v1.3. | +| PLAN-tool-er-framework.md | — | — | inbox | 2026-09-07 | PLANNED, not picked up; QA'd PASS-WITH-CHANGES + red-teamed (SEC-01 open-redirect must fix before Phase 1); owner decisions a-d pending at Phase 0 gate | +| PLAN-ATP-Blob-Hype.md | — | — | inbox | 2026-09-07 | SKELETON — 9 open decisions (§8) must be resolved before pickup | +| PLAN-BACKUP3-X10-CANONICAL-MAP.md | — | — | inbox | 2026-08-20 | DRAFT; decisions locked (DP-1a/2a/3a/4a/5a/6c); one-pass activation after GATE-4 | diff --git a/docs/plans/archive/PLAN-Flaresolverr-to-bypar.md b/docs/plans/archive/PLAN-Flaresolverr-to-bypar.md new file mode 100644 index 0000000..35435e7 --- /dev/null +++ b/docs/plans/archive/PLAN-Flaresolverr-to-bypar.md @@ -0,0 +1,167 @@ +PLAN: Replace FlareSolverr with Byparr +Machine: Mac Studio 2022 (mac-studio-2022, M1 Max, macOS 26.6.2) +Date authored: 2026-09-13 +Status: Ready to execute — no blockers +Changelog: ~/arrstack-control/logs/CHANGELOG.md + +Goal +Add byparr as a new named service in docker-compose, update Prowlarr's IndexerProxy host from http://flaresolverr:8191 to http://byparr:8191, then remove the old flaresolverr service. Container name, image name, Prowlarr config, and logs will all match — no maintenance confusion later. + +Byparr is a drop-in FlareSolverr API replacement that uses Camoufox (Firefox-based, anti-detection) instead of headless Chromium. It passes Cloudflare's managed challenge where FlareSolverr 3.5.0 fails due to fingerprint detection. + +Environment Summary +Stack location +Compose file: ~/arrstack/docker-compose.yml +Config base: ~/arrstack/config/ +Prowlarr DB: ~/arrstack/config/prowlarr/prowlarr.db +Prowlarr config: ~/arrstack/config/prowlarr/config.xml +Prowlarr URL: http://localhost:9696 +CHANGELOG: ~/arrstack-control/logs/CHANGELOG.md +Relevant containers (confirmed 2026-09-13) +Container Image Network Notes +arrstack-flaresolverr-1 ghcr.io/flaresolverr/flaresolverr:latest arrstack_default 192.168.199.14 Port 8191 internal only +arrstack-gluetun-1 qmcgaw/gluetun:latest arrstack_default 192.168.199.12 Publishes 9696 and 8080 to host +arrstack-prowlarr-1 lscr.io/linuxserver/prowlarr:latest network_mode: service:gluetun No own ports — shares gluetun netns +arrstack-qbittorrent-1 lscr.io/linuxserver/qbittorrent:latest network_mode: service:gluetun No own ports +Prowlarr state (confirmed from DB, 2026-09-13) +FlareSolverr IndexerProxy: id=1, name="FlareSolverr", host=http://flaresolverr:8191, timeout=60s +Tag: id=1, label="flaresolverr" +App sync profile: id=1, name="Standard" +Existing indexers: YTS (1), thepiratebay (2), IPTorrents Fallback (4) +EZTV: NOT saved — blocked at Prowlarr validation (see Root Cause) +Current flaresolverr compose stanza + + + +flaresolverr: + image: ghcr.io/flaresolverr/flaresolverr:latest + environment: + - "LOG_LEVEL=info" + restart: unless-stopped +Network +All arrstack services on arrstack_default bridge network +Prowlarr reaches FlareSolverr via Docker DNS: http://flaresolverr:8191 (confirmed working) +VPN exit IP: 193.32.127.194 (Mullvad via gluetun) — EZTV API responds fine from this IP +FlareSolverr v3.5.0, Chromium 148, aarch64/OrbStack +Root Cause (fully diagnosed) +FlareSolverr DOES solve the Cloudflare JS challenge ("Challenge solved! Response in 11.2s" confirmed in container logs). However, Prowlarr's cardigann indexer validator runs its own connectivity check server-side on save/test, independently of FlareSolverr. That check fails because Prowlarr's internal HTTP client directly hits https://eztvx.to/home, and Cloudflare's managed challenge fingerprints FlareSolverr's headless Chromium even after the JS challenge passes. + +forceSave=true API flag was tested — skips field validation only, NOT the connectivity check. Direct SQLite insert was also rejected: Prowlarr re-validates all indexers on startup and would bench/disable any that fail. + +Byparr uses Camoufox (Firefox + anti-detection patches) which passes the fingerprint check. It exposes an identical /v1 API on port 8191. + +What Was Tried (failed approaches) +PASS — FlareSolverr proxy configured in Prowlarr (http://flaresolverr:8191) +PASS — Tag id=1 "flaresolverr" assigned to EZTV indexer attempt +PASS — Network path confirmed (gluetun -> FlareSolverr reachable, challenge solved in logs) +FAIL — POST /api/v1/indexer — blocked by connectivity validation +FAIL — POST /api/v1/indexer?forceSave=true — only skips field validation, not connectivity +FAIL — Direct SQLite insert — Prowlarr re-validates on load, would bench the indexer +SOLUTION — Add byparr as new named service; remove flaresolverr cleanly after verified +The Fix +Step 1 — Backup compose + + + +cp ~/arrstack/docker-compose.yml \ + ~/arrstack/docker-compose.yml.bak-pre-byparr-$(date +%Y%m%d%H%M%S) +Step 2 — Add byparr service to compose +In ~/arrstack/docker-compose.yml, add alongside the existing flaresolverr stanza — do NOT remove flaresolverr yet: + + + + +byparr: + image: ghcr.io/thephaseless/byparr:latest + environment: + - "LOG_LEVEL=info" + restart: unless-stopped +No shm_size needed for OrbStack on Apple Silicon (only required in LXC environments). + +Step 3 — Bring up byparr, verify health BEFORE touching Prowlarr + + + +cd ~/arrstack +docker compose up -d byparr +sleep 15 +docker logs arrstack-byparr-1 --tail 20 +docker exec arrstack-gluetun-1 curl -s http://byparr:8191/ +Expected healthy response: {"msg": "Byparr is ready!", "version": "...", ...} + +Step 4 — Update Prowlarr proxy host via API + + + +API_KEY=$(grep -o 'ApiKey>.*<' ~/arrstack/config/prowlarr/config.xml | \ + sed 's/ApiKey>//;s/<.*//' | head -1) + +curl -s -X PUT "http://localhost:9696/api/v1/indexerproxy/1" \ + -H "X-Api-Key: ${API_KEY}" \ + -H "Content-Type: application/json" \ + -d '{ + "id": 1, + "name": "FlareSolverr", + "implementation": "FlareSolverr", + "configContract": "FlareSolverrSettings", + "fields": [ + {"name": "host", "value": "http://byparr:8191"}, + {"name": "requestTimeout", "value": 60} + ], + "tags": [1] + }' | python3 -m json.tool 2>/dev/null | grep -E '(id|name|host|value)' +Step 5 — Add EZTV indexer in Prowlarr UI +http://localhost:9696 → Indexers → + → search "eztv" → click EZTV +Base URL: https://eztvx.to +Tags: flaresolverr +Test → should be green +Save +Step 6 — Remove old flaresolverr service +Only after EZTV is confirmed saving and working: + + + + +cd ~/arrstack +docker compose stop flaresolverr +docker compose rm -f flaresolverr +# Then manually remove the flaresolverr stanza from ~/arrstack/docker-compose.yml +Step 7 — Update CHANGELOG +Append to ~/arrstack-control/logs/CHANGELOG.md: + + + + +- FlareSolverr replaced with Byparr: new `byparr` service added + (ghcr.io/thephaseless/byparr:latest), old `flaresolverr` service removed after + verification. Prowlarr IndexerProxy host updated from http://flaresolverr:8191 + to http://byparr:8191. Byparr uses Camoufox (Firefox anti-detection) vs + FlareSolverr Chromium 148 which Cloudflare fingerprints. EZTV indexer added + post-swap. Rollback: restore compose from .bak-pre-byparr-* and + docker compose up -d flaresolverr + revert Prowlarr proxy host. +Rollback + + + +cp ~/arrstack/docker-compose.yml.bak-pre-byparr- \ + ~/arrstack/docker-compose.yml +cd ~/arrstack +docker compose up -d flaresolverr +docker compose stop byparr && docker compose rm -f byparr +# Revert Prowlarr proxy host to http://flaresolverr:8191 via UI: +# Settings -> Indexers -> FlareSolverr -> update host field -> Save +Byparr Reference +Item Detail +GitHub https://github.com/ThePhaseless/Byparr +Image ghcr.io/thephaseless/byparr:latest +API Identical to FlareSolverr /v1 +Port 8191 +Browser Camoufox (Firefox-based, anti-detection) +Docker deploy docs https://deepwiki.com/ThePhaseless/Byparr/4.1-docker-deployment +Integration guide https://roundproxies.com/blog/byparr/ +Known gotcha LXC only: may need shm_size: 1g. OrbStack on Apple Silicon unaffected. +Production Safety Notes +Only byparr and flaresolverr containers are touched. Prowlarr, gluetun, Sonarr, Radarr, Lidarr, qBittorrent, Tdarr, Overseerr all continue running uninterrupted. +Other indexers (TPB, YTS, IPTorrents Fallback) have no flaresolverr tag and do not route through FlareSolverr/Byparr — unaffected. +Mac Studio is a production server — do not reboot. All steps are non-disruptive. +Verify 8 TB backup drive is mounted before any docker compose rm steps. -- 2.51.2