08491c0c9b
- system.html crashed with a 500 whenever SABnzbd history loaded: the trend() macro compared the formatted "avg_speed" string (e.g. "900 KB/s") against a number. Added a real numeric avg_speed_kbps field and pointed the macro at that instead. - Replaced "held"/"not held" wording with "in library"/"not in library" on Home and Discover. - Moved CLAUDE.md's Deployment/reverse-proxy and account-management sections into two on-demand skills (deploy-arr-summary, manage-accounts) so they only load when actually relevant, with a one-line pointer left in their place. - Updated PRODUCT.md's restructure note now that meridian-marquee has merged to main. - Dropped two stale/broken entries from settings.local.json's permission allowlist (a rule from a different machine/path, and one with a corrupted token). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NBw1QodG8ZMYHrGeQfqyDS
2 KiB
| name | description |
|---|---|
| manage-accounts | Use when adding, removing, or changing dashboard login accounts for Arr Summary (Media Centre), or explaining the difference between its multi-user and legacy single-shared-password login modes. |
Two modes, chosen by whether settings.json holds a non-empty users map:
- Multi-user (once any account exists): username + password, each
password stored as a salted pbkdf2 hash under
usersinsettings.json.verify_credentials()is the only entry point;load_users()re-reads the file per check, so adding a user or changing a password is live immediately in every gunicorn worker — no restart, unlike the API keys. - Legacy single shared password (no accounts yet): the original
LOGIN_PASSWORD/settings.json.login_passwordpath, username ignored. This fallback exists so deploying multi-user support can't lock an existing install out; the login page hides the username field entirely until accounts exist.
Manage accounts with manage_users.py, which prompts for passwords
(never echoed, never a CLI argument, so they stay out of shell history)
and only ever writes hashes:
docker exec -it arr-summary python3 manage_users.py list
docker exec -it arr-summary python3 manage_users.py add <username>
docker exec -it arr-summary python3 manage_users.py passwd <username>
docker exec -it arr-summary python3 manage_users.py remove <username>
Adding the first account switches the whole dashboard to per-user
logins and the shared password stops working — verify you can sign in
as that user before closing the shell. remove refuses to delete the
last account for the same reason.
Users live in settings.json rather than an env var deliberately: a
pbkdf2 hash contains $, which docker compose interpolates when reading
.env. PASSWORD_HASH_METHOD is pinned to pbkdf2 rather than Werkzeug's
default scrypt, which needs a hashlib built against OpenSSL and is absent
on the macOS system Python.