docs: source-grounding sweep of the *arr wiki (security, settings, health checks)

lidarr/environment-variables.md

@@ -59,11 +59,13 @@ The config namespaces are shared between all Servarr apps and correspond to the
 | `PostgresLogDbConnectionString`  | `POSTGRES` | `LOGDBCONNECTIONSTRING`  | `LIDARR__POSTGRES__LOGDBCONNECTIONSTRING`  |
 | `UrlBase`                | `SERVER`   | `URLBASE`            | `LIDARR__SERVER__URLBASE`         |
 | `BindAddress`            | `SERVER`   | `BINDADDRESS`        | `LIDARR__SERVER__BINDADDRESS`     |
+| `AllowedHosts`           | `SERVER`   | `ALLOWEDHOSTS`       | `LIDARR__SERVER__ALLOWEDHOSTS`    |
 | `Port`                   | `SERVER`   | `PORT`               | `LIDARR__SERVER__PORT`            |
 | `EnableSsl`              | `SERVER`   | `ENABLESSL`          | `LIDARR__SERVER__ENABLESSL`       |
 | `SslPort`                | `SERVER`   | `SSLPORT`            | `LIDARR__SERVER__SSLPORT`         |
 | `SslCertPath`            | `SERVER`   | `SSLCERTPATH`        | `LIDARR__SERVER__SSLCERTPATH`     |
 | `SslCertPassword`        | `SERVER`   | `SSLCERTPASSWORD`    | `LIDARR__SERVER__SSLCERTPASSWORD` |
+| `TrustedNetworks`        | `SERVER`   | `TRUSTEDNETWORKS`    | `LIDARR__SERVER__TRUSTEDNETWORKS` |
 | `UpdateMechanism`        | `UPDATE`   | `MECHANISM`          | `LIDARR__UPDATE__MECHANISM`       |
 | `UpdateAutomatically`    | `UPDATE`   | `AUTOMATICALLY`      | `LIDARR__UPDATE__AUTOMATICALLY`   |
 | `UpdateScriptPath`       | `UPDATE`   | `SCRIPTPATH`         | `LIDARR__UPDATE__SCRIPTPATH`      |

lidarr/faq.md

@@ -284,11 +284,11 @@ See the dedicated [VPN Guide](/vpn). Short version: only your BitTorrent client
 
 If Lidarr is reachable from outside your LAN, enable authentication. Trackers and indexers increasingly require it.
 
-As of Lidarr v2, **authentication is mandatory.** The config file must include `AuthenticationType` and `AuthenticationMethod`.
+As of Lidarr v2, **authentication is mandatory.** The config file must include `AuthenticationMethod` and `AuthenticationRequired`.
 
 #### Authentication Method
 
-- `Basic` — browser-native username/password pop-up. Deprecated; a future major version will drop it.
+- `Basic` - browser-native username/password pop-up. Removed in Lidarr v3.0.0; an existing `Basic` config is converted to `Forms` on load.
 - `Forms` — login page. Recommended for all UI-exposed installs.
 - `External` — disables app authentication entirely. Only use this for installs behind an external authentication layer (Authelia, Authentik, nginx auth). Configurable via the config file only. Don't use this unless the external auth is actually enforced on the request path.
 

lidarr/naming-guide.md

@@ -55,6 +55,8 @@ Wrap tokens in `{}`. Lidarr substitutes them at import time. Any token that reso
 | `{Artist CleanNameThe}` | Clean artist name with "The" moved to the end. |
 | `{Artist Disambiguation}` | Disambiguation string from MusicBrainz, for example, `UK band`. Empty for most artists. |
 | `{Artist Genre}` | First genre tag associated with the artist. |
+| `{Artist NameFirstCharacter}` | First character of the artist's name, with a leading "The" moved to the end before taking the character. Useful for A-Z folder sorting. |
+| `{Artist MbId}` | The artist's MusicBrainz identifier. |
 
 ## Album tokens
 
@@ -67,15 +69,20 @@ Wrap tokens in `{}`. Lidarr substitutes them at import time. Any token that reso
 | `{Album Disambiguation}` | Disambiguation string from MusicBrainz. Useful when an artist has two albums with the same name. |
 | `{Album Type}` | Release group type: Album, Single, EP, Compilation, Live, Remix, Soundtrack, etc. |
 | `{Album Genre}` | First genre tag for the album. |
+| `{Album MbId}` | The album's (release group's) MusicBrainz identifier. |
 | `{Release Year}` | Four-digit release year. |
 
 ## Track tokens
 
 | Token | Description |
 |---|---|
 | `{Track Title}` | Track title. |
+| `{Track CleanTitle}` | Track title with illegal filesystem characters removed. |
 | `{Track ArtistName}` | Track-level artist name. Useful for Various Artists compilations where each track has a different credited artist. |
+| `{Track ArtistCleanName}` | Track-level artist name with illegal filesystem characters removed. |
 | `{Track ArtistNameThe}` | Track artist name with "The" moved to the end. |
+| `{Track ArtistCleanNameThe}` | Clean track-level artist name with "The" moved to the end. |
+| `{Track ArtistMbId}` | The track-level artist's MusicBrainz identifier. |
 | `{track:00}` | Track number zero-padded to 2 digits (01, 02 … 99). Use `{track:000}` for 3-digit padding on large releases. |
 
 ## Medium (disc) tokens
@@ -84,6 +91,7 @@ Wrap tokens in `{}`. Lidarr substitutes them at import time. Any token that reso
 |---|---|
 | `{medium:0}` | Disc number, single digit. |
 | `{medium:00}` | Disc number zero-padded to 2 digits. |
+| `{Medium Name}` | The disc's title as stored in MusicBrainz, distinct from `{Medium Format}` (the physical media type). |
 | `{Medium Format}` | Physical format of the disc: CD, Vinyl, Digital Media, etc. |
 
 ## Quality and technical tokens
@@ -92,7 +100,9 @@ Wrap tokens in `{}`. Lidarr substitutes them at import time. Any token that reso
 |---|---|
 | `{Quality Title}` | Quality profile name as defined in Lidarr (for example, FLAC, MP3-320). |
 | `{Quality Full}` | Full quality string including proper/repack designation. |
+| `{Quality Proper}` | Proper/repack designation for the track's quality, for example `Proper`. Empty when the release wasn't a proper. |
 | `{MediaInfo AudioBitRate}` | Audio bitrate (for example, 320kbps). Only available after import; blank on pre-import rename previews. |
+| `{MediaInfo AudioBitsPerSample}` | Audio bit depth (for example, 16bit). |
 | `{MediaInfo AudioChannels}` | Number of audio channels. |
 | `{MediaInfo AudioCodec}` | Audio codec (for example, FLAC, MP3). |
 | `{MediaInfo AudioSampleRate}` | Audio sample rate (for example, 44100Hz). |
@@ -101,8 +111,11 @@ Wrap tokens in `{}`. Lidarr substitutes them at import time. Any token that reso
 
 | Token | Description |
 |---|---|
+| `{Original Title}` | The original release title as parsed from the track file's release name. |
+| `{Original Filename}` | The literal original filename of the imported file, unmodified. |
 | `{Release Group}` | Ripping or encoding group tag from the file. |
-| `{Preferred Words}` | Matched preferred words from Release Profiles, joined by spaces. |
+| `{Custom Formats}` | Every Custom Format that matched the release and has "Include Custom Format when Renaming" enabled, joined by spaces. |
+| `{Custom Format:Name}` | A single named Custom Format. `Name` is a placeholder for the exact Custom Format name, for example `{Custom Format:FLAC}`. Produces no output unless a format with that name matched and has "Include Custom Format when Renaming" enabled. |
 
 # Community naming conventions
 

lidarr/settings.md

@@ -350,15 +350,17 @@ Lidarr can set seed ratio and time goals via the torrent client's API when you a
 | Setting | Description |
 |---|---|
 | **Enable** (Advanced, global) | Automatically import completed downloads from the download client. Disabling this means Lidarr will never import anything, so leave it enabled unless you have a specific reason to disable it. |
-| **Remove** (per-client) | After import, ask the download client to remove the completed item. For torrents, removal only occurs when the client reports seeding is complete and the torrent is paused/stopped. |
+| **Remove Completed** (per-client) | After import, ask the download client to remove the completed item from its history. For torrents, removal only occurs when the client reports seeding is complete and the torrent is paused/stopped. |
+| **Remove Failed** (per-client) | Remove failed downloads from the download client's history. |
 
 ### Failed Download Handling
 
 Failed download handling is available for SABnzbd and NZBGet only. It isn't supported for torrent clients.
 
 | Setting | Description |
 |---|---|
-| **Redownload** | When a download fails, automatically search for a replacement. |
+| **Redownload Failed** | When a download fails, automatically search for a replacement. |
+| **(Advanced) Redownload Failed from Interactive Search** | Only shown when Redownload Failed is enabled. Automatically search for and attempt to download a different release when the failed release was grabbed from an interactive search. |
 | **(Advanced) Remove** | Remove the failed download from the client when Lidarr detects the failure. |
 
 When Lidarr detects a failure, it logs it, optionally removes the failed item, searches for a replacement, and blocklists the failed release so it isn't grabbed again automatically.
@@ -388,6 +390,8 @@ Click **Add (+)** and select a connection type. Most connections share these fie
 | **Name** | Label for this connection. |
 | **On Grab** | Trigger when Lidarr sends a release to a download client. |
 | **On Release Import** | Trigger when a downloaded release is successfully imported. |
+| **On Download Failure** | Trigger when a download fails. |
+| **On Import Failure** | Trigger when an import fails. |
 | **On Upgrade** | Trigger when Lidarr upgrades a file to better quality. |
 | **On Rename** | Trigger when Lidarr renames files. |
 | **On Artist Added** | Trigger when you add an artist to Lidarr. |
@@ -460,6 +464,32 @@ General settings live under **Settings → General**.
   - A blank value is accepted only when Authentication Required is `Enabled`; otherwise at least one host is required and a blank value is rejected on save.
 - Enable SSL - If you have SSL credentials and would like to secure communication to and from Lidarr, enable this option.
 
+## Security
+
+{#security}
+
+- Authentication - How would you like to authenticate to access your Lidarr instance
+  - None - You have no authentication to access your Lidarr. Typically if you're the only user of your network, do not have anybody on your network that would care to access your Lidarr or your Lidarr is not exposed to the web
+  - Basic (Browser pop-up) - Removed in Lidarr v3.0.0; an existing `Basic` value in the config is converted to `Forms` on load. Previously a browser username/password pop-up.
+  - Forms (Login Page) - This option will have a familiar looking login screen much like other websites have to allow you to log onto your Lidarr
+  - External - Hands authentication off entirely to a reverse proxy (e.g. Authelia, Organizr) placed in front of Lidarr. Not selectable in the UI; set it via `config.xml` or the `LIDARR__AUTH__METHOD` environment variable. Lidarr performs no authentication of its own in this mode, so Authentication Required and Trust CGNAT IP Addresses have no effect
+- Authentication Required - Controls which requests must authenticate. Do not change this unless you understand the risks.
+  - Enabled - Always require authentication (recommended)
+  - Disabled for Local Addresses - Skip authentication for requests Lidarr identifies as coming from localhost or the LAN
+
+> With Authentication Required set to `Disabled for Local Addresses`, a request that spoofs the `X-Forwarded-For` header can appear local and skip authentication unless Lidarr is behind a properly configured reverse proxy whose address is listed under Trusted Networks below. Lidarr only trusts `X-Forwarded-For` from addresses in that list. If you do not run a trusted reverse proxy, set Authentication Required to `Enabled`, or put Lidarr behind a VPN or Tailscale rather than exposing it directly.
+{.is-warning}
+
+- API Key - This is how other programs would communicate or have Lidarr communicate to other programs. This key if given to the wrong person with access could do all kinds of things to your library. This is why in the logs the API key is redacted
+- Certificate Validation - Change how strict HTTPS certification validation is
+  - Enabled - Validate all HTTPS certificates (recommended)
+  - Disabled for Local Addresses - Validate all HTTPS certificates except those on localhost and the LAN
+  - Disabled - Do not validate any HTTPS certificates
+- Trusted Networks - Comma-separated list of IP addresses or CIDR networks that trusted reverse proxies are on (for example `172.17.0.1`, `10.0.0.0/8`, or `fc00::/7`). Lidarr only trusts the `X-Forwarded-For` header from these addresses. Only add proxies that are properly configured to send the correct headers.
+
+> Trust CGNAT IP Addresses - Not exposed in the UI. Set via `config.xml` or the `LIDARR__AUTH__TRUSTCGNATIPADDRESSES` environment variable (default `false`). When enabled, Lidarr treats CGNAT addresses (`100.64.0.0/10`, the range Tailscale uses) as local for the Authentication Required `Disabled for Local Addresses` check. It has no effect with any other Authentication Required or Authentication setting.
+{.is-info}
+
 # Logging
 
 {#logging}