Feramance · Feramance · Apr 21, 2026 · Mar 15, 2026 · Mar 24, 2026 · Mar 24, 2026
diff --git a/.bumpversion.cfg b/.bumpversion.cfg
@@ -21,6 +21,12 @@ replace = **Latest Release**: v{new_version}
 search = EXPECTED_CONFIG_VERSION = "{current_version}"
 replace = EXPECTED_CONFIG_VERSION = "{new_version}"
 
+[bumpversion:file:qBitrr/gen_config.py]
+search =         "ConfigVersion",
+        "{current_version}",
+replace =         "ConfigVersion",
+        "{new_version}",
+
 [bumpversion:file:docs/configuration/config-file.md]
 search = ConfigVersion = "{current_version}"
 replace = ConfigVersion = "{new_version}"
diff --git a/AGENTS.md b/AGENTS.md
@@ -8,7 +8,8 @@
 - **Entry Point**: `qBitrr.main:run` → spawns WebUI, ArrManager loops, auto-update watchers
 - **Key Modules**:
   - `qBitrr/main.py` – orchestrates multiprocessing, launches arr managers and WebUI
-  - `qBitrr/arss.py` – ArrManager classes (Radarr/Sonarr/Lidarr) with health checks & import logic
+  - `qBitrr/arss.py` – `Arr` (Radarr/Sonarr/Lidarr via `self.type`), `ArrManager`, `PlaceHolderArr`, `FreeSpaceManager`, `TrackerSortManager`; health checks & import logic
+  - `qBitrr/arr_tracker_index.py` – shared tracker config → derived URI/host sets (`build_tracker_index`, `extract_tracker_host`)
   - `qBitrr/config.py` – TOML config parsing, validation, migrations
   - `qBitrr/webui.py` – Flask routes for `/api/*` (token-protected) and `/web/*` (helpers)
   - `qBitrr/ffprobe.py` – media file verification via ffprobe
@@ -94,6 +95,7 @@
 - **User Messages**: Provide actionable error messages; reference config keys, Arr instance names, torrent hashes
 
 ## Architecture & Patterns
+- **Arr / Radarr-Sonarr-Lidarr**: One `Arr` class branches on `self.type` (`"radarr"`, `"sonarr"`, `"lidarr"`). Prefer extracting shared logic into helpers (e.g. `arr_tracker_index.py`) before adding subclasses; per-app handler objects are optional for future refactors
 - **Multiprocessing**: `pathos.multiprocessing` for cross-platform support; each Arr instance runs in a separate process
 - **Threading**: WebUI runs in main thread; auto-update, network monitor, and FFprobe downloads in background threads
 - **Database**: Peewee ORM with SQLite (thread-safe via `db_lock.py`); tables: `DownloadsModel`, `SearchModel`, `EntryExpiry`
@@ -108,7 +110,7 @@
 - **Config Changes**: Edit `qBitrr/gen_config.py` (MyConfig class); regenerate example via `qbitrr --gen-config`
 - **WebUI Changes**: Run `npm run dev` in webui/, API requests proxy to http://localhost:6969
 - **Database Schema**: Modify `qBitrr/tables.py`, add migration logic in `config.py:apply_config_migrations()`
-- **New Arr Type**: Subclass `ArrManagerBase` in `arss.py`, implement `_process_failed_individual()`, register in `main.py`
+- **New Arr Type**: Radarr/Sonarr/Lidarr share the `Arr` class (`self.type`); add API branches in `arss.py` and config in `gen_config.py`. Special workers subclass `Arr` (`PlaceHolderArr`, etc.) without calling full `Arr.__init__`. Register new managed instances in `ArrManager.build_arr_instances()` / `main.py` as needed
 - **Pre-commit Bypass**: `git commit --no-verify` (discouraged; use for emergency hotfixes only)
 
 ## Testing & Validation
@@ -346,7 +348,7 @@ When making code changes, update the following documentation as applicable:
 
 #### 4. API Documentation
 - **`docs/reference/api.md`**: Update if adding/changing WebUI API endpoints
-- **OpenAPI/Swagger**: Update specs if applicable
+- **OpenAPI/Swagger**: Keep [`qBitrr/openapi.json`](qBitrr/openapi.json) in sync when adding or changing REST routes; interactive UI is served at `/web/docs` and `/api/docs` (see [`docs/webui/api.md`](docs/webui/api.md))
 
 ### Documentation Quality Standards
 

diff --git a/MANIFEST.in b/MANIFEST.in
@@ -1,2 +1,3 @@
 recursive-include qBitrr/static *
+include qBitrr/openapi.json
 include config.example.toml
diff --git a/SECURITY.md b/SECURITY.md
@@ -0,0 +1,23 @@
+# Security Policy
+
+## Supported versions
+
+Security fixes are provided **only for the latest released version** of qBitrr. Older releases are not maintained for security patches. [Upgrade to the latest release](https://github.com/Feramance/qBitrr/releases/latest) to receive security updates.
+
+## Reporting a vulnerability
+
+Report security issues **privately** so they can be fixed before public disclosure.
+
+**Preferred:** Use GitHub's private reporting flow: open the [Security tab](https://github.com/Feramance/qBitrr/security), then use **Report a vulnerability**.
+
+Please include:
+
+- A clear description of the issue and its potential impact
+- Steps to reproduce (if possible)
+- The qBitrr version and environment you tested (OS, install method, relevant config if safe to share)
+
+We will acknowledge receipt when we can and coordinate on a fix and disclosure timeline where appropriate.
+
+## Coordinated disclosure
+
+Please do not publish details of an unfixed vulnerability until a fix is available, unless we agree otherwise.
diff --git a/config.example.toml b/config.example.toml
@@ -162,6 +162,9 @@ UserName = "CHANGE_ME"
 # If you set "Bypass authentication on localhost or whitelisted IPs" remove this field.
 Password = "CHANGE_ME"
 
+# If true, do not verify TLS certificates for HTTPS WebUI (self-signed certs). Disables MITM protection for that connection.
+SkipTLSVerify = false
+
 # Categories managed directly by this qBit instance (not managed by Arr instances).
 # These categories will have seeding settings applied according to CategorySeeding configuration.
 # Example: ['downloads', 'private-tracker', 'long-term-seed']
@@ -229,6 +232,9 @@ URI = "CHANGE_ME"
 # The Servarr API Key, Can be found it Settings > General > Security
 APIKey = "CHANGE_ME"
 
+# If true, do not verify TLS for this Servarr API (HTTPS). Does not affect Overseerr/Ombi. Disables MITM protection for that connection.
+SkipTLSVerify = false
+
 # Category applied by Servarr to torrents in qBitTorrent, can be found in Settings > Download Clients > qBit > Category
 Category = "sonarr-tv"
 
@@ -329,6 +335,9 @@ OmbiAPIKey = "CHANGE_ME"
 # Only process approved requests
 ApprovedOnly = true
 
+# If true, do not verify TLS for Ombi HTTPS (self-signed). Disables MITM protection.
+SkipTLSVerify = false
+
 [Sonarr-TV.EntrySearch.Overseerr]
 # Search Overseerr for pending requests (Will only work if 'SearchMissing' is enabled.)
 # If this and Ombi are both enable, Ombi will be ignored
@@ -343,6 +352,9 @@ OverseerrAPIKey = "CHANGE_ME"
 # Only process approved requests
 ApprovedOnly = true
 
+# If true, do not verify TLS for Overseerr HTTPS (self-signed). Disables MITM protection.
+SkipTLSVerify = false
+
 # Only for 4K Instances
 # Only for 4K Instances
 Is4K = false
@@ -431,6 +443,9 @@ URI = "CHANGE_ME"
 # The Servarr API Key, Can be found it Settings > General > Security
 APIKey = "CHANGE_ME"
 
+# If true, do not verify TLS for this Servarr API (HTTPS). Does not affect Overseerr/Ombi. Disables MITM protection for that connection.
+SkipTLSVerify = false
+
 # Category applied by Servarr to torrents in qBitTorrent, can be found in Settings > Download Clients > qBit > Category
 Category = "sonarr-anime"
 
@@ -531,6 +546,9 @@ OmbiAPIKey = "CHANGE_ME"
 # Only process approved requests
 ApprovedOnly = true
 
+# If true, do not verify TLS for Ombi HTTPS (self-signed). Disables MITM protection.
+SkipTLSVerify = false
+
 [Sonarr-Anime.EntrySearch.Overseerr]
 # Search Overseerr for pending requests (Will only work if 'SearchMissing' is enabled.)
 # If this and Ombi are both enable, Ombi will be ignored
@@ -545,6 +563,9 @@ OverseerrAPIKey = "CHANGE_ME"
 # Only process approved requests
 ApprovedOnly = true
 
+# If true, do not verify TLS for Overseerr HTTPS (self-signed). Disables MITM protection.
+SkipTLSVerify = false
+
 # Only for 4K Instances
 # Only for 4K Instances
 Is4K = false
@@ -633,6 +654,9 @@ URI = "CHANGE_ME"
 # The Servarr API Key, Can be found it Settings > General > Security
 APIKey = "CHANGE_ME"
 
+# If true, do not verify TLS for this Servarr API (HTTPS). Does not affect Overseerr/Ombi. Disables MITM protection for that connection.
+SkipTLSVerify = false
+
 # Category applied by Servarr to torrents in qBitTorrent, can be found in Settings > Download Clients > qBit > Category
 Category = "radarr-1080"
 
@@ -724,6 +748,9 @@ OmbiAPIKey = "CHANGE_ME"
 # Only process approved requests
 ApprovedOnly = true
 
+# If true, do not verify TLS for Ombi HTTPS (self-signed). Disables MITM protection.
+SkipTLSVerify = false
+
 [Radarr-1080.EntrySearch.Overseerr]
 # Search Overseerr for pending requests (Will only work if 'SearchMissing' is enabled.)
 # If this and Ombi are both enable, Ombi will be ignored
@@ -738,6 +765,9 @@ OverseerrAPIKey = "CHANGE_ME"
 # Only process approved requests
 ApprovedOnly = true
 
+# If true, do not verify TLS for Overseerr HTTPS (self-signed). Disables MITM protection.
+SkipTLSVerify = false
+
 # Only for 4K Instances
 # Only for 4K Instances
 Is4K = false
@@ -826,6 +856,9 @@ URI = "CHANGE_ME"
 # The Servarr API Key, Can be found it Settings > General > Security
 APIKey = "CHANGE_ME"
 
+# If true, do not verify TLS for this Servarr API (HTTPS). Does not affect Overseerr/Ombi. Disables MITM protection for that connection.
+SkipTLSVerify = false
+
 # Category applied by Servarr to torrents in qBitTorrent, can be found in Settings > Download Clients > qBit > Category
 Category = "radarr-4k"
 
@@ -917,6 +950,9 @@ OmbiAPIKey = "CHANGE_ME"
 # Only process approved requests
 ApprovedOnly = true
 
+# If true, do not verify TLS for Ombi HTTPS (self-signed). Disables MITM protection.
+SkipTLSVerify = false
+
 [Radarr-4K.EntrySearch.Overseerr]
 # Search Overseerr for pending requests (Will only work if 'SearchMissing' is enabled.)
 # If this and Ombi are both enable, Ombi will be ignored
@@ -931,6 +967,9 @@ OverseerrAPIKey = "CHANGE_ME"
 # Only process approved requests
 ApprovedOnly = true
 
+# If true, do not verify TLS for Overseerr HTTPS (self-signed). Disables MITM protection.
+SkipTLSVerify = false
+
 # Only for 4K Instances
 # Only for 4K Instances
 Is4K = true
@@ -1019,6 +1058,9 @@ URI = "CHANGE_ME"
 # The Servarr API Key, Can be found it Settings > General > Security
 APIKey = "CHANGE_ME"
 
+# If true, do not verify TLS for this Servarr API (HTTPS). Disables MITM protection for that connection.
+SkipTLSVerify = false
+
 # Category applied by Servarr to torrents in qBitTorrent, can be found in Settings > Download Clients > qBit > Category
 Category = "lidarr-music"
 

diff --git a/docs/configuration/arr/lidarr.md b/docs/configuration/arr/lidarr.md
@@ -21,6 +21,9 @@ URI = "http://localhost:8686"
 # Lidarr API Key (Settings > General > Security)
 APIKey = "your-lidarr-api-key"
 
+# Optional: set true only if Lidarr uses HTTPS with a self-signed or untrusted certificate
+SkipTLSVerify = false
+
 # Category applied by Lidarr to torrents in qBittorrent
 # MUST match: Lidarr > Settings > Download Clients > qBittorrent > Category
 Category = "lidarr-music"

diff --git a/docs/configuration/arr/radarr.md b/docs/configuration/arr/radarr.md
@@ -21,6 +21,9 @@ URI = "http://localhost:7878"
 # Radarr API Key (Settings > General > Security)
 APIKey = "your-radarr-api-key"
 
+# Optional: set true only if Radarr uses HTTPS with a self-signed or untrusted certificate
+SkipTLSVerify = false
+
 # Category applied by Radarr to torrents in qBittorrent
 # MUST match: Radarr > Settings > Download Clients > qBittorrent > Category
 Category = "radarr-movies"

diff --git a/docs/configuration/arr/sonarr.md b/docs/configuration/arr/sonarr.md
@@ -21,6 +21,9 @@ URI = "http://localhost:8989"
 # Sonarr API Key (Settings > General > Security)
 APIKey = "your-sonarr-api-key"
 
+# Optional: set true only if Sonarr uses HTTPS with a self-signed or untrusted certificate
+SkipTLSVerify = false
+
 # Category applied by Sonarr to torrents in qBittorrent
 # MUST match: Sonarr > Settings > Download Clients > qBittorrent > Category
 Category = "sonarr-tv"

diff --git a/docs/configuration/config-file.md b/docs/configuration/config-file.md
@@ -263,7 +263,7 @@ FreeSpace = "50G"
 **Default:** `"-1"` (disabled)
 **Format:** Number + Unit (`K`, `M`, `G`, `T`)
 
-Minimum free space to maintain in download directory. When free space drops below this threshold, qBitrr pauses downloads.
+Minimum free space to maintain in download directory. When usable space above this threshold is insufficient, qBitrr pauses **managed-category** downloads as needed, in **torrent `priority` order**, using a simulated budget so torrents that do not fit do not block smaller ones (see [Disk Space Management — Queue order and simulated budget](../features/disk-space.md#queue-order-and-simulated-budget)).
 
 **Units:**
 
@@ -284,12 +284,10 @@ FreeSpace = "-1"     # Disabled
 **How it works:**
 
 1. qBitrr monitors `FreeSpaceFolder` every loop
-2. If free space < `FreeSpace` threshold:
-   - Pauses all downloads
-   - Keeps seeding active
-   - Logs warning
-3. When space frees up:
-   - Resumes downloads automatically
+2. If usable space is tight relative to the threshold, qBitrr evaluates downloads in monitored categories in **priority order** and pauses those that would exceed the simulated budget (see [Queue order and simulated budget](../features/disk-space.md#queue-order-and-simulated-budget))
+3. Keeps seeding active and logs warnings as needed
+4. When space frees up:
+   - Resumes downloads automatically where appropriate
 
 **Recommendation:** Set to 10-20% of your disk capacity.
 

diff --git a/docs/configuration/qbittorrent.md b/docs/configuration/qbittorrent.md
@@ -21,8 +21,15 @@ Port = 8080
 # qBittorrent WebUI Authentication
 UserName = "admin"
 Password = "your-password"
+
+# Optional: set true only if the Web UI uses HTTPS with a self-signed or untrusted certificate
+SkipTLSVerify = false
 ```
 
+When **`SkipTLSVerify`** is **`true`**, qBitrr does not verify the TLS certificate for the qBittorrent Web API. Use only on trusted networks; verification is disabled for that connection (MITM risk).
+
+Additional qBittorrent instances use **`[qBit-<name>]`** with the same keys, including **`SkipTLSVerify`** per instance.
+
 !!! tip "Finding qBittorrent Settings"
     Open qBittorrent → **Tools** → **Options** → **Web UI** tab to find your connection details.