barney241/arr-proxy repository overview

⁠Arr-Proxy

https://github.com/Barney241/arr-proxy⁠

A secure API gateway for Sonarr and Radarr. Enforces endpoint whitelists, injects API keys, and handles authentication.

⁠Quick Start

docker run -p 8080:8080 \
  -e APP_PORT=8080 \
  -e APP_API_KEY=my-secret-key \
  -e RADARR_URL=http://radarr:7878 \
  -e RADARR_API_KEY=your-radarr-key \
  barney241/arr-proxy:latest

curl -H "X-Api-Key: my-secret-key" http://localhost:8080/radarr/api/v3/system/status

⁠Features

• Authentication: API Key (default), mTLS, or Basic Auth
• Whitelist Enforcement: Block endpoints not in your allow-list
• Method Restrictions: Limit endpoints to specific HTTP methods (GET, POST, etc.)
• Secret Injection: Clients don't need backend API keys
• Structured Logging: JSON logs with request tracing

⁠Endpoints

⁠Documentation

• Configuration⁠ - Environment variables, YAML config, whitelist patterns
• Authentication⁠ - API Key, mTLS, Basic Auth setup
• Certificates⁠ - Generating TLS certificates

⁠Examples

See examples/⁠ for Docker Compose configurations:

• docker-compose.yml⁠ - Basic HTTP setup
• docker-compose.tls.yml⁠ - TLS enabled
• docker-compose.mtls.yml⁠ - Mutual TLS
• docker-compose.custom-whitelist.yml⁠ - Custom whitelists
• config/⁠ - Example service configurations

⁠Architecture

Client  ──▶  arr-proxy  ──▶  Sonarr/Radarr
              │
         ┌────┴────┐
         │Whitelist│
         │  Auth   │
         │API Keys │
         └─────────┘