Disable qBittorrent localhost auth; remove credentials from helpers

LocalhostAuthEnabled=false set in all three qbt configs. portforward-helper and
coordinator now call the API directly without auth — no more ban risk from failed
login attempts.

servers/legion/k8s/media/fornax-coordinator.yaml

@@ -26,30 +26,10 @@ data:
     PRIMARY = BACKENDS[0] if BACKENDS else ""
     sids = {}
 
-    def fetch_sid(backend):
-        data = urllib.parse.urlencode({"username": USER, "password": PASS}).encode()
-        req = urllib.request.Request(f"{backend}/api/v2/auth/login", data=data)
-        try:
-            with urllib.request.urlopen(req, timeout=5) as r:
-                for k, v in r.getheaders():
-                    if k.lower() == "set-cookie" and "SID=" in v:
-                        return v.split("SID=")[1].split(";")[0]
-        except Exception as e:
-            print(f"auth failed for {backend}: {e}")
-        return None
-
-    def sid(backend):
-        if not sids.get(backend):
-            sids[backend] = fetch_sid(backend)
-        return sids.get(backend, "")
-
     def active_count(backend):
         """Return number of downloading torrents on this backend, or large int on error."""
         try:
-            req = urllib.request.Request(
+            req = urllib.request.Request(f"{backend}/api/v2/torrents/info?filter=downloading")
-                f"{backend}/api/v2/torrents/info?filter=downloading",
-                headers={"Cookie": f"SID={sid(backend)}"},
-            )
             with urllib.request.urlopen(req, timeout=3) as r:
                 return len(json.loads(r.read()))
         except Exception:
@@ -62,7 +42,7 @@ data:
         return chosen
 
     def forward(backend, method, path, body, content_type):
-        headers = {"Cookie": f"SID={sid(backend)}"}
+        headers = {}
         if content_type:
             headers["Content-Type"] = content_type
         req = urllib.request.Request(
@@ -73,18 +53,6 @@ data:
             with urllib.request.urlopen(req, timeout=30) as r:
                 return r.status, r.read(), list(r.getheaders())
         except urllib.error.HTTPError as e:
-            if e.code == 403:  # SID expired — refresh once and retry
-                sids[backend] = fetch_sid(backend)
-                headers["Cookie"] = f"SID={sids[backend]}"
-                req2 = urllib.request.Request(
-                    f"{backend}{path}", data=body if method == "POST" else None,
-                    headers=headers, method=method,
-                )
-                try:
-                    with urllib.request.urlopen(req2, timeout=30) as r:
-                        return r.status, r.read(), list(r.getheaders())
-                except Exception as e2:
-                    return 500, str(e2).encode(), []
             return e.code, e.read(), []
         except Exception as e:
             return 500, str(e).encode(), []
@@ -139,10 +107,6 @@ spec:
           env:
             - name: BACKENDS
               value: "http://qbittorrent.media.svc:8080,http://fornax-worker-tx253.media.svc:8080,http://fornax-worker-tx34.media.svc:8080"
-            - name: QBT_USER
-              value: "admin"
-            - name: QBT_PASS
-              value: "adminadmin"
           ports:
             - containerPort: 8080
           volumeMounts:

servers/legion/k8s/media/fornax-workers.yaml

@@ -83,9 +83,7 @@ spec:
                   PORT=$(cat /tmp/gluetun/forwarded_port)
                   if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
                     echo "$(date): Forwarded port: $PORT — updating qBittorrent"
-                    curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
+                    curl -s -X POST http://localhost:8080/api/v2/app/setPreferences \
-                      -d "username=admin&password=adminadmin" >/dev/null 2>&1
-                    curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \
                       -d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
                     echo "$(date): qBittorrent listen port set to $PORT"
                   else
@@ -238,9 +236,7 @@ spec:
                   PORT=$(cat /tmp/gluetun/forwarded_port)
                   if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
                     echo "$(date): Forwarded port: $PORT — updating qBittorrent"
-                    curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
+                    curl -s -X POST http://localhost:8080/api/v2/app/setPreferences \
-                      -d "username=admin&password=adminadmin" >/dev/null 2>&1
-                    curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \
                       -d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
                     echo "$(date): qBittorrent listen port set to $PORT"
                   else

servers/legion/k8s/media/gluetun-qbittorrent.yaml

@@ -75,9 +75,7 @@ spec:
                   PORT=$(cat /tmp/gluetun/forwarded_port)
                   if [ -n "$PORT" ] && [ "$PORT" != "0" ]; then
                     echo "$(date): Forwarded port: $PORT — updating qBittorrent"
-                    curl -s -c /tmp/qbt.txt -X POST http://localhost:8080/api/v2/auth/login \
+                    curl -s -X POST http://localhost:8080/api/v2/app/setPreferences \
-                      -d "username=admin&password=adminadmin" >/dev/null 2>&1
-                    curl -s -b /tmp/qbt.txt -X POST http://localhost:8080/api/v2/app/setPreferences \
                       -d "json={\"listen_port\":$PORT,\"random_port\":false}" >/dev/null 2>&1
                     echo "$(date): qBittorrent listen port set to $PORT"
                   else