From 86550e12616f33c689d166a78b714b99300c9ee0 Mon Sep 17 00:00:00 2001
From: ibizaman <ibizaman@tiserbox.com>
Date: Mon, 23 Feb 2026 21:50:53 +0100
Subject: [PATCH] arr: bypass authentication for readarr when sso is enabled

---
 modules/services/arr.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/modules/services/arr.nix b/modules/services/arr.nix
index a8ebe9c..c7bc938 100644
--- a/modules/services/arr.nix
+++ b/modules/services/arr.nix
@@ -515,6 +515,7 @@ in
     (lib.mkIf cfg.readarr.enable (
       let
         cfg' = cfg.readarr;
+        isSSOEnabled = !(isNull cfg'.authEndpoint);
       in
       {
         services.readarr = {
@@ -525,7 +526,12 @@ in
           extraGroups = [ "media" ];
         };
         systemd.services.readarr.preStart = shb.replaceSecrets {
-          userConfig = cfg'.settings;
+          userConfig =
+            cfg'.settings
+            // (lib.optionalAttrs isSSOEnabled {
+              AuthenticationRequired = "DisabledForLocalAddresses";
+              AuthenticationMethod = "External";
+            });
           resultPath = "${cfg'.dataDir}/config.xml";
           generator = apps.readarr.settingsFormat.generate;
         };