Point Servarr download clients at internal Docker hosts so API calls bypass Authentik forward_auth.

After batch 2 SSO, Sonarr/Radarr hitting nzbget.ginnoir.com got 302 from Caddy instead of NZBGet JSON-RPC.

scripts/apply-media-external-auth.sh

@@ -125,6 +125,49 @@ print("  dangerous_allow_public_without_auth=true, cleared username/password")
 PY
 docker restart stash >/dev/null
 
+echo "=== *arr download clients: internal Docker URLs (bypass Caddy forward_auth) ==="
+python3 - <<'PY'
+import json
+import sqlite3
+
+# Servarr apps talk to download clients over the media network, not via *.ginnoir.com.
+INTERNAL = {
+    "Nzbget": ("nzbget", 6789),
+    "QBittorrent": ("qbittorrent", 3232),
+    "Deluge": ("deluge", 8112),
+}
+PUBLIC_SUFFIX = ".ginnoir.com"
+LOCALHOSTS = {"localhost", "127.0.0.1"}
+
+for app in ("sonarr", "radarr", "prowlarr", "whisparr"):
+    db = f"/config/{app}/{app}.db"
+    conn = sqlite3.connect(db)
+    cur = conn.cursor()
+    cur.execute("SELECT Id, Name, Implementation, Settings FROM DownloadClients")
+    for cid, name, impl, settings_json in cur.fetchall():
+        if impl not in INTERNAL:
+            continue
+        settings = json.loads(settings_json)
+        host = (settings.get("host") or "").strip()
+        internal_host, port = INTERNAL[impl]
+        if host == internal_host and settings.get("port") == port and not settings.get("useSsl"):
+            continue
+        if PUBLIC_SUFFIX in host or host in LOCALHOSTS:
+            old = f"{host}:{settings.get('port')}"
+            if settings.get("useSsl"):
+                old += " ssl"
+            settings["host"] = internal_host
+            settings["port"] = port
+            settings["useSsl"] = False
+            cur.execute(
+                "UPDATE DownloadClients SET Settings=? WHERE Id=?",
+                (json.dumps(settings), cid),
+            )
+            print(f"  {app}/{name}: {old} -> {internal_host}:{port} http")
+    conn.commit()
+    conn.close()
+PY
+
 echo "=== deluge: bypass web login (Authentik at edge; patch re-applies on recreate) ==="
 if docker exec deluge grep -q 'homelab external auth' /lsiopy/lib/python3.12/site-packages/deluge/ui/web/auth.py 2>/dev/null; then
   echo "  already patched"