Byparr on PMSS

Byparr gives Prowlarr on your Pulsed Media seedbox the FlareSolverr proxy it needs for indexers that sit behind Cloudflare's browser check. Prowlarr hands it those requests, and Byparr opens each page in a headless Firefox and returns the page and its cookies. It is heavy: the image is 3.47 GB, it uses 1.1 to 1.4 GiB of memory, and the first page fetch after a start took up to two minutes in the test. It runs in rootless Docker inside your account. Tested on one Pulsed Media seedbox on 24 October 2026 with ghcr.io/thephaseless/byparr v3.0.4. The test fetched plain web pages and passed Prowlarr's own proxy test; getting through a real Cloudflare check was not part of it.

Privacy

Level: MEDIUM. Using Byparr reduces your privacy. What it sends out, and who else can use it:

Every page Byparr opens sees the server's IP address and a full Firefox browser (the user agent in the test was Firefox 151 on Windows), not your own connection.
Byparr's Docker health check opens https://google.com in its browser every 15 minutes: the image's health check calls Byparr's /health address, and that address loads google.com (Byparr v3.0.4 source, Dockerfile and src/endpoints.py).
Byparr has no login. Prowlarr must reach it at http://127.0.0.1:PORT/, and every other account on the same server can reach that address too. They could make your Byparr fetch pages for them, using your memory and CPU, from the server's address. Byparr's only token setting, OWUI_API_KEY, guards its /load address, not the /v1 address that Prowlarr uses (Byparr v3.0.4 source, src/owui.py).

Requirements

Need	Byparr on PMSS
Memory	1.1 to 1.37 GiB measured in the test. While fetching a page it used 540% to 910% CPU, five to nine cores' worth, on a busy test server.
Disk	The image is 3.47 GB. Docker keeps it in your home folder, so it counts toward your disk quota. The install creates no folder of its own.
Start time	On the busy test server the very first start took 83 seconds before the port answered. In five timed restarts after it, the port answered 31 to 60 seconds after the start and the first page fetch took 52 to 119 seconds. Every one of them worked.
Own login	No. See Privacy.
Address	Prowlarr uses `http://127.0.0.1:PORT/`. An optional web path behind your panel login is in step 3.
Other apps	Prowlarr, which Install Media Stack installs.

Install

Replace PORT with a free port between 2000 and 38000 that ss -tln does not list. Byparr has no login to set, so unlike the other app guides there is no first start without a port: it is open from the moment its port exists.

1. Start it on loopback only. The image is pinned to the digest that was tested. --shm-size=1g gives its browser shared memory; the test used 1 GB, and Byparr's README says 512 MB is usually enough.

docker run -d --name byparr --shm-size=1g -p 127.0.0.1:PORT:8191 \
  ghcr.io/thephaseless/byparr@sha256:874f719518f617d03a60e03411fc5d090647e1a877041e81f8dc965927c7deb6

2. Wait for it, then fetch one page. The first command prints 301 once Byparr answers (a redirect to its /docs page). Repeat it until it does.

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:PORT/
curl -s -m 150 -X POST -H 'Content-Type: application/json' \
  -d '{"cmd":"request.get","url":"https://example.com","maxTimeout":60000}' \
  http://127.0.0.1:PORT/v1 | grep -o '"status": *"[a-z]*"'

The second command prints "status":"ok". In the test it took 52 to 119 seconds after each start.

3. Optional: a web path behind your panel login. Prowlarr cannot use this path (see Integrate). It is for a program that can send your panel login with HTTP basic auth, for example curl reading the login from a config file. Save it as ~/.lighttpd/custom.d/byparr.conf, with your USERNAME and PORT:

$HTTP["url"] =~ "^/user-USERNAME/byparr($|/)" {
  setenv.set-request-header = ( "Authorization" => "" )
  proxy.server = ( "" => ( (
    "host" => "127.0.0.1",
    "port" => PORT
  ) ) ),
  proxy.header = (
    "upgrade" => "enable",
    "map-urlpath" => (
      "/user-USERNAME/byparr/" => "/",
      "/user-USERNAME/byparr" => ""
    )
  )
}

There is no auth.require = () line, so your panel login stays in front of the path. The setenv.set-request-header line stops your web server from passing that login, your account password, on to Byparr after it has checked it. Without the line it is passed on even with the panel login in front. On 24 October 2026 this line was tested with a small test app: requests without a login were still refused and the app received no password. That test did not use Byparr. map-urlpath strips the path, because Byparr has no base-URL setting. Check the syntax with /usr/sbin/lighttpd -t -f ~/.lighttpd.conf. Your web server picks up the file within about a minute (Lighttpd Custom Configuration).

Configure

Adding --restart unless-stopped to the step 1 command brings Byparr back when your Docker daemon restarts, as described on Rootless DOCKER. The test ran without it.
Adding --no-healthcheck to the step 1 command stops the health check that opens google.com every 15 minutes. That was not tested.

Integrate

In Prowlarr, open Settings → Indexer Proxies, click +, and choose FlareSolverr (Servarr wiki, Prowlarr settings):

Host: http://127.0.0.1:PORT/
Request Timeout: the test used 100 seconds. Prowlarr's default is 60 and its maximum is 180. The first fetch after a start took up to 119 seconds on the test server.
Tags: give the proxy a tag, and give the same tag to each indexer that needs it. Prowlarr uses the proxy only for indexers with a matching tag, and only when it detects Cloudflare. A proxy without a tag is disabled.

In the test, Prowlarr 2.6.5's proxy test against http://127.0.0.1:PORT/ passed after 97 seconds.

Why not the web path from step 3: Prowlarr's FlareSolverr proxy has only the Host and Request Timeout fields, so it cannot send your panel login. In the test, the web path without a login answered Prowlarr with 401. A Host with user:password@ in it was refused by Prowlarr itself ("Uri didn't match expected pattern"). So Prowlarr must use the port directly, which other accounts on the server can use too (see Privacy).

Test

docker ps --filter name=byparr shows the container as Up. Its health may read "starting" for a long time: in the test it still did after 9 minutes.
Step 2's page fetch prints "status":"ok".
If you made the step 3 path, requests without your panel login are refused:

curl -s -o /dev/null -w '%{http_code}\n' https://SERVER/user-USERNAME/byparr/docs
curl -s -o /dev/null -w '%{http_code}\n' -X POST https://SERVER/user-USERNAME/byparr/v1

In the test both returned 401, and with the panel login a page fetch through the path returned "status":"ok". The port itself has no login: in the test, page fetches sent to http://127.0.0.1:PORT/v1 without any login returned 200. Those requests came from the same account; a request from another account was not made, but other accounts on the server can connect to 127.0.0.1 ports (Rootless DOCKER).

Uninstall

docker rm -f byparr
rm -f ~/.lighttpd/custom.d/byparr.conf
touch ~/.lighttpd/custom

The last two lines are for the optional step 3 path. Deleting a fragment changes no remaining file, so touch ~/.lighttpd/custom makes your web server restart without it within about a minute (Lighttpd Custom Configuration explains why). docker rmi ghcr.io/thephaseless/byparr@sha256:874f719518f617d03a60e03411fc5d090647e1a877041e81f8dc965927c7deb6 frees the image's 3.47 GB. The install created no folder, so nothing else is left. Remove the proxy from Prowlarr's Indexer Proxies too.

Troubleshooting

The /docs page under the web path shows "Failed to load API definition" and "Not Found /openapi.json": the page asks for /openapi.json at the top of the server, outside your path. Byparr itself still works; Prowlarr does not use that page.

Byparr's /docs page under /user-USERNAME/byparr/ in the 24 October 2026 test: it cannot load its definition from outside the path.

Prowlarr's proxy test or a search times out: the first fetch after a start took up to 119 seconds in the test. Raise Request Timeout (the maximum is 180) or wait until step 2's fetch works, then test again.
Step 2's first command prints 000: Byparr is still starting. In the test the port answered 31 to 60 seconds after the start.
docker pull or docker run fails before Byparr starts: see the troubleshooting section of Rootless DOCKER.