Media Stack Exposed and Protected Status
If you installed the media stack (Jellyfin, Radarr, Sonarr, Prowlarr, SABnzbd, Autobrr) through install-media-stack.sh, your account welcome page lists each installed app with a status badge: Protected or Exposed.
What the badges mean
The badge reflects whether that specific app has its own login configured. It is not about whether the URL itself requires a password.
- Protected — the app has its own username/password (or admin account) set up. You need to log in to reach it.
- Exposed — the panel could not find app-level login configured for that app. Anyone with the URL can open it without a password.
The panel checks this by reading each app's own local configuration file or database (for example Radarr/Sonarr/Prowlarr's config.xml, SABnzbd's sabnzbd.ini, or Autobrr's local user database) to see whether credentials are set. It does not touch your other files.
This is separate from the reverse-proxy path itself. Every media stack app is served at /public-USERNAME/appname/, and that path is intentionally not gated by an HTTP login prompt at the proxy level; the same path is used for general public web hosting on PMSS accounts. Ports are randomized per user, so the URL is not published or guessable, but that is an obscurity layer, not a substitute for the app's own login. The app's own login is what actually secures access to that specific app.
What changes the state
On first install, install-media-stack.sh configures each app's own login automatically and writes the generated credentials to ~/.media-stack-credentials.txt:
- Jellyfin — admin user created through Jellyfin's own startup API.
- Radarr / Sonarr / Prowlarr — forms authentication enabled through the app's local host-config API.
- SABnzbd — username and password set in its
[misc]config section. - Autobrr — admin user created with
autobrrctl create-user.
A freshly installed app should show Protected. It shows Exposed if the install did not finish that step, if the app's own login was manually removed or reset from inside the app, or if the app's config could not be found where expected (for example after a reinstall outside the normal flow).
Securing an exposed app
For any app currently shown as Exposed, the panel has a Secure this app button next to it. Clicking it runs the same installer, scoped to just that app (install-media-stack.sh --secure-app=APPNAME), as your own account. No SSH is needed. It configures a fresh login for that app and adds the generated credential to ~/.media-stack-credentials.txt.
If the button is not available, the panel shows why (app not installed, installer files incomplete, or similar). In that case SSH access lets you run the installer or repair the app directly.