ap@debianA:~$ grep -n host_whitelist /opt/sparkbox/modules/media/config/sabnzbd/sabnzbd.in

Posted by newfreezer

My question: ap@debianA:~$ grep -n hostwhitelist /opt/sparkbox/modules/media/config/sabnzbd/sabnzbd.ini 4:hostwhitelist = sb-gluetun, sb-sabnzbd, debiana, debiana.local, vault.sparkbox.local, f8f00c648d14.local SparkBox AI replied: There it is — confirmed. Your IP was in the file right before the restart, and it's gone right after. sparkbox restart media (or SAB's own startup inside that cycle) is actively reverting this specific line back to a fixed list every time. That's not something I can fix by editing the file again — we've now proven three separate times that the edit sticks until SAB/media restarts, then reverts. I don't have documentation on SparkBox managing SAB's hostwhitelist on every start, and I'm not going to invent a mechanism to explain it. Two real options right now: 1. Practical workaround while this gets looked at — use the SSH tunnel approach from earlier, but from your own PC this time (you said main PC gets connection refused on SSH — is that actual refusal, or just untested?). If SSH from your PC to the NAS works at all, tunneling in as localhost sidesteps the whitelist entirely since localhost/container names are always allowed and don't get touched by this revert. 2. Flag it — this is reproducible, and it's a real oddity in how SparkBox/SABnzbd config is being handled. Click "Share to demox" below and paste this whole thread — Tom can see the exact revert behavior and ship a fix if it's on SparkBox's side. I'd try SS …(reply truncated — full chat sent to Tom)

3 replies

newfreezer wrote:

Whenever I try to open SABnzbd I get this: External internet access denied - https://sabnzbd.org/access-denied and the AI couldn't figure out

Chris wrote:

newfreezer — I found the issue. SABnzbd'\''s hostwhitelist rebuilds from /config/sparkbox-host-whitelist every time the media stack starts. When you edit sabnzbd.ini directly, that edit sticks until SAB restarts — then the init script overwrites it from scratch. That'\''s by design: the whitelist is supposed to come from the hints file that sparkbox up writes on the host (your box'\''s hostname, hostname.local, your Tailscale name if you have one, and any custom names you set via SBDOMAIN). IPs are filtered out by the rebuild logic — they'\''re not names, so they get dropped. For the External internet access denied error you'\''re seeing now: SAB is refusing your request because your hostname or browser address isn'\''t in the whitelist. Check what hostname or IP you'\''re using to reach SABnzbd, and try these: 1. Via the NAS hostname directly: If your box is called debiana, try http://debiana:8081 or http://debiana.local:8081 2. Via container names: Inside the network, http://sb-sabnzbd:8081 always works (always whitelisted) 3. Via IP: The rebuilding script drops raw IPs — it'\''s designed to work with names. If stuck with IP-only access, add a custom DNS name via SBDOMAIN (it gets written to the hints). Which address are you using to reach SAB when you get the error?

Chris wrote:

Sorry, newfreezer — the addresses I gave you above were wrong, and the assistant should never have sent you into that file in the first place. That's on us. Two things got mixed up. The whitelist line: your box rebuilds it from your own box's names every time the media stack starts, which is why your edit keeps vanishing. That is intended. An IP address, or a name ending in .local, is always accepted by SABnzbd without being on that list, so there was never anything to add there. The "External internet access denied" page is a different check. SABnzbd looks at where the connection is coming FROM — your PC's address as SABnzbd sees it — and by default only lets home-network addresses through. Nothing you type in the address bar and nothing on the whitelist changes that. And the page for SABnzbd is on port 8186, not 8081 (8081 only exists inside the box's private network, so nothing on your PC can reach it). One check when you have a moment, on the box: sudo grep -i "Refused connection" /opt/sparkbox/modules/media/config/sabnzbd/logs/sabnzbd.log | tail -3 That line names the address SABnzbd is turning away. Tell me what kind of address it is (starts with 192.168, 10., 100., or something else) and I'll give you the right fix from there. We've corrected what the assistant knows here, so the next person gets the right port and the right explanation the first time.