Radarr 3.0: buttons/UI not working: 400 bad request

Heya –

Ever since upgrading Radarr to 3.0 the UI stopped working for me (it’s showing weird and outdated stuff in the settings, and clicking most buttons doesn’t work).

My browser console gives me this error:

Bad Request
Transferred1.78 KB (0 B size)
Referrer Policystrict-origin-when-cross-origin

Radarr has a nginx proxy running in front (also Docker) with Lets Encrypt. It’s taking in HTTP/2 requests.

I’ve tried to play around with add_header Referrer-Policy in nginx – but whatever I set this to (including unsafe-url) it throws a similar error.

This is running on an RPi4 (both nginx proxy as well as Radarr/Sonarr). I am not having this issue with Sonarr/Bazarr/etc. Only Radarr is having this issue. Radarr 2.x did not have this problem.

This is my sites config for nginx:

server {
	server_name	radarr.xxxx.one;

	location / {
		auth_basic			"xxxx";
		auth_basic_user_file /srv/xxxx/htpasswd;
		proxy_set_header	X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header	Host $host;
		proxy_set_header	X-Real-IP $remote_addr;
		proxy_http_version	1.1;
		proxy_set_header	Upgrade $http_upgrade;
		proxy_set_header	Connection "Upgrade";

	location ~ /\.git {
		deny  all;

	location ~ /\.ht {
		deny  all;

	listen [::]:443 ssl http2;
	listen 443 ssl http2;
	ssl_certificate /etc/letsencrypt/live/radarr.xxxx.one/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/radarr.xxxx.one/privkey.pem;
	include /etc/letsencrypt/options-ssl-nginx.conf;
	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

And this is my actual nginx config:

user nobody;
worker_processes auto;
pid /run/nginx.pid;

events {
	worker_connections 1024;
	multi_accept on;

http {
	# https://www.nginx.com/blog/thread-pools-boost-performance-9x/
	aio threads;
	# enable HTTP/2 push
	http2_push_preload on;

	# Basic Settings

	sendfile 				on;
	tcp_nopush 				on;
	tcp_nodelay 			on;
	keepalive_timeout		70;
	client_max_body_size 	100m;
	client_body_timeout		60;
	types_hash_max_size 	2048;
	server_tokens 			off;
	server_names_hash_bucket_size 64;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	# SSL Settings

	ssl_protocols TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE, disable TLSv1 TLSv1.1 
	ssl_prefer_server_ciphers on;
	ssl_session_cache		shared:SSL:15m;
	ssl_session_timeout		3d;
	ssl_stapling 			on;
	ssl_stapling_verify 	on;
	ssl_ciphers 			HIGH:!aNULL:!MD5;

	# Security headers

	add_header X-Frame-Options				"SAMEORIGIN" always;
	add_header X-XSS-Protection				"1; mode=block" always;
	add_header X-Content-Type-Options		"nosniff" always;
	add_header Referrer-Policy				"no-referrer-when-downgrade" always;
	add_header Strict-Transport-Security	"max-age=31536000; includeSubDomains; preload" always;

	# Logging Settings

	log_format compression	'$remote_addr ($http_x_forwarded_for) - $remote_user [$time_local] '
							'$host "$request" $status $body_bytes_sent '
							'"$http_referer" "$http_user_agent" "$gzip_ratio" "$request_time"';
	access_log /dev/stdout compression;
	error_log /dev/stderr;
	log_not_found			off;

	# Gzip Settings

	gzip on;
	gzip_vary on;
	gzip_proxied any;
	gzip_comp_level 6;
	gzip_buffers 16 8k;
	gzip_http_version 1.1;
	gzip_types text/plain text/css application/json application/javascript text/xml application/atom+xml image/svg+xml application/xml application/xml+rss text/javascript;

	# Virtual Host Configs

	include /etc/nginx/conf.d/*.conf;
	include /etc/nginx/sites-enabled/*;

What am I missing here?

I tried to use HTTP1.1 instead of HTTP2.0 and the same issue happens:

I’ve also tried to destroy the config and start with a clean/blank installation, and the same problem is happening.

# uname -a
Linux server 5.10.11-v7l+ #1399 SMP Thu Jan 28 12:09:48 GMT 2021 armv7l GNU/Linux

Post a full docker log and also post the command you used to create the container

Logs: at NzbDrone.Common.Http.HttpClient.ExecuteRequest(HttpRequest request, Cookie - Pastebin.com

The DNS issues are ‘normal’ (I can’t change/configure anything, and it’s trying to connect to the wrong indexers/downloaders). Just need to change the hostnames into IPs.

This is my docker startup script:

git pull

TIMEZONE=`cat /etc/timezone`

docker pull ghcr.io/linuxserver/deluge
docker pull ghcr.io/linuxserver/jackett
docker pull ghcr.io/linuxserver/bazarr
docker pull ghcr.io/linuxserver/radarr
docker pull ghcr.io/linuxserver/sonarr
docker pull ghcr.io/linuxserver/lazylibrarian

# Run disconnect to unlock resolv.conf file. Prevents errors when rm'ing
docker exec downloader-wg nordvpn disconnect

docker stop downloader-wg deluge jackett bazarr radarr sonarr lazylibrarian

# Issues with resolv.conf: Error response from daemon: unable to remove filesystem for x: unlinkat xe/resolv.conf: operation not permitted
chattr -i /var/lib/docker/containers/*/resolv.conf

docker rm -f downloader-wg deluge jackett bazarr radarr sonarr lazylibrarian

docker build -t downloader-wg --no-cache .

docker run -d --name=downloader-wg --hostname=downloader-wg-`hostname` --privileged \
                -p 8112:8112 -p 58846:58846 -p 58946:58946 -p 9117:9117 -p 6767:6767 -p 7878:7878 -p 8989:8989 -p 5299:5299 \
                -e PUID=1000 -e PGID=1000 -e GROUPID=1000 -e TZ=$TIMEZONE --sysctl="net.ipv4.conf.all.src_valid_mark=1" \
                --sysctl="net.ipv4.conf.all.rp_filter=2" \
                --device /dev/net/tun --restart always downloader-wg

docker run -d --name=jackett --network container:downloader-wg -e PUID=1000 -e PGID=1000 -e TZ=$TIMEZONE -v /srv/downloader/jackett/:/config -v /srv/downloader/downloads/client:/downloads --restart always ghcr.io/linuxserver/jackett
docker run -d --name=deluge --network container:downloader-wg -e PUID=1000 -e PGID=1000 -e TZ=$TIMEZONE -e UMASK_SET=022 -e DELUGE_LOGLEVEL=error -v /srv/downloader/deluge/config:/config -v /srv/downloader/downloads/client:/downloads --restart always ghcr.io/linuxserver/deluge
docker run -d --name=bazarr --network container:downloader-wg -e PUID=1000 -e PGID=1000 -e TZ=$TIMEZONE -e UMASK_SET=022 -v /srv/downloader/bazarr/config:/config -v /srv/downloader/downloads/Movies:/movies -v /srv/downloader/downloads/TV:/tv -v /srv/downloader/downloads/client:/downloads --restart always ghcr.io/linuxserver/bazarr
docker run -d --name=radarr --network container:downloader-wg -e PUID=1000 -e PGID=1000 -e TZ=$TIMEZONE -e UMASK_SET=022 -v /srv/downloader/radarr/config:/config -v /srv/downloader/downloads/Movies:/movies -v /srv/downloader/downloads/client:/downloads --restart always ghcr.io/linuxserver/radarr
docker run -d --name=sonarr --network container:downloader-wg -e PUID=1000 -e PGID=1000 -e TZ=$TIMEZONE -e UMASK_SET=022 -v /srv/downloader/sonarr/config:/config -v /srv/downloader/downloads/TV:/tv -v /srv/downloader/downloads/client:/downloads --restart always ghcr.io/linuxserver/sonarr
docker run -d --name=lazylibrarian --network container:downloader-wg -e PUID=1000 -e PGID=1000 -e TZ=$TIMEZONE -e UMASK_SET=022 -v /srv/downloader/lazylibrarian/config:/config -v /srv/downloader/downloads/client:/downloads -v /srv/downloader/lazylibrarian/books:/books --restart always ghcr.io/linuxserver/lazylibrarian

Restart the container and post a full log. We need to see all the init steps including the lsio banner

# docker logs radarr
[s6-init] making user provided files available at /var/run/s6/etc...exited 0.
[s6-init] ensuring user provided files have correct perms...exited 0.
[fix-attrs.d] applying ownership & permissions fixes...
[fix-attrs.d] done.
[cont-init.d] executing container initialization scripts...
[cont-init.d] 01-envfile: executing...
[cont-init.d] 01-envfile: exited 0.
[cont-init.d] 10-adduser: executing...

          _         ()
         | |  ___   _    __
         | | / __| | |  /  \
         | | \__ \ | | | () |
         |_| |___/ |_|  \__/

Brought to you by linuxserver.io

To support the app dev(s) visit:
Radarr: https://opencollective.com/radarr

To support LSIO projects visit:

User uid:    1000
User gid:    1000

[cont-init.d] 10-adduser: exited 0.
[cont-init.d] 30-config: executing...
[cont-init.d] 30-config: exited 0.
[cont-init.d] 99-custom-scripts: executing...
[custom-init] no custom files found exiting...
[cont-init.d] 99-custom-scripts: exited 0.
[cont-init.d] done.
[services.d] starting services
You are using a legacy method of defining umask
please update your environment variable from UMASK_SET to UMASK
to keep the functionality after July 2021
[services.d] done.
[Info] Bootstrap: Starting Radarr - /app/radarr/bin/Radarr.dll - Version
[Info] AppFolderInfo: Data directory is being overridden to [/config]
[Info] Router: Application mode: Interactive
[Info] MigrationController: *** Migrating data source=/config/radarr.db;cache size=-20000;datetimekind=Utc;journal mode=Wal;pooling=True;version=3 ***
[Info] MigrationController: *** Migrating data source=/config/logs.db;cache size=-20000;datetimekind=Utc;journal mode=Wal;pooling=True;version=3 ***
[Info] WebHostController: Listening on the following URLs:
[Info] WebHostController:   http://*:7878
[Info] RadarrBootstrapper: Starting Web Server
[Info] CommandExecutor: Starting 2 threads for tasks.
[Error] RemotePathMappingCheck: Unknown error occured in RemotePathMapping HealthCheck

[v3.0.2.4552] System.Net.WebException: DNS Name Resolution Failure: 'deluge'
   at NzbDrone.Common.Http.Dispatchers.ManagedHttpDispatcher.GetResponse(HttpRequest request, CookieContainer cookies) in D:\a\1\s\src\NzbDrone.Common\Http\Dispatchers\ManagedHttpDispatcher.cs:line 95
   at NzbDrone.Common.Http.HttpClient.ExecuteRequest(HttpRequest request, CookieContainer cookieContainer) in D:\a\1\s\src\NzbDrone.Common\Http\HttpClient.cs:line 121
   at NzbDrone.Common.Http.HttpClient.Execute(HttpRequest request) in D:\a\1\s\src\NzbDrone.Common\Http\HttpClient.cs:line 57
   at NzbDrone.Core.Download.Clients.Deluge.DelugeProxy.AuthenticateClient(JsonRpcRequestBuilder requestBuilder, DelugeSettings settings, Boolean reauthenticate) in D:\a\1\s\src\NzbDrone.Core\Download\Clients\Deluge\DelugeProxy.cs:line 307
   at NzbDrone.Core.Download.Clients.Deluge.DelugeProxy.BuildRequest(DelugeSettings settings) in D:\a\1\s\src\NzbDrone.Core\Download\Clients\Deluge\DelugeProxy.cs:line 214
   at NzbDrone.Core.Download.Clients.Deluge.DelugeProxy.ProcessRequest[TResult](DelugeSettings settings, String method, Object[] arguments) in D:\a\1\s\src\NzbDrone.Core\Download\Clients\Deluge\DelugeProxy.cs:line 221
   at NzbDrone.Core.Download.Clients.Deluge.DelugeProxy.GetConfig(DelugeSettings settings) in D:\a\1\s\src\NzbDrone.Core\Download\Clients\Deluge\DelugeProxy.cs:line 75
   at NzbDrone.Core.Download.Clients.Deluge.Deluge.GetStatus() in D:\a\1\s\src\NzbDrone.Core\Download\Clients\Deluge\Deluge.cs:line 200
   at NzbDrone.Core.HealthCheck.Checks.RemotePathMappingCheck.Check() in D:\a\1\s\src\NzbDrone.Core\HealthCheck\Checks\RemotePathMappingCheck.cs:line 62

Did you try connecting directly without the reverse proxy?
Did you clear browser cache (or incognito with cache disabled)?

Incognito/other browser is not making a difference.

Okay – connecting directly (docker run -d --name=radarr -p 7878:7878 -e PUID=1000 -e PGID=1000 -e TZ=$TIMEZONE -v /srv/downloader/radarr/config:/config -v /srv/downloader/downloads/Movies:/movies -v /srv/downloader/downloads/client:/downloads --restart always ghcr.io/linuxserver/radarr) works significantly better. The UI is responsive and clicking buttons actually does things.

My database (upgraded from 2.x to 3.x) is still empty but I guess I can live with that (some of my previous settings/databases seem gone).

I am still seeing 400 errors in the dev logs (they may not have been related to my actual issue?)
EDIT: the 400 errors seem to be related to the other containers being offline. Testing for example SMTP works (something that didn’t work before).

But then I don’t understand what’s wrong with my nginx rproxy.

this is our SWAG (nginx) proxy conf:

and the referenced proxy.conf:

Cool – seems like proxy_set_header Connection "Upgrade"; was the bad option and caused it to break.

Thank you so much!

Based on your config: proxy_set_header Connection $connection_upgrade; I am getting:

2021/04/05 22:35:53 [emerg] 1#1: unknown "connection_upgrade" variable
nginx: [emerg] unknown "connection_upgrade" variable

This is an alpine based nginx container.

we set that in here: docker-swag/nginx.conf at master · linuxserver/docker-swag · GitHub

You might want to look into our swag image, it can save you a lot of headaches as it contains preset proxy confs for many apps, as well as automated certbot (both letsencrypt and zerossl are supported), php and fail2ban

Aha – works. Not sure why the upgrade part doesn’t work for Radarr.

The reason I am hosting my own docker (besides learning) is that a few more sites are hosted/proxied. Didn’t look into detail if that’s possible with yours.


Absolutely, it’s just nginx under the hood with a bunch of automation and preset confs added to it. We provide template proxy confs that work for most apps/services without modification: reverse-proxy-confs/_template.subdomain.conf.sample at master · linuxserver/reverse-proxy-confs · GitHub

Here’s a guide with a bunch of hosting and reverse proxy examples: SWAG setup - LinuxServer.io

1 Like

This topic was automatically closed 5 days after the last reply. New replies are no longer allowed.