Enable Authentik SSO for qBittorrent once upstream supports UI/API auth decoupling

[claytono]

qBittorrent cannot be placed behind Authentik today. Disabling UI auth also disables API auth, and qBittorrent does not support basic auth, so forward/basic auth patterns break.

Blocked by upstream: qbittorrent/qBittorrent#13238

Next steps once unblocked:

• Decide approach (simple forward-auth vs basic-auth) based on upstream support
• Update with and appropriate for API (e.g., /api(/|$))
• Regenerate Authentik blueprints via pre-commit (ak-collect-blueprints)
• Validate UI and API flows behind Authentik

[claytono]

Qui appears to support oidc for the ui and proxying the qbittorrent api, so we can probably use that.

[github-actions]

Issue Triage Report

Status: BLOCKED (waiting for qBittorrent v5.2.0 release)

Upstream Dependencies

Issue: WebUI: Single Sign-On with Traefik

• State: Closed (completed)
• Created: August 5, 2020
• Closed: January 5, 2026
• Notable: Issue closed after both required PRs merged

PR: WebAPI: Add support for authenticating via API key

• State: Merged
• Merged: October 16, 2025
• Target version: v5.2.0
• Notable: Enables API authentication separate from WebUI

PR: WebUI: Support authenticating via Basic auth

• State: Merged
• Merged: January 5, 2026
• Target version: v5.2.0
• Notable: Enables forward-auth/basic-auth patterns for reverse proxy SSO

Current State

• Latest qBittorrent release: v5.1.4 (November 19, 2025)
• Features merged to master but not yet in a release
• Waiting for v5.2.0 to be released and container images updated

Workaround Deployed

Qui has been deployed as an alternative frontend (currently v1.12.0). Qui provides:

• OIDC support for SSO via Authentik
• Proxies the qBittorrent API

This provides a working SSO solution for the qBittorrent WebUI while waiting for native support.

What's Needed

1. qBittorrent v5.2.0 needs to be released
2. Container images (linuxserver/qbittorrent, onedr0p/qbittorrent) need to update to v5.2.0
3. Renovate will create a PR when v5.2.0 images are available
4. After updating, native Authentik SSO can be configured for qBittorrent WebUI

[github-actions]

Issue Triage Report

Status: BLOCKED (waiting for qBittorrent v5.2.0 release)

Upstream Dependencies

Issue: WebUI: Single Sign-On with Traefik

• State: Closed (completed)
• Closed: January 5, 2026

PR: WebAPI: Add support for authenticating via API key

• State: Merged
• Merged: October 16, 2025

PR: WebUI: Support authenticating via Basic auth

• State: Merged
• Merged: January 5, 2026

Current State

• Latest qBittorrent release: v5.1.4 (unchanged)
• Both required PRs merged to master but not yet in a release
• v5.2 milestone: 15 open issues, 281 closed — milestone
• Release preparation underway: v5_2_x branch is active (last commit Feb 3, 2026) and a backport tracking issue was created Feb 7, 2026
• No RC or beta tags yet

Workaround Deployed

Qui remains deployed as an alternative frontend with OIDC support via Authentik.

What Changed

• Previous status (Jan 20): BLOCKED — no release branch activity noted
• Current: Still BLOCKED, but release preparation is now actively underway with the v5_2_x branch receiving backports and a dedicated backport tracking issue created 3 days ago
• Renovate PR #1381 updated qbittorrent digest on Feb 9 — still v5.1.4

What's Needed

1. qBittorrent v5.2.0 needs to be released (release branch active, appears to be approaching)
2. Container images (linuxserver/qbittorrent) need to update to v5.2.0
3. Renovate will create a PR when v5.2.0 images are available
4. After updating, native Authentik SSO can be configured for qBittorrent WebUI