EXTENSIONS

SSH-based management of a self-hosted, Cloudflare-free public ingress: nftables/Docker firewall reconciliation, a WireGuard tunnel, a Traefik reverse proxy with its own Let's Encrypt certs, an Authelia forward-auth gate (file or shared-LDAP-directory backed, with optional OIDC provider), an LLDAP user directory, and fail2ban jails. Encodes several non-obvious operational gotchas (Docker chain wipe on nftables reload, mobile-app auth bypass paths, fail2ban's reload-vs-restart trap) discovered standing up a real homelab edge.

List, add (Torznab), and remove Prowlarr indexers via its REST API, with the API key resolved from a vault at execution time instead of passed as a literal.

Read-only inventory of TCP ports listening on the local host, correlated with owning process (via ss) and, where applicable, the Docker container that published it (via docker ps). Useful as a pre-flight check before binding a new service to a port.

Download client, acquisition provider, and settings configuration for Shelfarr (audiobook/ebook acquisition tool), via a companion admin shim since Shelfarr itself has no admin API — only session-cookie/CSRF-protected HTML forms. API key resolved from a vault at execution time.

Read-only VPN status and public IP visibility for gluetun's HTTP control server, using the protocol-agnostic status endpoint (not the OpenVPN-specific one, which misreports on WireGuard setups). API key resolved from a vault at execution time.

Category CRUD and connection verification for qBittorrent's WebUI API, with session-cookie login handled internally and credentials resolved from a vault at execution time instead of passed as literals.

Category CRUD, queue/history visibility, and NZB-by-URL submission for SABnzbd via its REST API, with the API key resolved from a vault at execution time instead of passed as a literal.