Getting started

1. Install #

Dashboarr ships on three channels:

• Apple App Store for iPhone and iPad.
• Google Play for Android.
• A signed APK attached to each GitHub release, for de-Googled or sideloaded installs. Sideloaded builds update manually: the app checks the releases page and opens it for you, but there is no in-app installer.

The optional push-notification backend is a separate, self-hosted Docker or Node.js service. You do not need it to use the app. Section 8 covers it.

2. First launch #

On a fresh install the Dashboard tab shows:

A three-step intro carousel explains the workspace concept. You can skip it and replay it later from Settings, About, "Show workspace tour".

A few things already exist before you configure anything:

• One dashboard named Default, holding three widget cards: Service Health, Radarr Queue and Calendar.
• Three pinned bottom tabs: Downloads, Calendar and Services. Together with Dashboard and Settings, that is the five-icon bar you see on day one.
• One placeholder instance for every supported service, all disabled with blank URLs. That is why you normally tap an existing row in Integrations rather than creating anything new.

Want to look around first?

Turn on Settings, Backup & Storage, Advanced, Demo Mode ("Show sample data, no server required"). Every service switches to realistic sample content without touching your real configuration, and a banner reads DEMO MODE, Sample data only with an Exit link. Turn it off and everything comes back exactly as it was.

3. Add your first service #

Services live behind the Integrations row on the Settings tab, subtitled "Applies to all dashboards". The row itself summarises the state of everything you have connected, for example "7 connected, 1 needs attention".

Tapping it opens Integrations, which has up to three parts:

• Needs attention, one row per instance that is enabled but failing, with the reason ("Authentication failed", "Unreachable", "Enabled but no URL set"). Tapping a row opens that instance's editor directly. Instances that are only out of reach because you are away from your home network are listed separately as away, not as failures.
• Your services, one row per service kind you have set up.
• Add a service, which opens the searchable catalogue of everything Dashboarr supports, grouped into Download clients, Media automation, Indexers, Media servers, Requests and automation, and Monitoring. Search matches old names and abbreviations too, so "readarr" finds Bindery and "qbit" finds qBittorrent.

On a brand-new install Integrations opens on a "No services yet" card with a Browse services button and a short list of popular starting points.

Picking a service opens its editor. A kind that has more than one instance shows its instance list first.

The instance editor, top to bottom

URL rules

• Enter the bare origin, for example http://192.168.1.100:7878. Dashboarr appends the API path itself. Never paste /api/v3 into the URL box.
• A reverse-proxy sub-path is supported and preserved: https://media.example.com/radarr becomes https://media.example.com/radarr/api/v3/...
• Typing a URL without a scheme auto-prefixes http:// when the field loses focus.
• Only http:// and https:// are accepted. A trailing slash is harmless.
• Saving a Remote URL on plain http:// raises a confirmation titled "Remote URL uses HTTP" with a Save anyway button, because API keys would cross the internet in cleartext. A local http:// URL is accepted silently, which is the normal case on a LAN.

What saves instantly, and what does not

The editor is split by that rule, so you can read it off the screen. Everything under Connection, above the Save button, only persists when you press Save: Name, both URLs, credentials and Custom Headers. Everything under Preferences, below it, applies the moment you change it, and the section says so. The Enabled toggle sits above both and is also instant.

While changes are pending the editor title shows "unsaved" in amber. Leaving with unsaved changes offers Save or Discard, whether you use the back arrow, the Android back gesture or the iOS edge swipe.

Test Connection

Test Connection probes the values currently typed in the form, so you can validate before saving. It tests exactly one URL, whichever the app would use right now, and tells you which:

• Connected via local URL in 42ms
• Auth failed (remote URL): ...
• Could not reach local URL: ...

The probe times out after 8 seconds. It never tests both URLs in one tap.

Then attach it to a dashboard

The first time you save an instance that has both a URL and a credential, an Add to dashboards sheet appears so you can pick which workspaces include it.

Status dots

Once a kind has at least one enabled instance, its Integrations row shows a coloured dot: green for reachable, amber for reachable but credentials rejected, red for unreachable. While the first health check is running the dot pulses grey. Unlike the dashboard's Service Health widget, this list reports the worst instance of a kind, so a broken second server is never hidden behind a healthy first one. Health polls every 30 seconds, so the list can lag a config change by up to half a minute. Test Connection is the only immediate probe.

Multiple instances

Every service supports multiple instances: two Radarrs, an anime Sonarr, a second household. Use "Add another instance" at the bottom of the instance list. New instances auto-name themselves (Radarr, then Radarr 2). With two or more, each row gains reorder arrows and a delete button, and that order is the order shown in the per-screen instance switcher. Reach the list from the Instances row at the bottom of any instance editor.

To take a service back out of your setup entirely, open its last remaining instance and use "Remove <service>". That clears its URLs and credentials, drops it from Your services, and returns it to Add a service as an empty slot ready to set up again.

When a kind has two or more enabled instances attached to the current dashboard, its screen header shows the instance name with a chevron. Tapping it opens a Switch instance sheet.

4. Local and remote URLs #

This is the most important concept in Dashboarr, and the source of most confusion.

The default: auto-switch is off

Settings, Network, "Auto-switch network" is off on a fresh install. With it off, every service always uses its Local URL (or the Remote URL if no local one is set), on any network. Nothing else in this section applies until you turn it on. If you only use the app at home, or you address everything through Tailscale, you can leave it off and skip ahead.

With auto-switch on

The app uses a service's Local URL only when it has positively confirmed you are on one of your saved home WiFi networks. Anywhere else it uses the Remote URL only and deliberately never falls back to the local one. The reason is concrete: 192.168.1.50 on airport WiFi belongs to a stranger, and falling back would hand them your API key.

Consequences to be aware of:

• A service that only has a Local URL is simply unavailable while you are away. That is intended, not a bug.
• "Away" is the default at every cold start, until the WiFi name is read.
• If auto-switch is on, you have saved no home networks, and "Treat VPN as home" is off, the Settings row turns amber: "Add at least one, without it the app stays on remote URLs".

Adding a home network

Settings, Network, Home Networks. Use "Add current WiFi" to auto-detect and pre-fill, or "Add manually". The form has two fields:

• WiFi Name (SSID), required, matched exactly and case-sensitively.
• Access Point MAC (BSSID), optional. Leave empty to match any access point with that name. Setting it guards against a rogue AP cloning your SSID.

Up to 20 networks can be saved. If your router broadcasts separate 2.4 GHz and 5 GHz SSIDs, save both.

Location permission

Reading the WiFi network name requires Location permission on both iOS and Android. Without it the app can never confirm you are home, so it silently stays on remote URLs.

On iOS you also need Precise Location enabled for Dashboarr. With Approximate location the system still shows the location indicator, so permission looks granted, but iOS will not reveal the network name. The Home Networks screen surfaces this with an amber "Using remote URLs" card and a Grant Location permission button, plus a Retry detection path when Location is allowed but the name still will not appear. Toggling WiFi off and on usually clears it.

VPNs and Tailscale

Under a VPN the OS normally masks the WiFi name, so the app reads you as away and uses remote URLs. Turn on Settings, Network, "Treat VPN as home" (visible only while auto-switch is on) to use local URLs whenever a VPN is connected. The app can only detect that some VPN is up, not which one, so enable this only if your VPN actually reaches your home LAN.

Diagnostics

Settings, Network, Home Networks, "Network diagnostics" (collapsed, labelled "For bug reports") shows Platform, VPN native module, VPN detected, VPN flag, On WiFi, Auto-switch, Treat VPN as home, and Away from home as yes (remote-only) or no (local OK). Quote this panel in bug reports.

Per-dashboard home networks

Each dashboard can restrict which home networks count as home for it, under Edit dashboard, "Home networks", All / Custom. Selecting Custom with nothing ticked forces that workspace onto remote URLs everywhere, and that wins even when the global auto-switch toggle is off.

Custom headers and Wake-on-LAN

• Custom Headers exist at two levels: globally (Settings, Network, Custom Headers, sent on every request to every enabled service) and per instance. Per-instance headers override global ones on a name collision, and the service's own auth always wins. Up to 32 headers each. Useful for Cloudflare Access, Authelia and similar static-header schemes. They cannot fix cookie or session based SSO.
• Wake-on-LAN lives at Settings, Network, Wake-on-LAN. Fields are Device Name, MAC Address, Broadcast Address and Port; only name and MAC are required. Defaults are 255.255.255.255 and port 9, but a subnet-directed broadcast such as 192.168.1.255 is far more reliable, since many routers drop the global broadcast. MACs may be typed with colons, dashes, dots or nothing at all. The MAC is validated at send time, not when you save the device. A Wake button appears in the Services tab header once you have devices saved.

5. Service reference #

Dashboarr stores exactly three credential fields per instance (API key, username, password) plus optional custom headers. The editor shows one of two shapes: Username and Password for seven services, API Key for everything else. Plex adds a "Connect with Plex" button on top of the API Key field.

The ports below are the upstream defaults, for reference only. Dashboarr never prefills or appends a port, so type the full URL yourself.

Where to find each API key is documented by each upstream project, generally under that service's own General or Security settings.

Self-signed certificates

Turn on Allow invalid certificates in the instance editor. The bypass is keyed to hostname and covers both that instance's local and remote hostnames, which means any other service on the same hostname is relaxed too.

The backend has its own copy of the same toggle, under Settings, Notifications, Backend. Turn it on when the backend sits behind a reverse proxy using an internal CA, such as Caddy's default internal issuer or a homelab root certificate. Your phone's browser may trust that CA while the app does not, so /health opens fine in the browser and pairing still fails with "Network request failed", with nothing reaching the container. Mounting the CA into the backend container, for example with NODE_EXTRA_CA_CERTS, does not help: that only affects calls the backend makes outward, never the phone's call inward.

Behind a forward-auth SSO proxy

With Authentik or Authelia in front, the proxy hands API calls an HTML login page instead of JSON. Dashboarr detects this and says so rather than falsely reporting the service healthy. The fix is on the proxy side: exclude the API path from authentication. For Authentik, add ^/api and ^/ping to the Proxy Provider's Unauthenticated Paths. This is safe because the *arr API is already protected by its own API key. Custom Headers cannot solve this, because proxy auth here is cookie based, not header based.

6. Dashboards and widgets #

Dashboarr supports multiple named dashboards, internally called workspaces. Each holds its own widget cards, icon and accent colour, pinned tabs, attached service instances, and home-network selection.

Switching and creating

Tap the dashboard name in the Dashboard header to open the Dashboards sheet. From there you can switch, reorder with the chevrons, duplicate with the copy icon, delete with the trash icon, or tap Add dashboard.

Creating is submit-only: type the name (40 characters max) and confirm with the keyboard's Done key or the check button. Tapping elsewhere discards it. The new dashboard opens straight into its editor, and it starts genuinely empty: no widgets, no attached instances, and only the Services tab pinned.

Duplicating produces <name> copy and clones widgets, per-widget settings, attachments, pinned tabs, tab icons, home networks and tile order. The last remaining dashboard cannot be deleted. There is no cap on how many you create.

Two different "edit" surfaces

This trips people up, so be precise:

• The pencil icon toggles widget edit mode: reorder, remove, copy and configure the cards on the dashboard.
• The sliders icon (or the gear on a row in the Dashboards sheet) opens Edit dashboard: name, icon, colour, attached instances, pinned tabs, home networks.

Renaming a dashboard only exists in Edit dashboard, Name. Tapping a name in the Dashboards sheet just switches to it.

Widget edit mode

The pencil appears once at least one instance is enabled anywhere. In edit mode a banner reads "Reorder, remove, or add widgets", every card gains a dashed border, and a control row appears above each one with:

• up and down chevrons to reorder. There is no drag-and-drop for cards, and cards cannot be resized: they are always full width, stacked.
• a copy icon (only with more than one dashboard) that opens "Copy widget to..." and creates an independent copy with the same settings.
• a gear for widget settings.
• a red X to remove, with no confirmation.

Add widget at the bottom opens a sheet grouped into Available and Requires setup. "Requires setup" items are widgets whose service is attached to this dashboard but currently disabled in Integrations. Widgets for services that are not attached at all are hidden entirely, so if a widget you expect is missing, attach its service first.

The widget catalogue

Thirty-seven widgets are available:

Service Health, Server Stats, Speed Stats, Downloads, SABnzbd Queue, NZBGet Queue, Radarr Queue, Sonarr Queue, Lidarr Queue, Bindery Queue, Recently Downloaded, Calendar, Still Pending, Stream Activity, Streaming Bandwidth, Seerr Requests, Now Playing (All Servers), Plex Now Playing, Jellyfin Now Playing, Emby Now Playing, Prowlarr Stats, Jackett Indexers, Bazarr Wanted, Wake-on-LAN, Shortcuts, Disk Space, Health Alerts, unRAID Array, Tdarr, Autobrr Activity, Cleanuparr Stats, NZBHydra2 Indexers, Navidrome Library, Pi-hole, Top Blocked Domains, AdGuard Home, Top Blocked Domains (AdGuard).

Recently Downloaded collapses episodes of the same series into one tile, badged with how many arrived, so a batch of episodes cannot push everything else out of the row. Tapping that tile lists the individual episodes with their quality, size and import date, and any of them opens the series. Turn it off with Episodes, "Group by series" in the widget settings.

Shortcuts is a grid of your own web links for anything Dashboarr does not integrate with: Portainer, Proxmox, Home Assistant, a router admin page, a hosting dashboard. Each entry has a name, a URL, an icon and an accent colour, and tapping it opens the page in the system in-app browser (Safari View Controller on iOS, a Chrome Custom Tab on Android). On Android the Custom Tab shares Chrome's logins; on iOS the Safari view keeps its own cookies, so expect to sign in there once. Manage the list at Settings, Shortcuts or from the gear on the card; https:// is assumed when you type a bare host. The list is shared, and the widget's settings sheet picks All shortcuts or a subset for that dashboard.

The same widget can be placed more than once on one dashboard, each copy with its own settings, which is how you show two download clients or two Radarrs side by side. Two widgets have no options and therefore no gear: Wake-on-LAN and unRAID Array.

Most settings sheets include a Visibility, "Hide when empty" toggle. Cards hidden that way still appear in edit mode, marked with a crossed-out-eye icon, so a "vanished" widget is easy to find. Service Health and Health Alerts have the same toggle worded "Hide when all healthy", since neither is ever literally empty: Service Health hides while every service it shows is online, Health Alerts hides while Sonarr, Radarr, Prowlarr and Lidarr report no health issues, and both come back the moment something goes wrong. Widgets for services that support several instances also expose an instance chip row with an All instances chip.

Attached instances and auto-attach

Edit dashboard, Attached instances controls which service instances this workspace can see. Attachment is per instance, not per kind, so a "Home" Radarr and a "Cabin" Radarr can live on different dashboards.

The starting Default dashboard is in auto-attach mode: it implicitly includes every service and instance you ever add. While that is true, the Dashboard tab shows an "Auto-attach mode" banner with a Curate shortcut.

Instances that are disabled cannot be newly attached. Their rows are dimmed and read "Enable in Settings → Integrations to attach".

Appearance

Edit dashboard, Appearance gives each dashboard an icon (61 to choose from) and one of eight accent colours: Blue (default), Red, Amber, Green, Teal, Purple, Pink and Slate. The accent tints the dashboard chrome, the Save button and the active tab icon in the bottom bar, so switching dashboards visibly recolours the app. A live preview tile at the top of the editor shows the result.

7. Tabs and screens #

The bottom bar is Dashboard first, Settings last, and up to three tabs of your choosing in between. It shows icons only, no labels.

Configure them in Edit dashboard, "Pinned tabs": tap a chip to pin, use the chevrons to reorder, the red X to unpin, and tap a pinned tab's small icon chip to change which icon represents it in the bar.

The twenty-four pinnable tabs are:

Downloads, Calendar, Services, Movies, TV, Library, Music, Books, Requests, Activity, Indexers, Plex, Jellyfin, Emby, Navidrome, Glances, Bazarr, unRAID, Tdarr, Autobrr, Cleanuparr, Pi-hole, Maintainerr, AdGuard Home.

A tab becomes pickable when the workspace has at least one attached instance of a backing service. Movies needs Radarr, TV needs Sonarr, Music needs Lidarr, Navidrome needs Navidrome, Books needs Bindery, Requests needs Seerr, Indexers needs Prowlarr, Jackett or NZBHydra2, Downloads needs any download client, Calendar needs Sonarr or Radarr, Library needs Radarr or Sonarr, and Activity needs any of Tautulli, Tracearr, Jellystat, Jellyfin or Emby. Services is always pickable.

Notes worth knowing:

• Pins are per dashboard. Switching dashboards rebuilds the whole bar, including order, icons and accent colour. If the tab you are on is not pinned on the new dashboard, the app takes you back to Dashboard so you are never stranded.
• Un-attaching a service hides its pinned tab but keeps the pin stored, so re-attaching restores it. Merely disabling the instance does not hide the tab.
• Unpinned tabs are not unreachable. Tapping a tile in the Services tab, or a service in the Service Health widget, opens that screen directly.
• Movies + TV and Library overlap: Library is those same two libraries behind one switcher. Pinning all three spends your slots on duplicate content.

What is on each screen

Most service tabs are one screen with a chip row acting as sub-tabs, plus pull-to-refresh.

• Downloads: a segmented control across enabled clients, hidden when you only have one. Torrent view has down and up speed pills, a speed-limits control (qBittorrent, rTorrent, Transmission and Deluge), Add Torrent with a paste-magnet field, and a filter and sort sheet. Long-press a row for multi-select with Pause, Resume, Category (qBittorrent only) and Delete. Deleting always asks Delete versus Delete + Files. The Usenet view adds queue-wide pause and resume, and Add NZB by URL or file upload.
• Calendar: a month grid merging Sonarr air dates with Radarr release dates (Digital, Physical or In Cinemas). Green dots mark episode days, amber dots movie days. Chips are All / TV / Movies plus an Include unmonitored toggle that is remembered between launches.
• Activity: merges Tautulli, Tracearr, Jellystat, Jellyfin and Emby. Sub-tabs are Streams and History; History only appears when a source that supports it is configured, because Jellyfin and Emby report live sessions only. Streams refresh every 5 seconds, history every 60.
• Movies (Radarr): Library, Queue, Wanted, with a filter and sort sheet and long-press action sheets. Posters show their Radarr tags as small badges, and the sheet has a Tags section for narrowing the library to one or more of them; the selection is remembered per instance.
• TV (Sonarr): Library and Calendar, with filter and sort and a "Search Missing Episodes" confirmation. Posters show their Sonarr tags as badges, and the sheet filters by tag alongside the status filter.
• Music (Lidarr): Library, Queue, Wanted, with tag badges on artist posters and the same filter by tag.
• Books (Bindery): Library, Queue, Wanted, with a media-type filter for ebooks, audiobooks and dual-format titles. Authors show a book count rather than a completion bar, because Bindery does not report per-author progress; the author screen computes real counts from its own book list.
• Requests (Seerr): Discover, Search, Requests, with per-row approve and decline, and a Customize link to reorder your Discover sliders.
• Indexers (Prowlarr, Jackett and NZBHydra2, with a source switcher when more than one is attached): Indexers, Search, and depending on the source Stats and History. Prowlarr indexers toggle with a power button and grabbing a release confirms first; each Jackett indexer has a Search button that opens the Search tab pinned to that one tracker (tap the pill to unpin) and a Test button that browses it and reports back, and grabbing opens a sheet to send the release to one of your torrent clients or open its details page. NZBHydra2 lists each indexer's state, last error and API/grab counts against its limits, adds Stats over a 7/30/90-day window and a History tab covering both searches and downloads, and grabbing sends the NZB to SABnzbd or NZBGet.
• Plex: Now Playing, Recent, On Deck, Libraries. Jellyfin and Emby share a screen: Now Playing, Recent, Continue Watching, Libraries.
• Navidrome: Overview, Browse and Playlists. Overview holds the library counters, whatever is playing right now, and the maintenance actions — quick scan, full scan and delete missing, each behind a confirm. Browse defaults to recently added albums and searches artists, albums and tracks as you type. Any row opens that record in Navidrome’s own web UI.
• Glances (headed "Server"): CPU, Memory, GPU, Disks, Disk I/O, Network and Containers cards. Containers are read-only here.
• unRAID: Array, Pools, Unassigned and Containers, with Start, Restart and Stop actions per container. Disks also show live read/write rates once you pair a Glances instance under Disk activity in the unRAID instance editor.
• Tdarr: Server status, Library stats (Tdarr score, health-check score, space saved), Nodes with per-node pause/resume and per-worker Cancel/Kill, a Libraries list with per-library Find New and Fresh Scan actions, and a file search across every library.
• Autobrr: push stats, a searchable release feed with approved/rejected/error badges and per-action retry, filter enable toggles, and IRC network health with per-network restart.
• Cleanuparr: strike/removal/cleanup stats over a selectable 24h/7d/30d window, scheduled jobs with run-now buttons, health of its connected download clients and *arr instances, and a filterable event feed.
• Pi-hole: blocking on/off with timed presets (1 minute through “until tomorrow”, plus a custom duration) and a live countdown, a one-tap Gravity update, 24h query stats with a blocked/allowed graph, top blocked and permitted domains and top clients, a live query log with domain and client filters, and local CNAME records you can add and delete.
• Bazarr: Movies, Episodes, History, with a per-item search button for missing subtitles.
• Maintainerr: an Overview with the scheduled-media and active-collection counts, plus a banner when Maintainerr’s database is unreachable, and a Collections list showing each collection’s media count and what its rule does to those items (auto-delete, unmonitor, change quality profile, or nothing) with an icon matching the action.
• AdGuard Home: protection on/off with timed presets (1 minute through “until tomorrow”, plus a custom duration) and a live countdown, query stats for the current window with a blocked/allowed graph, top blocked and queried domains and top clients, filter list status with a one-tap update, a live query log with search and reason filters, and local DNS rewrites you can add and delete.
• Services: a two-column grid of your enabled, attached services with a status dot each. Long-press a tile to drag-reorder, and the order saves per dashboard. When a tile is not green the reason is printed under its name rather than leaving a silent red dot.

Queue issues (Radarr, Sonarr, Lidarr, Bindery)

Sometimes a grab gets stuck. Most often it finished downloading but the *arr refuses to import it: non-media files in the release, a sample-only folder, episodes missing from the pack, no matching movie or series. It can also be the download itself going wrong, such as a torrent stalled with no connections. When that happens the Movies, TV, Music and Books screens show a queue issues banner above the chip row. Amber means a warning, red means the download failed outright. It only appears when something is actually stuck, and it follows the instance you currently have selected.

Tapping it lists every stuck grab with the reason the service gave and the release name. Tap one for these actions:

• Force import (Radarr and Sonarr, blocked imports only): imports the downloaded files anyway, replacing the current file if there is one. This is the fix when the release was fine but the *arr refused it, most often because it is not an upgrade over what you already have.
• Manual import (Radarr and Sonarr, blocked imports only): opens the download's files so you can map them yourself. Pick the movie or the series, then the season and episodes for each file, adjust the quality if the *arr could not read one off the file name, and import. This is the fix when the release is named in a way the *arr cannot parse, so it matched nothing and Force import has nothing to send.
• Remove from queue: drops the grab and deletes it from the download client. The release stays eligible, so the same copy can be grabbed again.
• Blocklist & Search: also blocks the release so it is never grabbed again, then starts a search for a replacement. This is the one you want for a bad copy.
• Blocklist only: blocks the release with no replacement search.

Force import and the three disposal actions ask for confirmation first, and blocklisted releases show up under System → Blocklist in Radarr, Sonarr or Lidarr itself. The import itself runs on the server, so the stuck grab clears from the queue a moment after the app says the import started.

Global search

The magnifier in the Dashboard header opens Search. It needs two characters and covers Radarr, Sonarr, Lidarr, Seerr, Prowlarr, Jackett, NZBHydra2 and Navidrome, grouped into Movies, TV Shows, Music, Requests, Library and Releases. Each section loads independently, so a slow indexer search never blocks the rest. Plex, Jellyfin and Emby library search is not included, and the magnifier is hidden entirely when none of those services is attached.

Movies, shows and artists you already have appear first. They are matched against the library the app has already loaded, so they show up as you type instead of waiting on the Radarr, Sonarr or Lidarr metadata lookup. Those rows carry an In library badge and open the item's own screen instead of the add flow. The same ordering applies on the dedicated search screens behind the magnifier in the Movies, TV and Music tabs.

Magnet links

Dashboarr registers itself as a magnet handler. Tapping a magnet link in a browser opens the Downloads tab with the add card pre-filled. With more than one torrent destination you first get an Add Torrent To sheet. SABnzbd and NZBGet are not magnet destinations.

8. Notifications and the optional backend #

Without a backend

Dashboarr raises local notifications while the app is running. There is no background task, so a closed or force-quit app produces nothing. This is the number one notification question, and the honest answer is: the toggles work, but only while the app is open.

Settings, Notifications has a master Enable notifications switch and, when on, seven category toggles: Torrent completed, SABnzbd completed, NZBGet completed, Movie downloaded, Episode downloaded, Service offline, New Seerr request.

Every instance editor also has a Notifications card where each category is a three-way picker: Use default, Always notify, Never notify. Every service kind has at least "Service offline". Tracearr additionally exposes seven categories that exist only per instance, with no global toggles.

What the backend adds

The optional self-hosted backend moves the watching server-side, so events reach your lock screen with the app closed. It also adds webhook ingestion, a service-offline watchdog, and an optional Apprise fan-out to Discord, Telegram, ntfy or email.

Minimum docker-compose.yml:

services:
  dashboarr-backend:
    image: ghcr.io/renzobeux/dashboarr-backend:latest
    container_name: dashboarr-backend
    ports:
      - "4000:4000"
    volumes:
      - ./data:/data
    restart: unless-stopped

Then docker compose up -d and docker logs -f dashboarr-backend. All state lives in one SQLite file at /data/dashboarr.db. On Synology Container Manager, create the lowercase data folder inside your project folder in File Station first, or the build fails with a bind-mount error.

It also runs without Docker on Node.js 20+: clone the repo, cd backend/dashboarr-backend, then npm install, npm run build, npm start.

Environment variables, all optional

Web status page and config editor

With WEB_UI_PASSWORD set, opening the backend URL in a browser shows a status page: the instances synced from the app with their poller state and last error, the paired phones, and the last 50 webhooks received. It is meant for the moment a notification did not arrive and your phone is not in front of you. It never shows API keys, passwords, device secrets or raw webhook payloads. Pairing still happens from the log and the app, not from this page. It also lists each device's encrypted backup slot with its size and age, never its contents, and from there you can edit a configuration from your PC.

Pairing

The pairing QR and token are printed to the backend's startup log only. There is no web pairing page. Read them with docker logs -f dashboarr-backend.

In the app: Settings, Notifications, Backend. Enter the Backend URL, then either Scan pairing QR or Enter token manually.

• The token is a 32-character hex string, valid for about 10 minutes, and single-use. If it expires, restart the container to print a fresh one. There is no regeneration endpoint by design.
• With PUBLIC_URL set, the QR carries the URL and the token together. Without it, the QR carries only the token, so type the backend URL into the app first.
• On success the app pushes its full config snapshot to the backend. After that, any config change re-syncs automatically after a couple of seconds, so make settings changes while your phone can see the backend.
• If pairing fails with "Push permissions denied or projectId missing", the OS notification permission is off. Turn on notifications for Dashboarr in your phone's settings, reopen the app, and pair again with a fresh token.

Once paired, the Backend screen offers Send test push, Rotate secret and Unpair, and tells you the state of the local fallback. The app polls the backend's health every 60 seconds and needs two consecutive failures before handing back to local watchers, so allow a couple of minutes for that transition.

Exposure

The backend does not need to be exposed to the internet. It needs outbound access to reach Expo's push service, and to be reachable by your phone on your home network. Pushes are delivered through Expo and then Apple or Google, so they still arrive over cellular with nothing port-forwarded. LAN-only is the recommended setup.

If you do expose it, the backend does not terminate TLS itself. Put a reverse proxy or Cloudflare Tunnel in front and set PUBLIC_URL to the https URL, otherwise an http to https redirect silently turns the pairing POST into a GET and 404s.

Health checks

GET /health with no Authorization header answers 200 with {"ok":true,"name":"dashboarr-backend"}, so a browser, an uptime monitor or a Docker health check can confirm the container is alive without a token. The full body, which lists every poller and its last error, needs the paired bearer, because those errors contain your internal service URLs.

Webhooks

Webhooks make Radarr, Sonarr, Seerr and Tracearr events near-instant instead of waiting for a poll. Only six kinds have endpoints today: Radarr, Sonarr, Seerr, Bazarr, Tautulli and Tracearr, and of those Bazarr and Tautulli events are ingested and logged but do not raise a push yet.

Get your exact URLs and the shared secret from the file the backend writes at startup:

docker exec dashboarr-backend cat /data/webhook-urls.txt

That file is mode 0600 and the secret is deliberately never printed to stdout, because logs often get shipped elsewhere.

Two URL shapes are supported: the secret in an X-Dashboarr-Secret header (preferred, keeps it out of proxy logs), or the secret as a path segment for services that cannot send custom headers. Configure Radarr and Sonarr as a Custom webhook connection on the Download event, and Seerr on MEDIA_PENDING. Each of those sends a test event that produces a confirmation push, so you can verify the wiring without waiting for a real download. Tracearr is path-secret only, configured as its JSON Webhook agent, and must include ?instance=<uuid>.

The ?instance=<uuid> parameter is optional elsewhere. Adding it prefixes push titles with the instance name and namespaces dedupe keys, so two Radarrs grabbing the same release produce two pushes. Copy the UUID from the Webhook Attribution card in the instance editor, which appears once a backend is paired. A wrong or stale value never drops the event; the backend quietly falls back to kind-only attribution.

Apprise

Settings, Notifications, Backend, "Apprise notifications" also sends to Discord, Telegram, ntfy or email via an Apprise server. Add your service URLs in the Apprise server's own config under a key, then paste that server's full /notify/<key> URL into the Apprise notify URL field, with optional Tags to filter which saved URLs fire. There is a Send Apprise test button. Apprise is additive: Expo push keeps working, the same toggles apply, and Apprise fires even with no phone paired. It requires a paired backend.

9. Backup and restore #

Settings, Backup & Storage. Export settings writes a single file named dashboarr-config.json and hands it to the system share sheet, so you choose where it lands. Despite the extension, the contents are encrypted: a small envelope wrapping AES-256-GCM ciphertext, with the key derived from your passphrase.

• A passphrase is mandatory, minimum 8 characters, typed twice. The dialog says it plainly: there is no recovery, and forgetting the passphrase makes the backup useless.
• Export also requires your device biometric or passcode. Cancelling that OS prompt silently aborts the export.
• "Remember on this device" stores the passphrase in the Keychain or Keystore behind biometrics, and adds a Use saved passphrase button next time. It only helps on the same device; migrating to a new phone always needs the typed passphrase.

What is in the file: every configured instance (names, local and remote URLs, per-instance flags) and its secrets (API key, username, password, custom headers), all dashboards with their widgets and per-widget settings, the active dashboard, home networks, the auto-switch and treat-VPN-as-home settings, Services tile order, Wake-on-LAN devices, web shortcuts, haptics, global custom headers, UI scale, theme, notification settings, and your backend pairing.

What is not in it: cached posters, live network state, onboarding flags (so a restored install replays the intro), and anything about your media servers' content.

Import settings confirms first, then opens a file picker, then asks for the passphrase. It is a full replace, not a merge, so export your current setup first if you might want it back. The passphrase is only requested for encrypted files: an unencrypted JSON imports straight through, which is what makes writing a config on your PC possible. Backups are forward-migrated automatically; a backup made by a newer app version is refused with a message telling you to update the app first.

Two deliberate behaviours after an import:

• Any pinned access-point BSSIDs on your home networks are stripped, because a pin recorded on the old phone will not match on the new one. Matching falls back to SSID only; re-pin manually if you want it.
• If auto-switch is on, services fall back to remote URLs until the home WiFi is re-confirmed, and the app re-asks for Location.

Backend push must be re-paired on the new phone, since the push token belongs to the physical device. Restart the backend for a fresh pairing token. If the old phone kept a backend backup (below), the new phone is offered it right after pairing, so the file export is not needed for that move.

The same screen also holds Clear image cache, for when cached posters and backdrops add up, and the Demo Mode toggle under Advanced.

Backend backup and sharing #

With a paired backend (1.6 or newer), Settings, Notifications, Backend has a Keep an encrypted backup on the backend switch. Turning it on asks for your device biometric or passcode, then for a backup passphrase (the same rules as the file export). From then on every configuration change is encrypted on the phone and uploaded a few seconds later; Back up now forces one.

• The upload is the same encrypted envelope as the export file, minus this phone's backend pairing. The backend stores it as-is and cannot read it; the passphrase never leaves the phone. What the phone keeps is a key derived from the passphrase, so uploads do not ask for anything.
• Each paired device has its own backup slot. The slot survives Unpair, Rotate secret and a reinstall: it shows as unpaired on the backend's web page until that phone pairs again or someone deletes it.
• Restoring. When a phone pairs with the backend, the app lists the available backups and offers to restore one. Restore… on the Backend screen does the same later. A restore replaces every setting on the phone, like a file import, but keeps that phone's own pairing. It asks for the backup's passphrase, and then offers to keep the new phone backed up with the same passphrase.
• Sharing. That is also how a second phone or a family member gets your whole setup: they pair with the same backend, pick your backup ("iPhone · app 1.19 · 2h ago"), and type the passphrase you gave them. Nothing else changes hands.
• Manage backend backups… lists every slot and lets you delete one, including stale unpaired ones.
• Anyone paired with the backend can download any slot, so the passphrase is what protects it. Pick one you would not use for a file you post publicly. Demo Mode never uploads.

Editing from your PC #

The backend's web page (backend 1.7 or newer) has an Edit button on every backup. It downloads the encrypted backup, asks for its passphrase and decrypts it in your browser; the passphrase is never sent to the backend. You can add, edit and remove service instances (name, URLs, credentials, certificate bypass, Seerr sign-in mode) and change the notification toggles and Apprise settings. Dashboards, widgets, home networks, Wake-on-LAN devices and appearance stay as they were and are still edited on the phone.

• Save to backend re-encrypts with the same passphrase and writes a separate web slot. It never touches a phone's own backup. If someone saved from another tab in the meantime, you are asked before overwriting.
• On the phone, the Backend screen then shows Configuration edited on the web with an Apply button, and the Settings rows leading there turn amber. Apply is a normal restore: it replaces every setting, asks for the passphrase, keeps the phone's pairing, and the prompt clears. Nothing is applied without you tapping it; whatever you apply or upload last is the configuration.
• Starting from zero. New configuration asks for a passphrase and opens a blank configuration with the app's defaults. Save it, pair the phone, and the restore prompt after pairing offers it, so a first-time setup can be done entirely on a keyboard.
• Over plain http:// the page itself is only as trustworthy as the network that delivered it, so the editor shows a notice on LAN addresses. Use HTTPS for anything beyond your own network.

Writing a config file on your PC #

Export always encrypts, but import does not require an encrypted file. The importer only decrypts when the file carries the dashboarr-encrypted-v1 header; anything else is read as plain JSON and restored directly. So if typing a dozen URLs and API keys on a phone keyboard is the thing stopping you, write the whole setup in a text editor instead, put the file on the device, and use Import settings. This is a supported path, not a legacy fallback.

A complete, working file with two services:

{
  "version": 51,
  "exportedAt": "2026-09-01T00:00:00.000Z",
  "services": {
    "qbittorrent": [{
      "id": "qbt-1",
      "enabled": true,
      "name": "qBittorrent",
      "localUrl": "http://192.168.1.10:8080",
      "remoteUrl": "https://qbt.example.com",
      "useRemote": false
    }],
    "radarr": [{
      "id": "radarr-1",
      "enabled": true,
      "name": "Radarr",
      "localUrl": "http://192.168.1.10:7878",
      "remoteUrl": "",
      "useRemote": false
    }]
  },
  "secrets": {
    "qbt-1": { "username": "admin", "password": "your-password" },
    "radarr-1": { "apiKey": "0123456789abcdef0123456789abcdef" }
  },
  "autoSwitchNetwork": false,
  "homeNetworks": [],
  "dashboards": [{ "id": "dash-1", "name": "Home", "widgets": [] }],
  "activeDashboardId": "dash-1"
}

Top-level fields

Everything else is optional and falls back to defaults when omitted: backend, notificationSettings, wolDevices, shortcuts, hapticsEnabled, treatVpnAsHome, globalCustomHeaders, uiScale, appTheme and servicesOrder. The simplest way to see their exact shape is to configure one in the app and read it back from an export.

Instances and secrets

Every instance needs all six of id, enabled, name, localUrl, remoteUrl and useRemote. Optionally add ignoreCertErrors: true for a self-signed certificate. A secrets entry may carry any of apiKey, username, password and customHeaders (an object of header name to value).

Four things reject a file or silently drop data, in rough order of how often they bite:

• URLs need a scheme and must be present. "http://…" or "https://…", or "" for unset. "192.168.1.10:8080" is rejected, and omitting the key entirely is rejected too, so write "remoteUrl": "" rather than leaving it out.
• id must be unique across every service, not just within one kind. It is any string you choose; it only has to match between services and secrets. A duplicate rejects the file.
• A secrets key matching no instance id is dropped without an error, and you get a service that loads but cannot authenticate. If a service is unauthorised after import, check that spelling first.
• Service keys must match exactly: qbittorrent, rtorrent, transmission, deluge, sabnzbd, nzbget, radarr, sonarr, lidarr, bindery, overseerr (Seerr), tautulli, tracearr, jellystat, prowlarr, jackett, nzbhydra2, plex, jellyfin, emby, navidrome, glances, bazarr, unraid, tdarr, autobrr, cleanuparr, pihole, maintainerr. A misspelled key is ignored silently, so the service simply will not appear.

10. Appearance and updates #

Settings, Appearance has three controls:

• UI Scale: Normal, Large (+15% fonts, spacing and icons) or Extra Large (+30%). It applies live across the whole app. Poster grids intentionally drop from three columns to two at Large and above.
• Theme: Default (neutral zinc), Ember (warm red-brown), Midnight (deep navy), Forest (dark green) and Violet (dark purple). All five are dark; Dashboarr is dark-mode only and has no light theme. A theme re-tints backgrounds, surfaces and borders but deliberately leaves accent colours alone, so the difference is subtle by design.
• Haptic feedback: vibrations on taps, toggles and refreshes.

Settings, About holds View on GitHub, Report an issue (pre-filled with your version, runtime and platform), Support development, Show workspace tour, and the app version card with a Check for updates button.

The app checks for a newer version automatically at most once every 24 hours, a few seconds after launch. Sideloaded Android builds check the GitHub releases page; store installs check their store. The prompt offers Update now and Skip this version; dismissing it counts as "later" and silences it for seven days, while "Skip this version" is permanent for that version number.

11. Troubleshooting #

Everything is red, or shows "Remote", and I am at home.

Auto-switch is on and the app has not confirmed you are on a saved home WiFi. Check Settings, Network, Home Networks, Network diagnostics: if "Away from home" reads yes (remote-only), the app cannot read your network name. Grant Location permission, enable Precise Location on iOS, and make sure the network you are on is saved (SSID-only if you have a mesh). A service with only a Local URL is unreachable while away, by design.

Everything broke when I turned on my VPN.

Enable Settings, Network, "Treat VPN as home", or switch to addressing services by their VPN hostname with "Always use Remote URL".

Test Connection passes but the screen is empty or 404s.

Test Connection authenticates against each service's API root, so a wrong port normally fails it outright rather than passing. When the test passes but a screen stays empty, confirm the URL is the bare origin with no /api/... suffix, and that the instance points at the service you think it does.

A service is green in Integrations but missing from the Services tab.

The Services tab only shows services attached to the dashboard you are on. Attach it via Dashboard, sliders icon, Attached instances.

A widget I expect is not in the Add widget sheet.

Its service is not attached to this dashboard. Attach it first. If it appears greyed out under "Requires setup", the service is attached but disabled in Integrations.

A widget disappeared from the dashboard.

Either its service was disabled or un-attached (it is hidden, not deleted, and returns when you restore it), or it has "Hide when empty" on, or, for Service Health and Health Alerts, "Hide when all healthy". Enter widget edit mode to see hidden cards, marked with a crossed-out-eye icon.

qBittorrent says wrong username or password.

qBittorrent 5.2.0 changed its login API. Update to app v1.6.3 or newer, and backend v1.2.5 or newer. Also check the URL is the bare origin with no /api/v2 suffix.

rTorrent says wrong username or password, but the credentials work elsewhere.

Dashboarr authenticates to the rTorrent /RPC2 mount with HTTP Basic or Digest, whichever the web server in front of rTorrent asks for, so a Digest realm (lighttpd auth.backend.htdigest, Apache AuthType Digest) works without changing the server. Two things still fail with that message. If the server front-ends the mount with SSO such as Authelia or Authentik, the toast names the scheme it asked for: Dashboarr has no session with the proxy and cannot get one. If the credentials differ between the web UI and XML-RPC, use the XML-RPC pair; the popular crazy-max/rtorrent-rutorrent image keeps them apart, with the UI on port 8080 and XML-RPC on port 8000 with its own rpc.htpasswd.

A rare Digest variant Dashboarr cannot compute, qop=auth-int or an algorithm other than MD5, SHA-256 or one of their -sess forms, is reported by name; switch that realm to plain qop=auth. If the message mentions forbidden RPC access instead, the server answered 403: check that it allows this client to reach the /RPC2 location, which many ruTorrent guides restrict to localhost.

Digest never puts your password on the wire, but Dashboarr only learns the server wants Digest from the first rejected request, and that request carries Basic. Over plain HTTP that one exchange per app launch exposes reusable credentials to network observers, as does every request to a Basic-only server. Put these services behind HTTPS, or keep them on a network you trust.

Radarr or Sonarr behind Authentik or Authelia will not connect.

The proxy is returning its HTML login page instead of JSON. Exclude the API path from the proxy: for Authentik, add ^/api and ^/ping to Unauthenticated Paths. Custom Headers cannot fix cookie-based SSO.

Seerr requests fail with HTTP 403 "invalid csrf token".

Turn off CSRF protection in Seerr, which otherwise limits the API to read-only. The same setting blocks signing in with a Plex, Jellyfin, Emby or Seerr account from the app.

Glances shows no disks.

A Dockerized Glances cannot see the host filesystem. Bind-mount the host root read-only (- /:/rootfs:ro). CPU and RAM keep working because they come from /proc, which is why it looks like an app bug.

Backend paired but no notifications arrive.

Check, in order: the master switch under Settings, Notifications is on; the backend only notifies about events that complete after it starts, so anything already finished is treated as seen; for Radarr, Sonarr and Seerr the webhook test event should produce a confirmation push; and Bazarr and Tautulli webhooks are logged but do not push yet.

Backend pairing says "Network request failed" but the URL opens in my browser.

Almost always an internal CA. If the backend is behind Caddy, Traefik or Nginx serving a private root certificate, your phone's browser may trust it while the app does not, and the pairing request fails before it ever reaches the container, which is why nothing appears in the container log. Three fixes, best first: give that hostname a publicly trusted certificate; or point the app at the backend over plain http:// on your LAN; or turn on Allow invalid certificates under Settings, Notifications, Backend. Check the token as well: it is single-use and expires in about ten minutes, so restart the container for a fresh one.

Wake-on-LAN does nothing.

Set a subnet-directed broadcast such as 192.168.1.255 rather than the default 255.255.255.255, which many routers drop, and confirm you are on the same LAN as the target. The MAC is only validated when you press Wake, so an invalid MAC surfaces as a send-time error.

The Health Alerts widget is empty.

That is correct. With nothing wrong it shows "All services healthy". To drop the card off the dashboard entirely while everything is clean, turn on Visibility, "Hide when all healthy" in its widget settings.

Filing a bug.

Use Settings, About, "Report an issue", which pre-fills your version and platform, and include the Network diagnostics rows if the problem is connectivity related.