FAQ¶

Answers to the questions we get most on Discord. For error codes, see Error codes.

Connecting and networking¶

What do the four connection test stages mean?

The test checks Address → Reachable → Authenticated → Version, in that order, and stops at the first failure. The QM- code it shows tells you exactly which layer to fix. See Error codes.

It fails at Authenticated. Is my address wrong?

No. The host answered fine.

401: the key is wrong or mistyped. Copy it again.
403: a proxy or Cloudflare Access is stripping the key, or the key doesn't have permission.

It fails at Reachable. Why can't it reach the service?

There was no HTTP answer at all. Check that:

http vs https matches what the service uses
you're on a network that can see it (Wi-Fi or Tailscale)
the port is right

Your first LAN connection also needs Settings → Quartermaster → Local Network turned on in iOS.

Where do I add another network or IP range after setup?

Tap the profile icon (top right), then the key icon. You can add, edit or remove ranges at any time without a reset. A range only decides "is this my network". It doesn't affect whether a service is reachable.

How does it choose between the home and away address?

It always prefers the local address and only falls back to the remote one when local fails. A badge shows which it's using: On your network, Remote, Via Tailscale or Unreachable. See Home and away.

What does setting a Home Wi-Fi (SSID) do?

When you're on that exact Wi-Fi network, the app uses the local address straight away without testing first. Reading the Wi-Fi name needs Location permission. If you skip it, the app just tests the address instead.

How do I reach my stack from anywhere with Tailscale?

Install Tailscale on your phone and your server, then use the server's 100.x IP or MagicDNS name as the remote address.

Note

SABnzbd needs that hostname added to its whitelist, or it returns 403. See SABnzbd won't connect.

What's the difference between Cloudflare Tunnel and Cloudflare Access?

Tunnel is just another address and works normally.
Access is a login gate that blocks the API (QM-EDGE-01). To fix it, create an Access service token, then add CF-Access-Client-Id and CF-Access-Client-Secret as custom headers under Advanced.

My service has a self-signed certificate. How do I trust it?

Quartermaster shows a trust prompt with the certificate's fingerprint. Check it matches your server, then tap Trust. You can also connect over http:// instead.

This is normal for Proxmox, Portainer, UniFi and TrueNAS. TrueNAS can't be pinned at all, so use http:// there.

Why does it warn that the certificate changed?

The pinned certificate no longer matches (QM-TLS-03). Usually that's a renewed certificate or a rebuilt container, but it could mean someone is intercepting the connection. Only trust it again if you were expecting the change.

It connects but fails with 404 or a Version error. Is the service down?

Not necessarily.

404 is often a missing subpath in your URL. Add it, for example /radarr.
A Version error means a proxy or SSO login page is answering instead of the service. Point the address directly at the service.

What does \"Cloudflare is rate-limiting, backed off\" (QM-EDGE-02) mean?

The app is deliberately backing off so Cloudflare doesn't block your address. Relax bot protection for that hostname, or connect over Tailscale or your LAN instead.

Connects at home but not away (or the other way round)?

The missing address, local or external, needs to be added or corrected in that service's connection settings. For remote access without opening ports, use Tailscale or a Cloudflare Tunnel.

Do I have to expose my servers to the internet?

No. At home the app talks over your LAN, and nothing needs to face the internet. For access from anywhere without opening ports, add a Tailscale or Cloudflare Tunnel address.

A service won't connect¶

Radarr, Sonarr, Prowlarr, Lidarr or Bazarr rejects the connection

These use an API key (Settings → General → Security), not a username and password.

401: wrong key
404: missing URL Base or subpath
403: something in front of the service is stripping the key

Plex won't sign in, or sharing says I'm not the owner

Tap Sign in with Plex. It uses Plex's official PIN sign-in, so you don't need a manual token. For sharing or invite errors, sign in with the account that actually owns the server.

Jellyfin or Emby rejects my key (or I don't have one)

They need a server API key, not your login. An admin creates one under Advanced → API Keys. If a proxy strips the header, add Authorization: MediaBrowser Token="<key>" as a custom header under Advanced.

SABnzbd won't connect

Use the full API Key (Config → General), not the NZB Key.

"Blocked this hostname" comes from SABnzbd's DNS-rebinding protection. Add your hostname to host_whitelist in Config → Special.

qBittorrent won't connect

There's no API key. Sign in with your Web UI username and password, and turn on the Web UI first under Tools → Options.

Deluge shows Authenticated with a cross, but its log says login succeeded

Your password is fine. Leave the username blank and enter only the password. The session cookie isn't carrying over, which is a known issue we're fixing. In the meantime, connect directly to host:8112 rather than through a proxy.

NZBGet won't connect

NZBGet uses HTTP Basic auth with the ControlUsername and ControlPassword from NZBGet's settings. The defaults are nzbget / tegbzn6789, so change them. Check that any proxy passes Basic credentials through.

Tautulli won't connect

The API key is under Settings → Web Interface → API. A blank version number just means no Plex server is linked yet. It isn't a connection fault.

UniFi won't connect

You need UniFi OS with Network 9.3 or later. Create the key under Control Plane → Integrations with Network scope. A Site Manager cloud key won't work. Expect a self-signed certificate trust prompt.

Streamystats won't connect or shows no data

Streamystats uses your Jellyfin login, not its own key, so a Streamystats problem is often a Jellyfin login problem. Deep Stats also needs the Jellyfin account to be an admin.

Glances connected, but the Docker card shows no containers

Glances needs the Docker socket mounted. Add this to the container and restart it:

-v /var/run/docker.sock:/var/run/docker.sock:ro

If Portainer or Dockhand is connected, it's used as the container source instead.

How do I connect Unraid?

You need Unraid 7.3 or later.

In Unraid, go to Settings → Management Access → API Keys.
Create a key with the CONNECT and ADMIN roles.
In Quartermaster, add Unraid with your server's address and paste the key.

Unraid refuses to start or stop a container or VM

Quartermaster shows the reason, including which permission is missing. Check the API key has the CONNECT and ADMIN roles under Settings → Management Access → API Keys.

My key is definitely correct, but I get a 403 or a login page

It's not your key. A proxy or edge service (Cloudflare Access, Authelia, nginx) is intercepting the request. Add a bypass rule for the API, or send the proxy's own credentials as custom headers under Advanced.

AdGuard Home on a router (GL.iNet) has no username or password

Leave both fields empty and tap Test. Router-hosted AdGuard Home is open by default. Only fill in credentials if you set up your own login.

Which Gluetun API routes does Quartermaster need?

GET /v1/vpn/status
GET /v1/publicip/ip
GET /v1/openvpn/portforwarded
GET /v1/version

Add PUT /v1/vpn/status if you want the restart button to work.

Can I get a terminal for my Proxmox VMs and containers?

Not in the app yet. Use Open console in browser from each VM's or container's row menu. You need to already be signed in to Proxmox in that browser.

Notifications and alerts¶

How do notifications work? What are my options?

There are two paths:

Instant alerts, your way (free). Quartermaster sets up a connection in Sonarr, Radarr or Seerr that sends straight to your own ntfy, Pushover, Discord or Telegram.
Push notifications (Pro). Alerts go through Quartermaster's relay and arrive even when the app is closed.

See Alerts.

How do I set up instant alerts through my own push service?

Go to Local alerts → Instant alerts, your way. ntfy is set up in one tap, and you can self-host it for full privacy. Pushover, Discord and Telegram need a short manual step in each service's own Connect settings.

What is the relay, and is it private?

It's a small Cloudflare Worker that turns service events into Apple push notifications. It only stores your device's push token, never your API keys, URLs or library data. It's off by default, needs Pro and is fully opt-in.

Which services and events can alert me right now?

Relay: Sonarr and Radarr imports, failures and health warnings. Seerr new, approved and available requests.
Your own push: the same services, set up in one tap with sensible defaults.

A notification never arrived. What should I check?

In order:

Is it set up at all?
Is that service's switch on?
Has iOS notification permission been granted?
Open the app once to refresh an out-of-date push token.
Remember that iOS doesn't guarantee background checks.

I switched a service on but got \"Couldn't set up\"

The service wasn't reachable at that moment. Check it connects on its own screen first, then try again. For requests, make sure no other app is already using Seerr's single webhook slot.

Test push says \"Reconnecting\", or the device token refreshed

Apple issued a new push token (after an update or restore) and the relay still has the old one. Just open Quartermaster once and it registers again automatically.

How do I get a live Now Playing card or alert when someone starts watching?

Turn on Push notifications (relay).

Plex: works through Tautulli, which is set up automatically.
Jellyfin: needs its free Webhook plugin, which Quartermaster can install for you.
Emby: needs a one-time manual webhook.

Jellyfin Now Playing wants a plugin and a restart. Is that safe?

Yes. Quartermaster only adds the official Webhook plugin and nothing else changes. It asks first, because installing it briefly interrupts anyone who's watching.

How do I add the Emby Now Playing webhook by hand?

Tap the Emby row under Now Playing to get the exact URL. Then in Emby:

Go to Dashboard → Notifications and add a Webhook.
Set the content type to application/json.
Tick Playback events.
Paste the URL.

Can Quartermaster get Now Playing alerts from Tracearr?

No. Tracearr's API is read-only. You don't need it anyway: connect Tautulli (for Plex), or Jellyfin or Emby directly.

What is the daily release digest?

A Pro morning summary of what's releasing today, from Radarr and Sonarr. It's scheduled as a real iOS notification, so it arrives reliably even when the app is closed.

What are \"Imports & failures\" foreground alerts?

A local notification when a download finishes or fails while the app is open on screen. You don't need to set anything up in your services, and nothing leaves your device.

Do I need Pro for notifications?

Relay push and the daily digest need Pro. Your own push (ntfy, Pushover, Discord, Telegram) and the foreground "Imports & failures" alerts are free.

Downloads, Discover and Home¶

How do I move a download up or down the queue?

Open the row's ⋯ menu and choose Move to top, up, down or to bottom. This works for SABnzbd, NZBGet, qBittorrent, Transmission and Deluge. It only appears on items that have a queue position.

qBittorrent downloads show no Move options

Turn on Torrent Queueing in qBittorrent's options (Downloads or BitTorrent, depending on version), then reconnect. Without it, qBittorrent doesn't report a queue position.

How does queue order work for SABnzbd and NZBGet?

The list order is the queue: the top item downloads next. The Move options shift its position. There's no separate priority number to set.

What's the difference between the two Discover decks?

My Library: swipe through what you already own, ranked by your taste.
New to You: recommends titles you don't have yet, built from your taste profile using Seerr or TMDB.

I picked two genres and got fewer titles. Is that a bug?

No, that's intended. Genres combine with AND, so each extra genre narrows the deck. Deselect a genre to broaden it again.

What does the Both / Movies / Series toggle do?

It filters the deck. Both mixes films and series, Movies uses Radarr only and Series uses Sonarr only. It applies to both Discover decks.

Now Playing is empty even though something's streaming

For Plex, Jellyfin and Emby, sessions only show for the server owner's account or token. A shared or managed-user connection returns nothing, so switch to the owner's account.

Tapping a Plex poster opens Plex's home screen, not the title

Plex's own "Who's watching?" picker swallows the link. In Quartermaster, go to Settings → Playback and set Open in Plex to the Plex website, which opens the title directly.

Why does Home say \"Now Playing · Plex\" instead of just \"Now Playing\"?

When more than one source is streaming at once, each card is labelled with its source. With one active source there's no label.

UniFi shows 0.00 Mbps for a client

One client at 0 usually just means it's idle right now. If every client shows 0, your console's firmware doesn't provide the older per-client speed data.

What is the Most Active card in UniFi?

It ranks your highest-bandwidth devices as usage bars. It shows live speed when they're active and falls back to session totals when idle. Tap a row for that device's details.

Pro, privacy and the basics¶

What do I get free, and what needs Pro?

Free: one service, one profile and the full Demo mode.

Pro: unlimited services and profiles, the Discover deck, Coming Soon on Home and the combined calendar, the Stuck Download Doctor, full stats, encrypted backups and custom icons.

See Free and Pro.

How much is Pro, and what's the difference between the plans?

You can buy a one-time lifetime unlock or an auto-renewing subscription. Every plan unlocks exactly the same features, and there are no separate tiers. Pick lifetime if you're staying long term, or monthly to try it out. See Pricing.

Does Quartermaster collect any data about me or my servers?

No. It's purely a client, with no analytics, no telemetry and no server behind it. It only talks to the services you set up, and nothing about your stack is sent to us or anyone else. The optional relay only stores a push token.

Where are my API keys and passwords stored?

In the iOS Keychain, never in unencrypted app storage. Keys are also removed from all diagnostic logs.

Can I try the app before connecting my servers?

Yes. Demo mode fills the app with realistic sample data. It runs entirely on your device, makes no network calls and touches no secrets. Turn it on in Settings or when you first open the app.

I didn't buy Pro. What happens to the extra services I added?

They're kept, not deleted. One service and one profile stay usable. The rest show as locked, with their settings and keys saved untouched until you unlock Pro.

What are profiles, and when would I use more than one?

A profile is a self-contained stack: its services, addresses, Wi-Fi name and proxy domains. Use separate profiles for separate setups, such as your home and a family member's. Free includes one profile, and Pro is unlimited.

What are the worlds?

Entertainment is media: films, shows, downloads and requests. Command Centre is infrastructure: containers, DNS, UniFi and NAS. QM Reader is books and audiobooks. The switcher at the top of Home moves between them. See Worlds.

I have a new phone or reinstalled. How do I get Pro back?

Go to Settings → Restore purchase. If it says "Nothing to restore", check you're signed in with the same Apple ID that bought Pro.

How do I completely reset the app?

Go to Settings → Reset → Delete everything. This wipes all services, keys and settings and can't be undone, so export a backup first. Your Pro purchase stays on your Apple ID.

How do I cancel the subscription or get a refund?

Apple manages both. To cancel, go to App Store → your Apple ID → Subscriptions → Quartermaster Pro → Cancel. For refunds, use reportaproblem.apple.com.

Does it work on Mac? Is there an Apple TV app?

It runs on Apple silicon Macs as the same app, with a sidebar layout. The Apple TV app is in beta. See Platforms.