# Security

## Admin mode

Due to [this exploit](https://www.exploit-db.com/exploits/52079) Tunarr supports "admin mode". By default, admin mode is disabled. Some settings, like FFmpeg executable paths, can only be edited in the Tunarr UI when Tunarr is running in admin mode. **NOTE**: This shouldn't be confused with Windows "run as administrator"!

There are several ways to update sensitive settings that require admin mode.

### Running in admin mode

### Standalone binary

Pass the `--admin` flag when running the executable, e.g.:

```bash
 ./tunarr --admin
```

or on Windows:

```powershell
.\tunarr.exe --admin
```

You can also use an environment variable:

```bash
TUNARR_SERVER_ADMIN_MODE=true ./tunarr
```

and again on Windows (Powershell):

```powershell
$Env:TUNARR_SERVER_ADMIN_MODE='true'
.\tunarr.exe
```

or Command Prompt:

```
set TUNARR_SERVER_ADMIN_MODE=true
.\tunarr.exe
```

### Docker

Start Tunarr server with the `admin` argument

```bash
docker run ... chrisbenincasa/tunarr:latest -- /tunarr/tunarr --admin
```

!!! note

    <a href="https://github.com/chrisbenincasa/tunarr/issues/900" target="_blank">chrisbenincasa/tunarr#900</a> tracks simplifying running commands against Tunarr within a container.

or with the environment variable

```bash
docker run -e 'TUNARR_SERVER_ADMIN_MODE=true' ... chrisbenincasa/tunarr
```

### Updating sensitive values directly

Tunarr supports other run modes other than server. One is updating settings.json values directly. This can be done against a running Tunarr server without admin mode enabled.

```bash
./tunarr.sh settings update --settings.ffmpeg.ffmpegExecutablePath="FFMEPG_PATH" --settings.ffmpeg.ffprobeExecutablePath="FFPROBE_PATH"
```

This also works with Docker

```bash
docker run --rm \
  ...
  chrisbenincasa/tunarr -- /tunarr/tunarr \
  settings update \
  settings.ffmpeg.ffmpegExecutablePath="FFMEPG_PATH" \
  settings.ffmpeg.ffprobeExecutablePath="FFPROBE_PATH"
```

## Trust proxy

When running Tunarr behind a reverse proxy server for HTTPS support, you will need to enable "trust proxy" for the generated XMLTV and M3U files to contain the correct protocol (e.g., `http` or `https`) and host. Without "trust proxy" enabled, Tunarr will not honor the `X-Forwarded-Proto` and `X-Forwarded-Host` headers forwarded from the reverse proxy.

There are several ways to enable "trust proxy".

### Standalone script

Pass the `--trustProxy` flag when running the script, e.g.:

```bash
 ./tunarr --trustProxy
```

or on Windows:

```powershell
.\tunarr.exe --trustProxy
```

You can also use an environment variable:

```bash
TUNARR_SERVER_TRUST_PROXY=true ./tunarr
```

and again on Windows (Powershell):

```powershell
$Env:TUNARR_SERVER_TRUST_PROXY='true'
.\tunarr.exe
```

or Command Prompt:

```
set TUNARR_SERVER_TRUST_PROXY=true
.\tunarr.exe
```

### Docker

Start Tunarr server with the `trustProxy` argument

```bash
docker run ... chrisbenincasa/tunarr:latest -- /tunarr/tunarr --trustProxy
```

or with the environment variable

```bash
docker run -e 'TUNARR_SERVER_TRUST_PROXY=true' ... chrisbenincasa/tunarr
```
