Release v3.2.1 — rTorrent HTTPS, self-hosted assets & script debugging

- Add HTTPS/SSL support for rTorrent XML-RPC connections
- Bundle country flag SVGs locally (remove external CDN dependency)
- Bundle Chart.js locally and remove cdn.jsdelivr.net from CSP
- Add CRLF detection warning for event scripts
- Improve event script error logging (always log stderr)
- Fix mobile auto-scroll in settings when content stretches page

Author: got3nks

.env.example

@@ -55,6 +55,7 @@ PORT=4000
 # RTORRENT_PATH=/RPC2
 # RTORRENT_USERNAME=
 # RTORRENT_PASSWORD=
+# RTORRENT_USE_SSL=false
 
 # qBittorrent Configuration (Optional)
 # Connect to qBittorrent for BitTorrent downloads via WebUI API

.gitignore

@@ -31,6 +31,7 @@ pids/
 # Build outputs
 static/output.css
 static/dist/
+!static/dist/chart.umd.min.js
 dist/
 build/
 

CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.2.1] - rTorrent HTTPS, Self-Hosted Flags & Script Debugging
+
+### ✨ Added
+
+- **rTorrent HTTPS Support** - Connect to rTorrent XML-RPC endpoints over HTTPS/SSL, matching qBittorrent, Deluge, and Transmission. Configurable via Settings UI, `RTORRENT_USE_SSL` env var, or config.json
+- **Self-Hosted Country Flags** - Country flag SVGs are now bundled locally instead of loading from an external CDN, eliminating Content Security Policy issues and external dependencies
+- **Self-Hosted Chart.js** - Chart.js is now bundled locally instead of loading from jsdelivr CDN, removing the last external script dependency
+- **Event Script CRLF Detection** - Scripts with Windows line endings (CRLF) are detected before execution with a clear warning and fix command in logs
+
+### 🐛 Fixed
+
+- **Event Script Error Logging** - stderr output is now always logged regardless of exit code, and stdout is included on failures for easier debugging
+- **Settings Auto-Scroll on Mobile** - Fixed section auto-scroll not working on mobile when expanding sections that stretch the page content
+
+### 🔒 Security
+
+- **Tighter CSP** - Removed `cdn.jsdelivr.net` from `script-src` Content Security Policy directive — all assets are now self-hosted
+
+---
+
 ## [3.2.0] - Five-Client Support, Multi-Instance & User Management
 
 ### 🎉 Major Release - Five Download Clients & Multi-User

Dockerfile

@@ -35,6 +35,7 @@ COPY server/modules ./server/modules
 COPY static/index.html ./static/
 COPY static/*.png static/*.ico static/*.svg static/site.webmanifest ./static/
 COPY static/service-icons ./static/service-icons
+COPY static/flags ./static/flags
 
 # Copy built assets from builder stage (CSS + JS bundle)
 COPY --from=builder /build/static/output.css ./static/output.css

docs/CONFIGURATION.md

@@ -167,6 +167,7 @@ services:
       - RTORRENT_PATH=/RPC2
       - RTORRENT_USERNAME=user
       - RTORRENT_PASSWORD=pass  # Locks UI editing
+      - RTORRENT_USE_SSL=false
 
       # qBittorrent Connection (optional)
       - QBITTORRENT_ENABLED=true
@@ -258,6 +259,7 @@ services:
 | `RTORRENT_PATH` | `/RPC2` | XML-RPC endpoint path |
 | `RTORRENT_USERNAME` | - | HTTP auth username (if required) |
 | `RTORRENT_PASSWORD` | - | HTTP auth password (locks UI editing) |
+| `RTORRENT_USE_SSL` | `false` | Use HTTPS for XML-RPC connection |
 
 #### qBittorrent Connection
 

docs/RTORRENT.md

@@ -1,12 +1,12 @@
 # rTorrent Integration
 
-aMuTorrent connects to rTorrent via XML-RPC over HTTP, allowing you to manage BitTorrent downloads.
+aMuTorrent connects to rTorrent via XML-RPC over HTTP/HTTPS, allowing you to manage BitTorrent downloads.
 
 > **Alternative:** aMuTorrent also supports [qBittorrent](./QBITTORRENT.md), [Deluge](./DELUGE.md), and [Transmission](./TRANSMISSION.md). You can use multiple BitTorrent clients simultaneously.
 
 ## Requirements
 
-- rTorrent with XML-RPC enabled over HTTP
+- rTorrent with XML-RPC enabled over HTTP or HTTPS
 - Typically requires a web server (nginx, lighttpd) to expose XML-RPC
 
 ## Configuration
@@ -21,6 +21,7 @@ aMuTorrent connects to rTorrent via XML-RPC over HTTP, allowing you to manage Bi
    - **Port**: XML-RPC port (default: `8000`)
    - **Path**: XML-RPC endpoint path (default: `/RPC2`)
    - **Username/Password**: If HTTP authentication is required
+   - **Use SSL (HTTPS)**: Enable if your rTorrent XML-RPC endpoint uses HTTPS
 
 ### Via Environment Variables
 
@@ -31,6 +32,7 @@ RTORRENT_PORT=8000
 RTORRENT_PATH=/RPC2
 RTORRENT_USERNAME=user
 RTORRENT_PASSWORD=pass
+RTORRENT_USE_SSL=false
 ```
 
 ### Via config.json
@@ -43,7 +45,8 @@ RTORRENT_PASSWORD=pass
     "port": 8000,
     "path": "/RPC2",
     "username": "",
-    "password": ""
+    "password": "",
+    "useSsl": false
   }
 }
 ```

package.json

@@ -1,6 +1,6 @@
 {
   "name": "amutorrent-webapp-frontend",
-  "version": "3.2.0",
+  "version": "3.2.1",
   "description": "aMuTorrent Frontend Build",
   "scripts": {
     "build:css": "tailwindcss -i ./src/input.css -o ./static/output.css --minify",

server/lib/EventScriptingManager.js

@@ -98,6 +98,17 @@ class EventScriptingManager extends BaseModule {
       return;
     }
 
+    // Warn about Windows line endings (CRLF) which cause "command not found" errors
+    try {
+      const head = Buffer.alloc(256);
+      const fd = await fs.promises.open(scriptPath, 'r');
+      await fd.read(head, 0, 256);
+      await fd.close();
+      if (head.includes(0x0d)) {
+        this.log(`[EventScript] WARNING: Script has Windows line endings (CRLF): ${scriptPath} — this will cause "command not found" errors. Convert with: sed -i 's/\\r$//' ${scriptPath}`);
+      }
+    } catch { /* non-critical check */ }
+
     const jsonData = JSON.stringify(eventData);
 
     // Build environment variables
@@ -162,10 +173,13 @@ class EventScriptingManager extends BaseModule {
         if (timeoutId) clearTimeout(timeoutId);
 
         if (!killed) {
+          if (stderr) {
+            this.log(`[EventScript] stderr for ${eventType}: ${stderr.trim().substring(0, 500)}`);
+          }
           if (code === 0) {
             this.log(`[EventScript] Script completed for ${eventType}${stdout ? ': ' + stdout.trim().substring(0, 100) : ''}`);
           } else {
-            this.log(`[EventScript] Script exited with code ${code} for ${eventType}${stderr ? ': ' + stderr.trim().substring(0, 200) : ''}`);
+            this.log(`[EventScript] Script exited with code ${code} for ${eventType}${stdout ? ' | stdout: ' + stdout.trim().substring(0, 200) : ''}`);
           }
         }
         resolve();

server/lib/configTester.js

@@ -169,9 +169,10 @@ async function testAmuleConnection(host, port, password) {
  * @param {string} rpcPath - XML-RPC path (e.g., /RPC2)
  * @param {string} username - Optional username for basic auth
  * @param {string} password - Optional password for basic auth
+ * @param {boolean} useSsl - Whether to use HTTPS
  * @returns {Promise<{success: boolean, connected: boolean, version: string|null, error: string|null}>}
  */
-async function testRtorrentConnection(host, port, rpcPath, username, password) {
+async function testRtorrentConnection(host, port, rpcPath, username, password, useSsl) {
   const result = {
     success: false,
     connected: false,
@@ -193,7 +194,8 @@ async function testRtorrentConnection(host, port, rpcPath, username, password) {
       port: port || 8000,
       path: rpcPath || '/RPC2',
       username: username || null,
-      password: password || null
+      password: password || null,
+      useSsl: useSsl || false
     });
 
     client.connect();

server/lib/rtorrent/RtorrentHandler.js

@@ -15,6 +15,7 @@ class RtorrentHandler {
     this.path = options.path || '/RPC2';
     this.username = options.username || null;
     this.password = options.password || null;
+    this.useSsl = options.useSsl || false;
 
     this.client = null;
     this.connected = false;
@@ -38,7 +39,14 @@ class RtorrentHandler {
       };
     }
 
-    this.client = xmlrpc.createClient(clientOptions);
+    // Allow self-signed certificates when using SSL
+    if (this.useSsl) {
+      clientOptions.rejectUnauthorized = false;
+    }
+
+    this.client = this.useSsl
+      ? xmlrpc.createSecureClient(clientOptions)
+      : xmlrpc.createClient(clientOptions);
     return this;
   }