[kris-anderson]

---

• I have read the contributing guideline and understand that I have made the correct modifications

---

Description

Adds channels-dvr.subdomain.conf.sample for Channels DVR Server (fancybits/channels-dvr, web UI on port 8089). The sample follows _template.subdomain.conf.sample. Its header uses the same bridge-mode / host-mode notes as the plex sample, because the Channels DVR docker instructions use --net=host.

It differs from a plain template conf in one way, and only as a commented-out line:

• Channels DVR treats any request carrying an X-Forwarded-For header as coming from outside the home network, whatever address the header holds. proxy.conf always sets that header, so through swag the web UI always shows Channels' "Unauthorized — Get Authorization Code" page (HTTP 403). The visitor then authorizes with their Channels account.
• That is the right default for a swag that is reachable from the internet, so the sample leaves it alone.
• For a swag that is only reachable from the LAN, the sample offers a commented-out proxy_set_header X-DVR-SkipAuth true;. That is Channels DVR's own header for skipping the check. The header comment and the line's comment both warn not to enable it on an internet-facing swag.

Benefits of this PR and context

There is no Channels DVR sample yet. The obvious attempt doesn't work: clearing the header with proxy_set_header X-Forwarded-For ""; after include /config/nginx/proxy.conf; changes nothing, because nginx sends proxy.conf's own entry anyway. Users then hit an authorization page on their own network with no hint why. This sample documents the behaviour and both ways to use it.

How Has This Been Tested?

• swag 5.9.0-ls498 on unRAID, Channels DVR 2026.10.24.0621 (fancybits/channels-dvr:tve), with swag only reachable from the LAN.
• Direct requests to Channels DVR on port 8089:
  • no X-Forwarded-For: 200
  • X-Forwarded-For with any address (LAN, loopback or docker range): 403, the authorization code page
  • X-Forwarded-For + X-DVR-SkipAuth: true (or 1): 200
• Through swag:
  • as shipped (line commented out): 403, the authorization code page
  • with the X-DVR-SkipAuth line enabled: 200 for /, /dvr, /devices and /manifest.json
• The repo's check_samples.yml steps were run locally:
  • allowed file name, no executable bit, LF line endings, version line regex
  • nginx -t in ghcr.io/linuxserver/nginx with all samples and the current proxy.conf.sample from docker-swag master: test is successful, both as shipped and with the X-DVR-SkipAuth line uncommented

Source / References

• Channels community: How does the web UI decide which IPs are local (no login) and remote (requires auth)
• Channels community: X-Forwarded-For/X-Real-IP has no effect in the web gui
• Channels community: Disable authorization code
• Channels DVR docker instructions (host networking): hub.docker.com/r/fancybits/channels-dvr

🤖 Generated with Claude Code