Docs: system pages realigned to live ground truth; sibling-vault overlap census

Census against serverAppConfigs-docs + read-only ssh probes on both boxes
(2026-10-18). Corrections to OURS, flags only for THEIRS:

- Hardware drift: RTX 3090 moved dankserver->dankclaw 2026-09; dankserver
  now 2x Radeon AI PRO R9700 (Ryzen 7 7700X stays), 246 GiB RAM, no swap;
  dankclaw 121 GiB RAM + 64 GiB swap. Served: frank-archon radiance TP=2
  (:7770 dankserver), frank-dragoon halogen NATIVE v2 (:7770 dankclaw
  iGPU), frank-zealot llama.cpp PrismML Ternary-Bonsai-2-27B PQ2_0
  (:7771 dankclaw, 3090). Kernel 7.0.0-38 both; dankclaw :7770 no auth.
- Gitea: gitea-caddy quadlet retired (fleet Caddy fronts the domain);
  data tree moved to /home/dank/Containers/gitea/ (2026-09-01 standard),
  /opt/gitea is a do-not-use leftover; LAN IP + live domain.
- pi-era pages (core/settings, pi/models + role tables) demarcated as
  ARCHIVE with banners; llama-cpp fleet note modernized.
- AGENTS.md machine-facts table corrected (it still routed prod warnings
  at frank-default-large).

Their-side staleness flagged in the changelog entry for the operator,
not edited: OMP Harness thresholdPercent 70 (live is 95), Ubuntu 24.04
OS table, 2026-09-03 stack mapping, superseded pi-KB backlink.

Refs #5

omp-docs/tools/gitea/index.md

@@ -1,11 +1,11 @@
 # Gitea on dankclaw
 
-Private Git hosting on dankclaw. Three quadlet-managed containers in the rootless podman session of user `dank`: Gitea, PostgreSQL, Caddy.
+Private Git hosting on dankclaw. Two quadlet-managed containers in the rootless podman session of user `dank`: Gitea and PostgreSQL, sharing a dedicated network unit. The former `gitea-caddy` container is **retired** — the canonical fleet Caddy (`caddy.service`, see [/caddy/index.md](/caddy/index.md)) fronts `gitea.franksdank.cloud`; do not recreate the retired unit.
 
-**Host:** dankclaw (71.227.227.172)
-**Config:** `~/.config/containers/systemd/gitea-{postgres,server,caddy}.container` + `gitea.network`
-**Local access:** `http://dankclaw:3000`
-**Domain:** `https://gitea.franksdank.cloud` (DNS pending)
+**Host:** dankclaw (192.168.0.143 LAN)
+**Config:** `~/.config/containers/systemd/gitea-{postgres,server}.container` + `gitea.network`
+**Local access:** `http://dankclaw:3000` (verified 2026-10-18)
+**Domain:** `https://gitea.franksdank.cloud` (live; served by fleet Caddy, DNS-01 TLS)
 
 ## Architecture
 
@@ -13,7 +13,7 @@ Private Git hosting on dankclaw. Three quadlet-managed containers in the rootles
 |---|---|---|---|
 | `gitea-server` | `gitea-server.service` | 3000 (HTTP), 2222 (SSH) | Git web UI, API, SSH daemon |
 | `gitea-postgres` | `gitea-postgres.service` | 5432 (internal) | Database |
-| `gitea-caddy` | `gitea-caddy.service` | 80, 443 | Reverse proxy, auto-TLS |
+| (network) | `gitea-network.service` | — | quadlet `gitea.network` bring-up |
 
 The containers share the private network `systemd-gitea` (quadlet `gitea.network`, DNS enabled). The automatic `podman` default network has DNS disabled; do not run the stack on it.
 
@@ -23,21 +23,21 @@ All commands run as `dank` on dankclaw.
 
 | Action | Command |
 |---|---|
-| Start all | `systemctl --user start gitea-postgres gitea-server gitea-caddy` |
-| Stop all | `systemctl --user stop gitea-caddy gitea-server gitea-postgres` |
+| Start all | `systemctl --user start gitea-postgres gitea-server` |
+| Stop all | `systemctl --user stop gitea-server gitea-postgres` |
 | Restart Gitea only | `systemctl --user restart gitea-server` |
 | Follow logs | `podman logs -f gitea-server` or `journalctl --user -u gitea-server -f` |
-| Check status | `systemctl --user status gitea-postgres gitea-server gitea-caddy` |
+| Check status | `systemctl --user status gitea-postgres gitea-server` |
 
 ## Data Persistence
 
-All data lives on host bind mounts under `/opt/gitea/data/`. Containers are ephemeral. Stopping a quadlet unit removes its container; the next start recreates it. Volumes survive.
+All data lives on host bind mounts under `/home/dank/Containers/gitea/` (fleet storage standard since 2026-09-01; verified live 2026-10-18). Containers are ephemeral. Stopping a quadlet unit removes its container; the next start recreates it. Volumes survive. The old `/opt/gitea/` tree remains on disk as a leftover — do not use it.
 
-| Volume Path | Container Mount | Contents |
-|---|---|---|
-| `/opt/gitea/data/gitea-gitea/` | `/data` | Git repositories, app.ini, attachments |
-| `/opt/gitea/data/gitea-postgres/` | `/var/lib/postgresql/data` | PostgreSQL data files |
-| `/opt/gitea/data/caddy/data/` | `/root/.local/share/caddy` | Caddy configuration, TLS certs |
+| Path | Contents |
+|---|---|
+| `/home/dank/Containers/gitea/data/` | Git repositories, app.ini, attachments |
+| `/home/dank/Containers/gitea/postgres/` | PostgreSQL data files |
+| `/home/dank/Containers/gitea/env` | EnvironmentFile (mode 0600; `GITEA_DB_PASSWORD`) |
 
 See [[data-persistence|data-persistence]] for backup and restore.
 
@@ -49,7 +49,7 @@ See [[management|management]] for boot persistence details and troubleshooting.
 
 ## Repo Copies
 
-The quadlet files, Caddyfile, and `.env.example` are tracked in the `serverAppConfigs` repo under `dankclaw/gitea/`. The live password lives only in `/opt/gitea/.env` on the host (mode 0600).
+The quadlet files and `.env` templates are tracked in the `serverAppConfigs` deploy repo; the sibling vault page `Infrastructure/Gitea.md` (in `~/Projects/serverAppConfig/serverAppConfigs-docs/`) is the deploy-side source of truth. Secrets live only on the host under `Containers/gitea/` (mode 0600), never in either docs tree.
 
 ## See Also