diff --git a/omp-docs/agentic-web-research/searxng-tuning.md b/omp-docs/agentic-web-research/searxng-tuning.md index 206548b..e39734a 100644 --- a/omp-docs/agentic-web-research/searxng-tuning.md +++ b/omp-docs/agentic-web-research/searxng-tuning.md @@ -8,18 +8,41 @@ tags: - privacy - configuration - unverified -verified: 2026-08-28 +verified: 2026-10-19 timestamp: 2026-08-11 resource: https://docs.searxng.org --- # SearXNG Tuning -SearXNG is a metasearch engine. It aggregates 274 or more upstream search services into one result set. Configuration lives in `settings.yml`. The recommended deployment is Docker Compose with a Valkey container. +SearXNG is a metasearch engine. It aggregates hundreds of upstream search +services into one result set (upstream `settings.yml` defines 388 engine +entries at master, probed 2026-10-19; the live fleet instance loads 262). +Configuration lives in `settings.yml`. The recommended deployment is Docker +Compose (or Podman Quadlet) with a Valkey container. This page lists the settings that matter for speed, privacy, and useful results. -> **Your setup:** Pi Web Access calls a remote SearXNG at [`192.168.0.143:8081`](../pi/packages/pi-web-access.md) (dankclaw). Apply these settings to that host, not to this machine. +> **Fleet instance:** the harness `web/searxng` provider calls the instance at +> `192.168.0.143:8081` (UI) / `:8082` (JSON API) on dankclaw. The pi-era +> [Pi Web Access](../pi/packages/pi-web-access.md) called the same host. + +## Live instance (probed 2026-10-19) + +User Quadlet stack on dankclaw: `searxng.container` +(`ghcr.io/searxng/searxng:latest`) + `searxng-valkey.container` +(`docker.io/valkey/valkey:9-alpine`) + `gluetun.container` (VPN egress; the +containers share its network namespace, which is why `podman ps` shows :8081/ +:8082 on several names) + `marreta`/`marreta_browser`. `limiter.toml`: enabled, +`pass_searxng_org: true`. + +**Policy drift flag:** this page's tuned engine policy (google and bing +disabled; DuckDuckGo/Wikipedia/Google News enabled — verified via `/config` on +2026-08-16) is NOT live: `/config` on 2026-10-19 reports all 262 engines +enabled, google and bing included. Either the settings override was lost in +the 2026-10 stack reinstatement or the policy was deliberately dropped. +Confirm with Frank before re-applying. + ## Plan the Deployment diff --git a/omp-docs/agentic-web-research/vpn-routing.md b/omp-docs/agentic-web-research/vpn-routing.md index 5c274df..78313bb 100644 --- a/omp-docs/agentic-web-research/vpn-routing.md +++ b/omp-docs/agentic-web-research/vpn-routing.md @@ -171,8 +171,14 @@ This pattern places the whole SearXNG process inside the tunnel namespace. The h 4. Confirm that unrelated host traffic keeps the host IP. ```bash -# From inside the tunnel with Gluetun -docker exec gluetun curl -s ifconfig.me +# Gluetun ships no curl; use its own endpoints or a throwaway container. +podman exec gluetun sh -c 'test -e /sys/class/net/tun0 && echo tunnel-up' +podman exec gluetun sh -c 'wget -qO- 127.0.0.1:9999/health' # "OK" when up +# NOTE: :9999 is Gluetun's HTTP health server (200 "OK" / 500); :8000 is the +# CONTROL server (/v1/* API), which 404s on everything else. Do not health- +# probe :8000. Egress-IP check needs a real binary — run a companion +# container on gluetun's network: docker run --rm --net container:gluetun +# curlimages/curl -s ifconfig.me ``` ## Citations diff --git a/omp-docs/caddy/index.md b/omp-docs/caddy/index.md index db5bfee..af39077 100644 --- a/omp-docs/caddy/index.md +++ b/omp-docs/caddy/index.md @@ -2,14 +2,13 @@ Caddy is the reverse proxy and TLS terminator for the homelab. A single caddy container on dankclaw (192.168.0.143) fronts every service on both hosts. It -runs Caddy v2.11.4 from the custom `franksdank/caddy-porkbun` image -(xcaddy-built with the Porkbun DNS-01 module, built locally on dankclaw). +runs Caddy v2.11.7 (verified in-container 2026-10-19) from the custom +`localhost/franksdank/caddy-porkbun:latest` image (xcaddy-built with the +Porkbun DNS-01 module, built locally on dankclaw). Since 2026-08-26 it is managed as a Podman Quadlet unit (`caddy.container`) installed to `~/.config/containers/systemd/`, providing boot-persistent, auto-restart service management. -* [[caddyfile|caddyfile]] — directive and matcher syntax, named matchers, - directive sorting, and the `handle`/`route` order rule. The Caddyfile lives in the serverAppConfigs repo at `dankclaw/Caddyfile`. `deploy.sh` renders basicauth hashes from the host `.env` @@ -27,4 +26,4 @@ resolves `*.franksdank.cloud` names to dankclaw. The porkbun DNS module source: [caddy-dns/porkbun](https://github.com/caddy-dns/porkbun). -* [Caddyfile Syntax](caddyfile.md) — Caddy Caddyfile reference — directive and matcher syntax, named matchers, directive sorting, and the handle/route order rule. Grounded in caddyserver.com (fetched 2026-08-28). +* [Caddyfile Syntax](caddyfile.md) — Caddy Caddyfile reference — directive and matcher syntax, named matchers, directive sorting, and the `handle`/`route` order rule. Grounded in caddyserver.com (fetched 2026-08-28). diff --git a/omp-docs/system/dankclaw.md b/omp-docs/system/dankclaw.md index 5601937..18bf01c 100644 --- a/omp-docs/system/dankclaw.md +++ b/omp-docs/system/dankclaw.md @@ -11,15 +11,29 @@ tags: generated: by: chief-designer/agent at: 2026-08-26T00:00:00Z -verified: 2026-10-18 +verified: 2026-10-19 --- # Dankclaw -Strix Halo mini-PC carrying the fleet's secondary models and most of the -service stack (Gitea, Caddy, OpenWebUI, SearXNG). Two GPU-class devices: the -Radeon 8060S iGPU with 119 GiB unified memory, and the RTX 3090 moved over -from Dankserver in September 2026. +Strix Halo mini-PC carrying the fleet's secondary models and the bulk of the +service stack. Two GPU-class devices: the Radeon 8060S iGPU with 119 GiB +unified memory, and the RTX 3090 moved over from Dankserver in September 2026. + +## Service Stack (live census, 32 containers, 2026-10-19) + +User-scope Podman Quadlet units (`~/.config/containers/systemd/`) unless +noted. Full names; detail pages where they exist. + +| Group | Containers | +|-------|-----------| +| Inference (root systemd, not quadlet) | `frank-dragoon` (:7770), `frank-zealot` (:7771) | +| TTS | `frank-tts` (:7772), `frank-tts-engine` (:8880) | +| Git forge | `gitea-server` (:3000/:2222), `gitea-postgres` — see [/tools/gitea/](/tools/gitea/index.md) | +| Web/search | `caddy` (:80/:443, Porkbun build), `searxng` (:8081/:8082 via `gluetun`), `searxng-valkey`, `marreta`, `marreta_browser`, `anubis` (bot shield), `chrome-devtools-protocol` (headless-shell) | +| Identity | `authentik-server` (:9000), `authentik-worker`, `authentik-outpost`, `authentik-outpost-ldap` (:389/:636), `authentik-postgres` | +| Monitoring | `prometheus` (:9090), `grafana` (:3002), `loki`, `alloy`, `alertmanager` (:9093), `node-exporter` — loopback-only ports | +| Media/apps | `open-webui` (:3005), `comfyui` (:8188, ROCm `gfx1151`), `seerr` (:5055), `hermes`/`hermes-webui`/`hermes-dashboard` (:9119), `ntfy` (pubsub), `pihole` (:53 DNS, :8083 admin) | ## Connection Details @@ -33,8 +47,8 @@ from Dankserver in September 2026. | Model ID | Unit | Endpoint | Engine / weights | |----------|------|----------|------------------| -| `frank-dragoon` | `frank-dragoon.service` (root) | `:7770` | halogen-flash-server container — Quat3rnion NATIVE v2 abliterated Qwen3.8-Flash-Next, MTP spec decode, 2 slots over ONE 200,704-position pool, vision ON, **Strix Halo iGPU** (unified memory) | -| `frank-zealot` | `frank-zealot.service` (root) | `:7771` | llama.cpp (PrismML fork, build 10754) — Ternary-Bonsai-2-27B PQ2_0 GGUF (qwen35 hybrid), 2×200,704 slots, q8_0 K+V, mmproj vision, **RTX 3090** | +| `frank-dragoon` | `frank-dragoon.service` (root) | `:7770` (container `frank-dragoon-halogen`, 7770→8731) | halogen-flash-server container (`ghcr.io/peonist-ai/halogen-flash-server`, digest-pinned) — Quat3rnion NATIVE v2 abliterated Qwen3.8-Flash-Next, MTP spec decode, 2 slots over ONE **401,408**-position pool at ctx **200,704**, vision ON, **Strix Halo iGPU** (unified memory) | +| `frank-zealot` | `frank-zealot.service` (root) | `:7771` | llama.cpp (PrismML fork, build 10777) — Ternary-Bonsai-**2-9B** PQ2_0-MTP GGUF (qwen35 hybrid), 2×262,144 slots over one 524,288 pool, **unquantized f16 K+V**, MTP off, mmproj Q8_0 vision, **RTX 3090** | Harness-side context windows (`agent/models.yml`): dragoon 155,648, zealot 200,704 per slot. The models.yml display labels "(dankclaw-gpu)" / diff --git a/omp-docs/tools/gitea/index.md b/omp-docs/tools/gitea/index.md index 0368c46..2ec5e7a 100644 --- a/omp-docs/tools/gitea/index.md +++ b/omp-docs/tools/gitea/index.md @@ -4,7 +4,7 @@ Private Git hosting on dankclaw. Two quadlet-managed containers in the rootless **Host:** dankclaw (192.168.0.143 LAN) **Config:** `~/.config/containers/systemd/gitea-{postgres,server}.container` + `gitea.network` -**Local access:** `http://dankclaw:3000` (verified 2026-10-18) +**Local access:** `http://dankclaw:3000` — Gitea 1.27.3 (`/api/v1/version`, probed 2026-10-19) **Domain:** `https://gitea.franksdank.cloud` (live; served by fleet Caddy, DNS-01 TLS) ## Architecture @@ -53,16 +53,7 @@ The quadlet files and `.env` templates are tracked in the `serverAppConfigs` dep ## See Also -- [[architecture|architecture]] — network topology and ports -- [[management|management]] — operations, upgrades, backups, incident log -- [[client-access|client-access]] — client-side tokens, the credential store, and the git 2.56 store-format trap -- [[data-persistence|data-persistence]] — volumes and backup strategy -- [[containers|containers]] — quadlet reference - - * [Gitea Architecture](architecture.md) — Gitea container architecture, network topology, and Caddy reverse proxy configuration on dankclaw. - - * [Gitea Data Persistence](data-persistence.md) — Gitea data persistence, volume mounts, ownership, and backup strategy on dankclaw. - - * [Gitea Management](management.md) — Gitea container management, boot persistence, troubleshooting, upgrades, and backup procedures on dankclaw. - - * [Gitea Client Access](client-access.md) — Token-based HTTP access from client workstations, credential store layout, and verification. +* [Gitea Architecture](architecture.md) — container architecture, network topology, ports. +* [Gitea Data Persistence](data-persistence.md) — data layout, ownership mapping, backup strategy. +* [Gitea Management](management.md) — operations, upgrades, backups, incident log. +* [Gitea Client Access](client-access.md) — token-based HTTP access from clients, credential store, git 2.56 store-format trap.