docs(fleet): live-probe corrections across dankclaw, caddy, gitea, searxng, vpn docs

Live read-only probes on Dankclaw (BatchMode ssh, 2026-10-19):

- system/dankclaw.md: full 32-container census added (authentik IdP,
  prometheus/grafana/loki/alloy/alertmanager monitoring, pihole, ntfy,
  seerr, hermes stack, anubis, frank-tts :7772 all undocumented);
  dragoon pool corrected 401,408 @ ctx 200,704 (was conflated);
  zealot corrected to PrismML build 10777, Ternary-Bonsai-2-9B
  PQ2_0-MTP, 2x262,144 over one 524,288 pool, f16 K+V (doc claimed
  build 10754, 27B, 2x200,704)
- caddy/index.md: v2.11.7 (in-container ), deduped
  caddyfile listing
- gitea: version 1.27.3 probed via API; systemd-gitea network + rootless
  100999 mapping confirmed live (gitea-server attaches systemd-gitea;
  dank subuid 100000:65536); index See-Also de-duplicated
- searxng-tuning.md: live instance section (ghcr image, valkey:9-alpine,
  marreta netns-sharing explains duplicate port maps); POLICY DRIFT FLAG:
  tuned engine policy (google/bing disabled, verified 2026-08-16) is NOT
  live — /config now shows all 262 engines enabled; upstream settings.yml
  count corrected 388@master; limiter table already matched source
- vpn-routing.md: verify snippet fixed — gluetun image ships no curl;
  health server is 127.0.0.1:9999/health ('OK'), :8000 is the CONTROL
  server (404s on health paths); correct probes provided

Refs #29

omp-docs/agentic-web-research/searxng-tuning.md

@@ -8,18 +8,41 @@ tags:
   - privacy
   - configuration
   - unverified
-verified: 2026-08-28
+verified: 2026-10-19
 timestamp: 2026-08-11
 resource: https://docs.searxng.org
 ---
 
 # SearXNG Tuning
 
-SearXNG is a metasearch engine. It aggregates 274 or more upstream search services into one result set. Configuration lives in `settings.yml`. The recommended deployment is Docker Compose with a Valkey container.
+SearXNG is a metasearch engine. It aggregates hundreds of upstream search
+services into one result set (upstream `settings.yml` defines 388 engine
+entries at master, probed 2026-10-19; the live fleet instance loads 262).
+Configuration lives in `settings.yml`. The recommended deployment is Docker
+Compose (or Podman Quadlet) with a Valkey container.
 
 This page lists the settings that matter for speed, privacy, and useful results.
 
-> **Your setup:** Pi Web Access calls a remote SearXNG at [`192.168.0.143:8081`](../pi/packages/pi-web-access.md) (dankclaw). Apply these settings to that host, not to this machine.
+> **Fleet instance:** the harness `web/searxng` provider calls the instance at
+> `192.168.0.143:8081` (UI) / `:8082` (JSON API) on dankclaw. The pi-era
+> [Pi Web Access](../pi/packages/pi-web-access.md) called the same host.
+
+## Live instance (probed 2026-10-19)
+
+User Quadlet stack on dankclaw: `searxng.container`
+(`ghcr.io/searxng/searxng:latest`) + `searxng-valkey.container`
+(`docker.io/valkey/valkey:9-alpine`) + `gluetun.container` (VPN egress; the
+containers share its network namespace, which is why `podman ps` shows :8081/
+:8082 on several names) + `marreta`/`marreta_browser`. `limiter.toml`: enabled,
+`pass_searxng_org: true`.
+
+**Policy drift flag:** this page's tuned engine policy (google and bing
+disabled; DuckDuckGo/Wikipedia/Google News enabled — verified via `/config` on
+2026-08-16) is NOT live: `/config` on 2026-10-19 reports all 262 engines
+enabled, google and bing included. Either the settings override was lost in
+the 2026-10 stack reinstatement or the policy was deliberately dropped.
+Confirm with Frank before re-applying.
+
 
 ## Plan the Deployment
 

omp-docs/agentic-web-research/vpn-routing.md

@@ -171,8 +171,14 @@ This pattern places the whole SearXNG process inside the tunnel namespace. The h
 4. Confirm that unrelated host traffic keeps the host IP.
 
 ```bash
-# From inside the tunnel with Gluetun
+# Gluetun ships no curl; use its own endpoints or a throwaway container.
-docker exec gluetun curl -s ifconfig.me
+podman exec gluetun sh -c 'test -e /sys/class/net/tun0 && echo tunnel-up'
+podman exec gluetun sh -c 'wget -qO- 127.0.0.1:9999/health'   # "OK" when up
+# NOTE: :9999 is Gluetun's HTTP health server (200 "OK" / 500); :8000 is the
+# CONTROL server (/v1/* API), which 404s on everything else. Do not health-
+# probe :8000. Egress-IP check needs a real binary — run a companion
+# container on gluetun's network: docker run --rm --net container:gluetun
+# curlimages/curl -s ifconfig.me
 ```
 
 ## Citations

omp-docs/caddy/index.md

@@ -2,14 +2,13 @@
 
 Caddy is the reverse proxy and TLS terminator for the homelab. A single caddy
 container on dankclaw (192.168.0.143) fronts every service on both hosts. It
-runs Caddy v2.11.4 from the custom `franksdank/caddy-porkbun` image
+runs Caddy v2.11.7 (verified in-container 2026-10-19) from the custom
-(xcaddy-built with the Porkbun DNS-01 module, built locally on dankclaw).
+`localhost/franksdank/caddy-porkbun:latest` image (xcaddy-built with the
+Porkbun DNS-01 module, built locally on dankclaw).
 Since 2026-08-26 it is managed as a Podman Quadlet unit (`caddy.container`)
 installed to `~/.config/containers/systemd/`, providing boot-persistent,
 auto-restart service management.
 
-* [[caddyfile|caddyfile]] — directive and matcher syntax, named matchers,
-  directive sorting, and the `handle`/`route` order rule.
 
 The Caddyfile lives in the serverAppConfigs repo at
 `dankclaw/Caddyfile`. `deploy.sh` renders basicauth hashes from the host `.env`
@@ -27,4 +26,4 @@ resolves `*.franksdank.cloud` names to dankclaw.
 
 The porkbun DNS module source: [caddy-dns/porkbun](https://github.com/caddy-dns/porkbun).
 
-* [Caddyfile Syntax](caddyfile.md) — Caddy Caddyfile reference — directive and matcher syntax, named matchers, directive sorting, and the handle/route order rule. Grounded in caddyserver.com (fetched 2026-08-28).
+* [Caddyfile Syntax](caddyfile.md) — Caddy Caddyfile reference — directive and matcher syntax, named matchers, directive sorting, and the `handle`/`route` order rule. Grounded in caddyserver.com (fetched 2026-08-28).

omp-docs/system/dankclaw.md

@@ -11,15 +11,29 @@ tags:
 generated:
   by: chief-designer/agent
   at: 2026-08-26T00:00:00Z
-verified: 2026-10-18
+verified: 2026-10-19
 ---
 
 # Dankclaw
 
-Strix Halo mini-PC carrying the fleet's secondary models and most of the
+Strix Halo mini-PC carrying the fleet's secondary models and the bulk of the
-service stack (Gitea, Caddy, OpenWebUI, SearXNG). Two GPU-class devices: the
+service stack. Two GPU-class devices: the Radeon 8060S iGPU with 119 GiB
-Radeon 8060S iGPU with 119 GiB unified memory, and the RTX 3090 moved over
+unified memory, and the RTX 3090 moved over from Dankserver in September 2026.
-from Dankserver in September 2026.
+
+## Service Stack (live census, 32 containers, 2026-10-19)
+
+User-scope Podman Quadlet units (`~/.config/containers/systemd/`) unless
+noted. Full names; detail pages where they exist.
+
+| Group | Containers |
+|-------|-----------|
+| Inference (root systemd, not quadlet) | `frank-dragoon` (:7770), `frank-zealot` (:7771) |
+| TTS | `frank-tts` (:7772), `frank-tts-engine` (:8880) |
+| Git forge | `gitea-server` (:3000/:2222), `gitea-postgres` — see [/tools/gitea/](/tools/gitea/index.md) |
+| Web/search | `caddy` (:80/:443, Porkbun build), `searxng` (:8081/:8082 via `gluetun`), `searxng-valkey`, `marreta`, `marreta_browser`, `anubis` (bot shield), `chrome-devtools-protocol` (headless-shell) |
+| Identity | `authentik-server` (:9000), `authentik-worker`, `authentik-outpost`, `authentik-outpost-ldap` (:389/:636), `authentik-postgres` |
+| Monitoring | `prometheus` (:9090), `grafana` (:3002), `loki`, `alloy`, `alertmanager` (:9093), `node-exporter` — loopback-only ports |
+| Media/apps | `open-webui` (:3005), `comfyui` (:8188, ROCm `gfx1151`), `seerr` (:5055), `hermes`/`hermes-webui`/`hermes-dashboard` (:9119), `ntfy` (pubsub), `pihole` (:53 DNS, :8083 admin) |
 
 ## Connection Details
 
@@ -33,8 +47,8 @@ from Dankserver in September 2026.
 
 | Model ID | Unit | Endpoint | Engine / weights |
 |----------|------|----------|------------------|
-| `frank-dragoon` | `frank-dragoon.service` (root) | `:7770` | halogen-flash-server container — Quat3rnion NATIVE v2 abliterated Qwen3.8-Flash-Next, MTP spec decode, 2 slots over ONE 200,704-position pool, vision ON, **Strix Halo iGPU** (unified memory) |
+| `frank-dragoon` | `frank-dragoon.service` (root) | `:7770` (container `frank-dragoon-halogen`, 7770→8731) | halogen-flash-server container (`ghcr.io/peonist-ai/halogen-flash-server`, digest-pinned) — Quat3rnion NATIVE v2 abliterated Qwen3.8-Flash-Next, MTP spec decode, 2 slots over ONE **401,408**-position pool at ctx **200,704**, vision ON, **Strix Halo iGPU** (unified memory) |
-| `frank-zealot` | `frank-zealot.service` (root) | `:7771` | llama.cpp (PrismML fork, build 10754) — Ternary-Bonsai-2-27B PQ2_0 GGUF (qwen35 hybrid), 2×200,704 slots, q8_0 K+V, mmproj vision, **RTX 3090** |
+| `frank-zealot` | `frank-zealot.service` (root) | `:7771` | llama.cpp (PrismML fork, build 10777) — Ternary-Bonsai-**2-9B** PQ2_0-MTP GGUF (qwen35 hybrid), 2×262,144 slots over one 524,288 pool, **unquantized f16 K+V**, MTP off, mmproj Q8_0 vision, **RTX 3090** |
 
 Harness-side context windows (`agent/models.yml`): dragoon 155,648,
 zealot 200,704 per slot. The models.yml display labels "(dankclaw-gpu)" /

omp-docs/tools/gitea/index.md

@@ -4,7 +4,7 @@ Private Git hosting on dankclaw. Two quadlet-managed containers in the rootless
 
 **Host:** dankclaw (192.168.0.143 LAN)
 **Config:** `~/.config/containers/systemd/gitea-{postgres,server}.container` + `gitea.network`
-**Local access:** `http://dankclaw:3000` (verified 2026-10-18)
+**Local access:** `http://dankclaw:3000` — Gitea 1.27.3 (`/api/v1/version`, probed 2026-10-19)
 **Domain:** `https://gitea.franksdank.cloud` (live; served by fleet Caddy, DNS-01 TLS)
 
 ## Architecture
@@ -53,16 +53,7 @@ The quadlet files and `.env` templates are tracked in the `serverAppConfigs` dep
 
 ## See Also
 
-- [[architecture|architecture]] — network topology and ports
+* [Gitea Architecture](architecture.md) — container architecture, network topology, ports.
-- [[management|management]] — operations, upgrades, backups, incident log
+* [Gitea Data Persistence](data-persistence.md) — data layout, ownership mapping, backup strategy.
-- [[client-access|client-access]] — client-side tokens, the credential store, and the git 2.56 store-format trap
+* [Gitea Management](management.md) — operations, upgrades, backups, incident log.
-- [[data-persistence|data-persistence]] — volumes and backup strategy
+* [Gitea Client Access](client-access.md) — token-based HTTP access from clients, credential store, git 2.56 store-format trap.
-- [[containers|containers]] — quadlet reference
-
-  * [Gitea Architecture](architecture.md) — Gitea container architecture, network topology, and Caddy reverse proxy configuration on dankclaw.
-
-  * [Gitea Data Persistence](data-persistence.md) — Gitea data persistence, volume mounts, ownership, and backup strategy on dankclaw.
-
-  * [Gitea Management](management.md) — Gitea container management, boot persistence, troubleshooting, upgrades, and backup procedures on dankclaw.
-
-  * [Gitea Client Access](client-access.md) — Token-based HTTP access from client workstations, credential store layout, and verification.