Files

T

Frank c99eb8e11b docs(fleet): live-probe corrections across dankclaw, caddy, gitea, searxng, vpn docs

Live read-only probes on Dankclaw (BatchMode ssh, 2026-10-19):

- system/dankclaw.md: full 32-container census added (authentik IdP,
  prometheus/grafana/loki/alloy/alertmanager monitoring, pihole, ntfy,
  seerr, hermes stack, anubis, frank-tts :7772 all undocumented);
  dragoon pool corrected 401,408 @ ctx 200,704 (was conflated);
  zealot corrected to PrismML build 10777, Ternary-Bonsai-2-9B
  PQ2_0-MTP, 2x262,144 over one 524,288 pool, f16 K+V (doc claimed
  build 10754, 27B, 2x200,704)
- caddy/index.md: v2.11.7 (in-container ), deduped
  caddyfile listing
- gitea: version 1.27.3 probed via API; systemd-gitea network + rootless
  100999 mapping confirmed live (gitea-server attaches systemd-gitea;
  dank subuid 100000:65536); index See-Also de-duplicated
- searxng-tuning.md: live instance section (ghcr image, valkey:9-alpine,
  marreta netns-sharing explains duplicate port maps); POLICY DRIFT FLAG:
  tuned engine policy (google/bing disabled, verified 2026-08-16) is NOT
  live — /config now shows all 262 engines enabled; upstream settings.yml
  count corrected 388@master; limiter table already matched source
- vpn-routing.md: verify snippet fixed — gluetun image ships no curl;
  health server is 127.0.0.1:9999/health ('OK'), :8000 is the CONTROL
  server (404s on health paths); correct probes provided

Refs #29

2026-10-19 04:12:04 -07:00

1.6 KiB

Raw Blame History

Caddy

Caddy is the reverse proxy and TLS terminator for the homelab. A single caddy container on dankclaw (192.168.0.143) fronts every service on both hosts. It runs Caddy v2.11.7 (verified in-container 2026-10-19) from the custom localhost/franksdank/caddy-porkbun:latest image (xcaddy-built with the Porkbun DNS-01 module, built locally on dankclaw). Since 2026-08-26 it is managed as a Podman Quadlet unit (caddy.container) installed to ~/.config/containers/systemd/, providing boot-persistent, auto-restart service management.

The Caddyfile lives in the serverAppConfigs repo at dankclaw/Caddyfile. deploy.sh renders basicauth hashes from the host .env (REPLACE_WITH_HASH → real bcrypt) into /home/dank/Containers/caddy/Caddyfile, which the container mounts read-only; Caddy's config file watcher (admin API, not disabled) hot-reloads on change. The Caddyfile joins the dankclaw_default compose network so container-name upstreams (authentik-server, grafana, etc.) still resolve.

TLS: Let's Encrypt wildcard certs via Porkbun DNS-01. The acme_dns block in the Caddyfile reads API keys from /home/dank/Containers/caddy/env (deployed from the repo's git-ignored .env). No inbound port 80/443 reachability is needed from the internet — DNS-01 works entirely from the LAN, where Pi-hole resolves *.franksdank.cloud names to dankclaw.

The porkbun DNS module source: caddy-dns/porkbun.

Caddyfile Syntax — Caddy Caddyfile reference — directive and matcher syntax, named matchers, directive sorting, and the handle/route order rule. Grounded in caddyserver.com (fetched 2026-08-28).

1.6 KiB Raw Blame History

Caddy

1.6 KiB

Raw Blame History