Files

T

Frank ae82aa00e4 Docs: system pages realigned to live ground truth; sibling-vault overlap census

Census against serverAppConfigs-docs + read-only ssh probes on both boxes
(2026-10-18). Corrections to OURS, flags only for THEIRS:

- Hardware drift: RTX 3090 moved dankserver->dankclaw 2026-09; dankserver
  now 2x Radeon AI PRO R9700 (Ryzen 7 7700X stays), 246 GiB RAM, no swap;
  dankclaw 121 GiB RAM + 64 GiB swap. Served: frank-archon radiance TP=2
  (:7770 dankserver), frank-dragoon halogen NATIVE v2 (:7770 dankclaw
  iGPU), frank-zealot llama.cpp PrismML Ternary-Bonsai-2-27B PQ2_0
  (:7771 dankclaw, 3090). Kernel 7.0.0-38 both; dankclaw :7770 no auth.
- Gitea: gitea-caddy quadlet retired (fleet Caddy fronts the domain);
  data tree moved to /home/dank/Containers/gitea/ (2026-09-01 standard),
  /opt/gitea is a do-not-use leftover; LAN IP + live domain.
- pi-era pages (core/settings, pi/models + role tables) demarcated as
  ARCHIVE with banners; llama-cpp fleet note modernized.
- AGENTS.md machine-facts table corrected (it still routed prod warnings
  at frank-default-large).

Their-side staleness flagged in the changelog entry for the operator,
not edited: OMP Harness thresholdPercent 70 (live is 95), Ubuntu 24.04
OS table, 2026-09-03 stack mapping, superseded pi-KB backlink.

Refs #5

2026-10-18 03:39:56 -07:00

3.6 KiB

Raw Blame History

type, title, description, tags, verified

type

title

description

Gitea Architecture

Two quadlet-managed containers (Gitea, PostgreSQL) on a shared private Podman network (rootless, user dank). Gitea connects to PostgreSQL via network DNS. The fleet Caddy (separate stack, see /caddy/index.md) proxies HTTP/S to Gitea — the old dedicated gitea-caddy container is retired.

Network Topology

Client (HTTPS)
    ↓
caddy :80/:443  (auto-TLS via Let's Encrypt DNS-01/Porkbun)
    ↓ reverse_proxy 192.168.0.143:3000 (published quadlet port)
gitea-server :3000  (web UI, API)
    ↓ PostgreSQL protocol
gitea-postgres :5432  (internal only)

Network

The containers share the quadlet network systemd-gitea (file gitea.network, DNS enabled by default). Container names resolve via network DNS.

The automatic rootless podman default network has dns_enabled: false. Container names do not resolve there. Keep the Gitea stack on systemd-gitea.

Container and Unit Names

Container	Unit	Depends on
`gitea-postgres`	`gitea-postgres.service`	`gitea-network.service`
`gitea-server`	`gitea-server.service`	`gitea-postgres.service`

Podman 5.x names quadlet units after the file (gitea-server.service), with no container- prefix.

Caddy Configuration

Caddy is a separate quadlet-managed service (caddy.container) on the shared dankclaw_default network. The live Caddyfile at /home/dank/Containers/caddy/Caddyfile proxies Gitea via the published quadlet port:

gitea.franksdank.cloud {
    reverse_proxy 192.168.0.143:3000
}

Caddy issues Let's Encrypt certs via DNS-01 (Porkbun module) — no inbound HTTP port needed.
Pi-hole quadlet resolves gitea.franksdank.cloud to 192.168.0.143 via addn-hosts.
Serves HTTP on port 80 and HTTPS on port 443, both bound to 0.0.0.0.

Gitea Configuration

Quadlet file: ~/.config/containers/systemd/gitea-server.container (repo copy: serverAppConfigs/dankclaw/gitea/quadlet/gitea-server.container)

Key environment variables:

DATABASE_TYPE=postgres
DATABASE_HOST=gitea-postgres (network DNS)
DATABASE_NAME=gitea
DATABASE_USER=gitea
DATABASE_PASSWD from /home/dank/Containers/gitea/env (mode 0600)
USER_UID=1000, USER_GID=1000

Gitea writes /data/gitea/conf/app.ini on first start (host: /home/dank/Containers/gitea/data/gitea/conf/app.ini). The [database] HOST and PASSWD lines in app.ini override the env vars. When you rename the database container, edit the HOST line in app.ini as well.

Ports

Service	Host Binding	Container Port	Access
Gitea HTTP	`0.0.0.0:3000`	3000	Web UI, API
Gitea SSH	`0.0.0.0:2222`	22	Git clone/push via SSH
PostgreSQL	`5432` (internal)	5432	Container-to-container only

Note: the full-stack repo compose (dankclaw/compose.yaml) maps Gitea HTTP to host port 3001. The live stack uses 3000. Align before the full-stack deploy.

gitea.franksdank.cloud resolves to 192.168.0.143 via the Pi-hole quadlet's addn-hosts. Caddy obtains Let's Encrypt certs via DNS-01 (Porkbun module), which requires no inbound port reachability. LAN clients reach Gitea via http://dankclaw:3000 (published quadlet port).

3.6 KiB Raw Blame History