Frank
9bfa0be85d
- 31 new managed skills (anubis/arr/authentik/hermes/freetoken/podman/llm-swap runbooks etc.) now tracked. - Removed superseded skills: omp_harness_config, peon_ping_integration (replaced by user-authored peon-ping-* managed skills), rocmfp4-strix-benchmark-orchestration. - New memory-root skills: niri_compositor_ops, omp_git_workflow, omp_model_config, quadlet-media-migration, homelab-service-triage, hermes-dankclaw-ops, frank-default-large-ops, caddy-auth-dns-playbook.
1.7 KiB
1.7 KiB
name, description
| name | description |
|---|---|
| arr-auth-posture-probe | Verify a self-hosted *arr-style service's real auth posture by behavioral API probes instead of config-flag inference; includes the sed-masks-a-miss pitfall and wrong-host probe pitfall |
Arr-auth posture probe
Ground truth for "is this arr/gate open?" comes from behavior, not config flags. AuthenticationMethod=None + AuthenticationRequired=Enabled in config.xml is ambiguous on paper; on the wire it means a login screen with zero users — first-account-wins.
Recipe
- Confirm which host runs the service before probing (
podman pson the target, not the box you ssh'd into first — arrs live on Dankserver, chat/searxng on Dankclaw). - Probe an API endpoint that bypasses the SPA shell, locally and through the vhost:
curl -s -o /dev/null -w "%{http_code}" http://<host>:<port>/api/v3/system/status- SPA roots (
/) always serve a 200 shell — never conclude "open" or "gated" from/. - 401 = gated; 200 + JSON = API fully open (anyone on the net can drive it with curl).
- SPA roots (
- For config truth, dump the whole file (
podman exec <svc> cat /config/config.xml), not a pipedgrep | sed -n 2p:sed -n Npexits 0 on zero matches, so the pipeline hides a miss and you conclude "empty field" when the grep itself failed. - API keys from config.xml are local-only secrets; they stop being secret the moment a vhost serves the API unauthenticated.
Decision framing for the user
When posture = gated-with-zero-users, present it as a decision menu (None behind the front-door wall vs External/authentikarr), not a silent change — first-account-wins means whoever logs in first owns the instance.