68 lines
4.6 KiB
Markdown
68 lines
4.6 KiB
Markdown
---
|
|
name: serverappconfigs-inventory-audit
|
|
description: "Audit serverAppConfigs for duplicated fleet-service definitions: the 10 hand-copied inventory sites, the live-vs-repo drift census commands, and the known staleness checks."
|
|
---
|
|
|
|
# serverAppConfigs inventory / duplication audit
|
|
|
|
Use when asked "where can we refactor or share resources", "why is X defined twice", or when adding a service and the edit sites must be enumerated. Read-only audit; changes come later.
|
|
|
|
## The inventory is hand-copied ten times (2026-10-13 census)
|
|
|
|
| Truth | Path | Shape |
|
|
|---|---|---|
|
|
order graph | `scripts/deploy-plan.py` `SERVICE_ORDER` | 45 names |
|
|
per-host allow-sets | `scripts/deploy-plan.py` `DANKCLAW_/DANKSERVER_/FRANKBOOK_SERVICES` | 3 sets |
|
|
path→service | `scripts/deploy-plan.py` `services_for_path` | ~30 branches + 6 in-branch name whitelists |
|
|
target:service gate | `scripts/deploy-remote.sh` `service_is_allowed` | `case "$TARGET:$service"` pairs |
|
|
dispatcher | `scripts/deploy-remote.sh` `deploy_service` | 30 branches |
|
|
test selector | `scripts/test-changed.sh` | ~40 path globs |
|
|
probes | `shared/homepage/services.json` | 35 entries (probe, url, docs, icon) |
|
|
scrape jobs | `shared/prometheus/prometheus.yml` | 11 jobs |
|
|
vhosts | `dankclaw/Caddyfile` | public vhost + `http://:8017` post-auth handler per guarded service |
|
|
DNS | `dankclaw/pihole/addn-hosts` | 30 records |
|
|
|
|
Adding one service touches all ten. Any audit that enumerates services must cross-check all ten, not one.
|
|
|
|
## Census commands
|
|
|
|
Live-vs-repo container drift (catches host-only units with no git provenance):
|
|
|
|
```bash
|
|
ssh dankclaw 'podman ps --format "{{.Names}}"' | sort > /tmp/live.txt
|
|
grep -h '^ContainerName=' dankclaw/*/*/*.container | sed 's/ContainerName=//' | sort > /tmp/repo.txt
|
|
comm -23 /tmp/live.txt /tmp/repo.txt # live, not in repo
|
|
comm -13 /tmp/live.txt /tmp/repo.txt # in repo, not running
|
|
```
|
|
|
|
`systemd-<network>` in the live list is podman's netns infra container — benign. A real hit: `ntfy` (2026-10-11) existed only as `~/.config/containers/systemd/ntfy.container` with `restart=no`.
|
|
|
|
Other probes, all cheap and all producing findings on 2026-10-13:
|
|
|
|
```bash
|
|
# stateful stores and whether probes can reach them
|
|
grep -n 'PublishPort' dankclaw/**/quadlet/*postgres* dankserver/**/quadlet/*{mariadb,redis}*
|
|
# dead scripts: zero refs outside docs
|
|
for f in scripts/*.sh; do grep -rl "$(basename $f)" . | grep -v serverAppConfigs-docs | grep -q . || echo "$f"; done
|
|
# shared paths that no longer exist
|
|
for p in dankclaw/frank-dragoon dankclaw/compose.yaml dankserver/Caddyfile; do [ -e "$p" ] || echo "STALE $p"; done
|
|
# memory footprint, to kill the "saves RAM" argument
|
|
ssh dankclaw 'podman stats --no-stream --format "{{.Name}} {{.MemUsage}}" postgres gitea-postgres authentik-postgres'
|
|
```
|
|
|
|
## Known-stale items to re-verify each audit
|
|
|
|
- `deploy-plan.py`: `DANKSERVER_SERVICES` still lists the six *arr services (they live on FrankBook-Pro); maps `scripts/qwen-sharp-v22.4.0.jinja` (retired runtime) to frank-dragoon; has **no** rule for `scripts/qwen38-froggeric-v22.5.jinja`, the live frank-archon template — editing it deploys nothing.
|
|
- `test-changed.sh`: cases for `dankclaw/frank-dragoon/*`, `dankclaw/compose.yaml`, `dankserver/Caddyfile` match nothing.
|
|
- `AGENTS.md` runbook index lists frank-archon's **retired** runbook as active while the endpoint section names the current one; frank-archon's shape is written in three places in that file.
|
|
- `shared/homepage/dankserver.services.json`: zero references; `deploy_homepage` copies six named files and it is not one of them.
|
|
- `scripts/hf-fetch.sh`: superseded by `scripts/hfget.sh`, no callers.
|
|
- Undeclared shared networks: 15 units attach to `dankclaw_default`, 6 to `dankserver_appnet`; no `.network` file in the repo defines either.
|
|
- `dankserver/compose.yaml` defines six containers whose names are owned by quadlet units, with diverged volume paths; `deploy_compose_service` refuses to act on it and `compose_validity.bats` checks YAML shape only.
|
|
- `frank-zealot.service` `Restart=on-failure` violates the law `frank_archon_unit.bats` states (clean engine exit reads as success, so on-failure never fires); the zealot seam greps `^Restart=` and passes.
|
|
- `render_caddyfile` / `deploy_homepage` write fixed `/tmp` filenames as `dank`, then `run_privileged cp` them into root-owned paths.
|
|
|
|
## Report shape
|
|
|
|
Table the duplication with counts (occurrences + path:line), label DUE vs DIVERGENT-intentional, then a ranked priority table (lines removed / risk). Ground "saves RAM" claims in measured RSS — two postgres containers measured 37 MiB and 325 MiB, so the prize is the operational surface (unit, secret, health gate, deploy entry, backup), not memory.
|