Frank
9bfa0be85d
- 31 new managed skills (anubis/arr/authentik/hermes/freetoken/podman/llm-swap runbooks etc.) now tracked. - Removed superseded skills: omp_harness_config, peon_ping_integration (replaced by user-authored peon-ping-* managed skills), rocmfp4-strix-benchmark-orchestration. - New memory-root skills: niri_compositor_ops, omp_git_workflow, omp_model_config, quadlet-media-migration, homelab-service-triage, hermes-dankclaw-ops, frank-default-large-ops, caddy-auth-dns-playbook.
21 lines
1.7 KiB
Markdown
21 lines
1.7 KiB
Markdown
---
|
|
name: arr-auth-posture-probe
|
|
description: "Verify a self-hosted *arr-style service's real auth posture by behavioral API probes instead of config-flag inference; includes the sed-masks-a-miss pitfall and wrong-host probe pitfall"
|
|
---
|
|
|
|
# Arr-auth posture probe
|
|
|
|
Ground truth for "is this arr/gate open?" comes from behavior, not config flags. `AuthenticationMethod=None` + `AuthenticationRequired=Enabled` in `config.xml` is ambiguous on paper; on the wire it means a login screen with **zero users** — first-account-wins.
|
|
|
|
## Recipe
|
|
1. Confirm which host runs the service before probing (`podman ps` on the target, not the box you ssh'd into first — arrs live on Dankserver, chat/searxng on Dankclaw).
|
|
2. Probe an API endpoint that bypasses the SPA shell, locally and through the vhost:
|
|
`curl -s -o /dev/null -w "%{http_code}" http://<host>:<port>/api/v3/system/status`
|
|
- SPA roots (`/`) always serve a 200 shell — never conclude "open" or "gated" from `/`.
|
|
- 401 = gated; 200 + JSON = API fully open (anyone on the net can drive it with curl).
|
|
3. For config truth, dump the whole file (`podman exec <svc> cat /config/config.xml`), not a piped `grep | sed -n 2p`: **`sed -n Np` exits 0 on zero matches**, so the pipeline hides a miss and you conclude "empty field" when the grep itself failed.
|
|
4. API keys from config.xml are local-only secrets; they stop being secret the moment a vhost serves the API unauthenticated.
|
|
|
|
## Decision framing for the user
|
|
When posture = gated-with-zero-users, present it as a decision menu (None behind the front-door wall vs External/authentikarr), not a silent change — first-account-wins means whoever logs in first owns the instance.
|