dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(hermes,dns): document the new internal-only exposure surface

Browse Source 
Post-change doc reconciliation for the hermes vhosts + DNS deletion batch:

- Hermes-Dashboard.md: access is now the hermesadmin.franksdank.cloud vhost
  (direct Caddy proxy to 192.168.0.143:9119, no guard chain — exempt because the
  dashboard enforces its own basic-auth login), plus the raw LAN port. The old
  text claimed an Authentik-guarded public vhost, which was decommissioned.
- Hermes-WebUI.md: description updated — the webui is now also reachable via the
  unguarded hermes.franksdank.cloud vhost (its own password auth is the gate).
- LAN-DNS.md: "add a name in two places" corrected to a two-or-three-step
  decision; internal-only names (prometheus/loki/grafana/seerr) deliberately get
  no public A record and resolve on the LAN only, and DNS-01 issuance is
  unaffected because the challenge is a TXT record in the same zone.
- Seerr.md: DNS row corrected — addn-hosts only since 2026-09-02; NXDOMAIN on WAN.
- hermes-dashboard.container: unit comment no longer claims Authentik termination.

No behavior change in this commit; tests 233/233 green (docs-completeness seam included).
This commit is contained in:
Frank
2026-09-02 18:57:38 -07:00
parent 1e4daaa24a
commit 1e491fa69f
5 changed files with 38 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serverAppConfigs-docs/Dankclaw/Hermes-Dashboard.md
+14 -2
View File
@@ -2,7 +2,7 @@
The Hermes web dashboard is a browser UI for managing the agent. It shows config, API keys, and sessions. It is a management tool. It is not a chat window. Chat happens over Signal or the CLI. See [[Hermes]].
**Host:** Dankclaw — **Port:** `9119` — **URL:** `http://192.168.0.143:9119`
**Host:** Dankclaw — **Port:** `9119` (published) — **URL:** `https://hermesadmin.franksdank.cloud` (internal-only; direct Caddy proxy, no guard chain) or `http://192.168.0.143:9119`
## Facts
@@ -47,7 +47,19 @@ The dashboard refuses to bind to a non-loopback address without an auth provider
## Access
Open `http://192.168.0.143:9119` in a browser on the LAN. Log in with the configured username and password.
Two paths reach the same process, both gated by the dashboard's own basic-auth
login — there is no unauthenticated bind:
1. **`https://hermesadmin.franksdank.cloud`** — Caddy vhost added 2026-09-02 that
reverse-proxies `192.168.0.143:9119` directly, with **no** Anubis/Outpost guard
chain in front of it (exempt-by-construction: the app carries its own complete
auth). The name deliberately has no public DNS record, so the vhost resolves on
the LAN only; WAN clients get NXDOMAIN. See [[LAN DNS]].
2. **`http://192.168.0.143:9119`** — the raw published port. Still reachable from
any LAN host (the container binds `0.0.0.0` inside its namespace and publishes
`9119:9119`), so treat the LAN as a trusted boundary here, not as a gate.
See [[Container Network Namespaces]] for why this container is on a bridge
network rather than the host namespace like its two siblings.
## Gotchas
serverAppConfigs-docs/Dankclaw/Hermes-WebUI.md
+1 -1
View File
@@ -1,7 +1,7 @@
---
type: configuration
title: Hermes-WebUI (Hermex server)
description: The hermes-webui container on Dankclaw — the API server that the Hermex iPhone app talks to, reachable over an SSH tunnel and, because it binds all interfaces, from the whole LAN.
description: The hermes-webui container on Dankclaw — the API server that the Hermex iPhone app talks to, reachable over an SSH tunnel, from the whole LAN (it binds all interfaces), and from https://hermes.franksdank.cloud (internal-only vhost).
tags:
- hermes
- hermes-webui
serverAppConfigs-docs/Dankclaw/Seerr.md
+1 -1
View File
@@ -14,7 +14,7 @@ Seerr is the unified request manager for the *arr stack (the maintained `seerr-t
| Unit | `dankclaw/seerr/quadlet/seerr.container` → `seerr.service` |
| Network | `dankclaw_default` (post-auth listener reachability) |
| Guard | Caddy TLS edge → Anubis :8923 → Authentik outpost provider `seerr-proxy` → Caddy :8017 `@seerr` handler → `seerr:5055` |
| DNS | Pi-hole addn-hosts + Porkbun public A `seerr.franksdank.cloud → 192.168.0.143` |
| DNS | Pi-hole addn-hosts only. The public Porkbun A record was deleted on 2026-09-02, so the name resolves on the LAN (→ 192.168.0.143) and returns NXDOMAIN on the WAN: Seerr is internal-only by construction |
## Why loopback-only publishing