From 2d06be876fde12c212528b904ce495f1ab20bf1f Mon Sep 17 00:00:00 2001 From: Frank Date: Tue, 1 Sep 2026 15:53:13 -0700 Subject: [PATCH] docs: correct Jellyfin admin-password claim (archive OCR corruption); prepare Mac WG peer --- serverAppConfigs-docs/Dankserver/Jellyfin.md | 8 +++-- .../Infrastructure/FrankBook-Pro.md | 34 +++++++++++++++++++ serverAppConfigs-docs/log.md | 5 +-- 3 files changed, 42 insertions(+), 5 deletions(-) diff --git a/serverAppConfigs-docs/Dankserver/Jellyfin.md b/serverAppConfigs-docs/Dankserver/Jellyfin.md index 3b15794..525ee9e 100644 --- a/serverAppConfigs-docs/Dankserver/Jellyfin.md +++ b/serverAppConfigs-docs/Dankserver/Jellyfin.md @@ -102,9 +102,11 @@ cgroup regardless of `GroupAdd=keep-groups`. ## Authentication - **Built-in auth:** per-user libraries, parental controls, max bitrate - limits. The local `dank` admin account is built-in and its password is - Frank's — never recorded in this repo (the bootstrap-era value no longer - authenticates on the live database). + limits. The local `dank` admin account is built-in; its password is + Frank's bootstrap value — never recorded in this repo. (2026-09-01: a + corrupted session-archive reading briefly suggested the password had + changed; verified offline against the stored PBKDF2-SHA512 hash, the + bootstrap value still authenticates.) - **LDAP via Authentik (live 2026-09-01):** the LDAP-Auth plugin authenticates users against the authentik LDAP outpost on Dankclaw — see [[Authentik]] for the outpost unit, provider, and RBAC objects. diff --git a/serverAppConfigs-docs/Infrastructure/FrankBook-Pro.md b/serverAppConfigs-docs/Infrastructure/FrankBook-Pro.md index 41f7c7a..e592c37 100644 --- a/serverAppConfigs-docs/Infrastructure/FrankBook-Pro.md +++ b/serverAppConfigs-docs/Infrastructure/FrankBook-Pro.md @@ -31,6 +31,40 @@ kill SearXNG), `deploy_frankbook_stack` **skips** gluetun and qbittorrent with instructions and deploys the five arrs anyway. The qB WebUI port stays unpublished by design; the e2e torrent test waits on the credentials. +### Prepared Mac peer (2026-09-01 — waiting on server-side add) + +A dedicated keypair is generated and parked on Dankclaw +(`~/frankbook-wg/mac-private.key`, 0600, host-local — never in the repo). +Lighting the tunnel needs exactly one change on the WireGuard server +(149.102.254.77): register a new peer for the Mac — different keypair from +Dankclaw's (one key cannot serve two machines; the server bounces the +endpoint between them), same endpoint and server key: + +- Server pubkey (route target): `utqNH4P+C0fA1wTgIUaIfhm1b7ai0iEGvXyiw4KC3Fs=` +- Endpoint: `149.102.254.77:51820` (`VPN_SERVICE_PROVIDER=custom`) +- Mac public key to register as the new peer: + `QIoCwI+9VuiWldRvUfPpTfXq7UVVBFynIqYb2vqHtQo=` +- Allocate the Mac a fresh tunnel IP as the peer's allowed IP — Dankclaw + holds `10.2.0.2/32`, so likely `10.2.0.3/32` unless the server numbers + differently. + +Then `/home/core/Containers/gluetun/env` (0600) inside the VM: + + VPN_SERVICE_PROVIDER=custom + VPN_TYPE=wireguard + WIREGUARD_PRIVATE_KEY= + WIREGUARD_ADDRESSES=/32 + WIREGUARD_PUBLIC_KEY=utqNH4P+C0fA1wTgIUaIfhm1b7ai0iEGvXyiw4KC3Fs= + WIREGUARD_ENDPOINT_IP=149.102.254.77 + WIREGUARD_ENDPOINT_PORT=51820 + WIREGUARD_ALLOWED_IPS=0.0.0.0/0,::/0 + WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=25s + +Deploy with `./scripts/deploy.sh frankbook-pro --service gluetun --service +qbittorrent`, then verify egress from the VM (`podman exec gluetun curl -s +ifconfig.me` must NOT show the residential IP) before declaring the +BitTorrent port usable. + ## Deploy flow Same deployer as every host: `./scripts/deploy.sh frankbook-pro --service diff --git a/serverAppConfigs-docs/log.md b/serverAppConfigs-docs/log.md index a91f275..82e97c9 100644 --- a/serverAppConfigs-docs/log.md +++ b/serverAppConfigs-docs/log.md @@ -45,8 +45,9 @@ timestamp: 2026-09-14 End-to-end verified with a throwaway `jellyfin_users` member (`AuthenticateByName` 200, non-admin policy), then removed from both authentik and the Jellyfin DB directly (its admin-token cleanup 401'd — - the local `dank` admin password on the live DB is Frank's, not the - bootstrap-era value; notated in the Jellyfin doc). + the admin password in the session archive was OCR-corrupted; verified + offline against the stored PBKDF2-SHA512 hash that the real bootstrap + value still authenticates, unchanged). - Docs: [[Authentik]] gained the LDAP-outpost section (objects table + rules), [[Jellyfin]] gained the LDAP-Auth plugin section. Docs-only commit → deploy no-op.