docs: correct Jellyfin admin-password claim (archive OCR corruption); prepare Mac WG peer

2026-09-01 15:53:13 -07:00
parent 6a67a9067f
commit 2d06be876f
3 changed files with 42 additions and 5 deletions
@@ -31,6 +31,40 @@ kill SearXNG), `deploy_frankbook_stack` **skips** gluetun and qbittorrent
 with instructions and deploys the five arrs anyway. The qB WebUI port stays
 unpublished by design; the e2e torrent test waits on the credentials.

+### Prepared Mac peer (2026-09-01 — waiting on server-side add)
+
+A dedicated keypair is generated and parked on Dankclaw
+(`~/frankbook-wg/mac-private.key`, 0600, host-local — never in the repo).
+Lighting the tunnel needs exactly one change on the WireGuard server
+(149.102.254.77): register a new peer for the Mac — different keypair from
+Dankclaw's (one key cannot serve two machines; the server bounces the
+endpoint between them), same endpoint and server key:
+
+- Server pubkey (route target): `utqNH4P+C0fA1wTgIUaIfhm1b7ai0iEGvXyiw4KC3Fs=`
+- Endpoint: `149.102.254.77:51820` (`VPN_SERVICE_PROVIDER=custom`)
+- Mac public key to register as the new peer:
+  `QIoCwI+9VuiWldRvUfPpTfXq7UVVBFynIqYb2vqHtQo=`
+- Allocate the Mac a fresh tunnel IP as the peer's allowed IP — Dankclaw
+  holds `10.2.0.2/32`, so likely `10.2.0.3/32` unless the server numbers
+  differently.
+
+Then `/home/core/Containers/gluetun/env` (0600) inside the VM:
+
+    VPN_SERVICE_PROVIDER=custom
+    VPN_TYPE=wireguard
+    WIREGUARD_PRIVATE_KEY=<raw b64 private key — fetch from dankclaw:~/frankbook-wg/mac-private.key>
+    WIREGUARD_ADDRESSES=<allocated tunnel IP>/32
+    WIREGUARD_PUBLIC_KEY=utqNH4P+C0fA1wTgIUaIfhm1b7ai0iEGvXyiw4KC3Fs=
+    WIREGUARD_ENDPOINT_IP=149.102.254.77
+    WIREGUARD_ENDPOINT_PORT=51820
+    WIREGUARD_ALLOWED_IPS=0.0.0.0/0,::/0
+    WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=25s
+
+Deploy with `./scripts/deploy.sh frankbook-pro --service gluetun --service
+qbittorrent`, then verify egress from the VM (`podman exec gluetun curl -s
+ifconfig.me` must NOT show the residential IP) before declaring the
+BitTorrent port usable.
+
 ## Deploy flow

 Same deployer as every host: `./scripts/deploy.sh frankbook-pro --service