docs(vault): destroy the dead weight — 53 pages and the change diary
The vault was 155 pages / 31,210 lines, most of it measurement ledgers for payloads that no longer run. A throughput figure for a runtime nobody operates is not a record: AI moves faster than the vault, so the number is wrong before anyone reads it, and a wrong number in a runbook gets believed. Per the new purpose test in `AGENTS.md` → *Documentation Policy*, it is destroyed. Gone (`.AGENTTRASH/20261019-destruction/`, KILL-LIST.txt is the manifest): - the `frank-medium` endpoint and its five era pages, `frank-npu`, FastFlowLM, the ikllama/kingjones/dealign/frank-redo eras, the ling/swift15/freetoken/ubatch campaign pages, qwen3.8 spec-matrix and strix-optimizations, the two "Running Qwen3.6 …" pages; - the whole `Pipeline Parallelism/` folder (no live script passes a pipeline flag) and the multi-device/x4-pair/hybrid/offload experiment pages; - every vLLM page — no vLLM endpoint exists on this fleet; - `LLM/deployment.md` (`Architecture/Deployment Flow.md` is the test-referenced owner) and the external surveys (SGLang, Lemonade, llama.cpp forks/diff, self-hosted app census, the TTS survey) that were obsolete by construction; - `log.md`, 2,380 lines. Git holds the chronology; a causal law belongs to the page that owns the thing it governs, never to a diary. Survivors: 101 pages, 17,542 lines, 0 OKF violations, 0 unresolved links. Eras tables keep the window, payload, runtime, reason and rollback pointer; the rate columns are blanked. The live shapes stay verbatim — those numbers are what the deployer and `models.yml` consume.
This commit is contained in:
Frank
@@ -80,7 +80,7 @@ image's own nginx (the desktop), so the content server runs on internal 8090.
|
||||
**Auth model (calibre 9.x):** users live in a SQLite userdb whose `pw` column
|
||||
is **plaintext** — the file is mode 600. The single admin account is
|
||||
bootstrapped once by the deploy handler
|
||||
(`deploy_calibre_server` in `scripts/deploy-remote.sh`) via
|
||||
(`deploy_calibre_server` in `scripts/deploy-remote.sh`)
|
||||
`calibre-server --manage-users -- add`, the password piped on stdin with
|
||||
`printf` (a trailing newline from `echo` lands in the stored password and
|
||||
breaks every login). The desktop's basic auth (`CUSTOM_USER`/`CUSTOM_PASSWORD`)
|
||||
|
||||
@@ -83,7 +83,7 @@ The `iv` edition is no longer available for arm32/armv6. Use `dj` for maximum co
|
||||
|
||||
## Volumes
|
||||
|
||||
Live deployment: the whole LUKS array is served at URL `/w` via
|
||||
Live deployment: the whole LUKS array is served at URL `/w`
|
||||
`Volume=/mnt/entropy:/w:ro` in the quadlet unit ([[Entropy Volume]]) —
|
||||
read-only **at the mount level**, so no containerized consumer can write into
|
||||
the array through this path regardless of account permissions. The ac edition
|
||||
@@ -111,7 +111,7 @@ convention; see [[#Command-line interface (ac edition)]] above.
|
||||
```
|
||||
|
||||
`${COPAY_ACCOUNT}`/`${COPAY_PASSWORD}` are **never** written into the unit:
|
||||
they live in the host-local `/home/dank/Containers/copyparty/env` (0600),
|
||||
they live in the host-local `/home/dank/Containers/copyparty/env` (0600)
|
||||
loaded via `[Service] EnvironmentFile=` so systemd expands them into
|
||||
`Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD}` at start. The password still
|
||||
lands in the container argv — visible to anyone who can run
|
||||
@@ -178,6 +178,6 @@ Upgrade to v1.20.19+ to cover all known advisories. The dirkey fix (v1.20.17) ma
|
||||
## Citations
|
||||
|
||||
- GitHub Security Advisories, `9001/copyparty` —
|
||||
https://github.com/9001/copyparty/security/advisories (accessed 2026-10-19);
|
||||
https://github.com/9001/copyparty/security/advisories (accessed 2026-10-19)
|
||||
each row's patched version read from `first_patched_version` in the
|
||||
`https://api.github.com/advisories/<GHSA-id>` response.
|
||||
|
||||
@@ -54,5 +54,5 @@ The following services ran on Dankserver and are now retired from this stack:
|
||||
|
||||
## See Also
|
||||
|
||||
- [[index]] — repository index
|
||||
- repository index
|
||||
- [[Network Architecture]] — routing and proxy
|
||||
|
||||
@@ -14,7 +14,7 @@ serving music, movies, and shows over LAN. It replaced the earlier research
|
||||
brief; it runs alongside [[Plex]], which remains the primary server for some
|
||||
clients.
|
||||
|
||||
**Host:** Dankserver (192.168.0.235) — **Access:** `http://192.168.0.235:8096`,
|
||||
**Host:** Dankserver (192.168.0.235) — **Access:** `http://192.168.0.235:8096`
|
||||
public vhost `jelly.franksdank.cloud` behind the [[Anubis]] guard chain →
|
||||
[[Authentik]] outpost (post-auth route proxies `localhost:8096`).
|
||||
|
||||
@@ -67,7 +67,7 @@ user to verify the password.
|
||||
- LDAP provider `Jellyfin LDAP` (Base DN `dc=franksdank,dc=cloud`, bind/search
|
||||
mode `direct`) + application `Jellyfin`.
|
||||
- LDAP outpost `Jellyfin LDAP Outpost` → container `authentik-outpost-ldap`
|
||||
(quadlet `dankclaw/authentik/quadlet/authentik-outpost-ldap.container`),
|
||||
(quadlet `dankclaw/authentik/quadlet/authentik-outpost-ldap.container`)
|
||||
publishing `389`/`636` on the Dankclaw host for cross-host binds.
|
||||
- Service account `svc-jellyfin-ldap` (DN
|
||||
`cn=svc-jellyfin-ldap,ou=users,dc=franksdank,dc=cloud`).
|
||||
@@ -80,7 +80,7 @@ user to verify the password.
|
||||
**Jellyfin side** (plugin config, set via admin → Plugins → LDAP-Auth):
|
||||
- Server `192.168.0.143:389` (plain LDAP over the trusted LAN), Base DN
|
||||
`dc=franksdank,dc=cloud`, bind user = the service-account DN, search
|
||||
attributes `uid,cn,mail,displayName`, uid attr `uid`, username attr `cn`,
|
||||
attributes `uid,cn,mail,displayName`, uid attr `uid`, username attr `cn`
|
||||
`CreateUsersFromLdap=true`, all folders enabled.
|
||||
|
||||
**Gotcha — the bind credential is a PASSWORD, not a token.** The LDAP bind is
|
||||
|
||||
@@ -60,7 +60,7 @@ root runs as the `dank` user, and the deployer adopts the data root with
|
||||
## Integration points
|
||||
|
||||
- **Caddy:** Plex is exempt from the Anubis bot challenge
|
||||
(plain-HTTP legacy clients cannot solve JS challenges) — see
|
||||
(plain-HTTP legacy clients cannot solve JS challenges) —
|
||||
[[Anubis]] "Exempt by construction".
|
||||
- **Tautulli** ([[Tautulli]]) is the companion: it polls PMS on the appnet
|
||||
for statistics and notifications and makes no sense without Plex.
|
||||
|
||||
@@ -32,7 +32,7 @@ Anubis → Authentik chain ([[Caddy]] routes it post-auth to
|
||||
## Architecture
|
||||
|
||||
Current RomM releases require MariaDB plus Redis (or Valkey) for the task
|
||||
queue; this deployment runs **redis** (`REDIS_HOST=redis` in the live unit),
|
||||
queue; this deployment runs **redis** (`REDIS_HOST=redis` in the live unit)
|
||||
not valkey.
|
||||
|
||||
```mermaid
|
||||
@@ -114,7 +114,7 @@ scan:
|
||||
## Deployment (Quadlet)
|
||||
|
||||
Since 2026-09-01 the trio runs as repo-tracked quadlet units, deployed with
|
||||
`./scripts/deploy.sh dankserver --service romm` (any of `romm`,
|
||||
`./scripts/deploy.sh dankserver --service romm` (any of `romm`
|
||||
`romm-mariadb`, `romm-redis` triggers the full ordered cutover):
|
||||
|
||||
- Units: `dankserver/romm/quadlet/{romm,romm-mariadb,romm-redis}.container`
|
||||
|
||||
Reference in New Issue
Block a user