feat(exposure): sonarr to admin side, internal-only by construction
Flip the homepage Sonarr card from the user category to admin and repoint its link at the LAN-direct port (192.168.0.112:8989). Retire the unguarded public vhost sonarr.franksdank.cloud (direct reverse_proxy, no auth) and its post-auth @sonarr handler from the Caddyfile; drop the Pi-hole addn-hosts A record with it. No public Porkbun record ever existed (NXDOMAIN at the zone), so after this there is no WAN path to Sonarr: users request TV via Seerr (guarded), admins reach Sonarr's own UI from the LAN only. Fixes the seerr/sonarr mix-up from 19b2589/e0bade6.
This commit is contained in:
Frank
+6
-8
@@ -248,9 +248,12 @@ radarr.franksdank.cloud {
|
||||
reverse_proxy 192.168.0.112:7878
|
||||
}
|
||||
|
||||
sonarr.franksdank.cloud {
|
||||
reverse_proxy 192.168.0.112:8989
|
||||
}
|
||||
# --- Sonarr: internal-only by construction (retired 2026-09-04) -----------
|
||||
# No vhost and no public DNS record for sonarr.franksdank.cloud: the TV-library
|
||||
# admin UI is reachable only on the LAN at 192.168.0.112:8989 (users request TV
|
||||
# through Seerr, which sits behind the guard chain; admins reach Sonarr's own
|
||||
# UI directly). A brief unguarded public vhost lived here and served the
|
||||
# zero-auth UI to the internet via manual DNS — retired.
|
||||
|
||||
lidarr.franksdank.cloud {
|
||||
reverse_proxy 192.168.0.112:8686
|
||||
@@ -362,11 +365,6 @@ http://:8017 {
|
||||
reverse_proxy 192.168.0.112:7878
|
||||
}
|
||||
|
||||
@sonarr host sonarr.franksdank.cloud
|
||||
handle @sonarr {
|
||||
reverse_proxy 192.168.0.112:8989
|
||||
}
|
||||
|
||||
@lidarr host lidarr.franksdank.cloud
|
||||
handle @lidarr {
|
||||
reverse_proxy 192.168.0.112:8686
|
||||
|
||||
@@ -27,7 +27,6 @@
|
||||
192.168.0.143 files.franksdank.cloud
|
||||
192.168.0.143 jelly.franksdank.cloud
|
||||
192.168.0.143 radarr.franksdank.cloud
|
||||
192.168.0.143 sonarr.franksdank.cloud
|
||||
192.168.0.143 lidarr.franksdank.cloud
|
||||
192.168.0.143 readarr.franksdank.cloud
|
||||
192.168.0.143 prowlarr.franksdank.cloud
|
||||
|
||||
@@ -87,10 +87,13 @@ Dankserver (recoverable until purged).
|
||||
|
||||
No *arr app sits behind the Anubis guard chain — the stack is exempt by
|
||||
construction (its own auth), with an exemption comment in the Caddyfile per
|
||||
vhost. Six TLS vhosts (`<svc>.franksdank.cloud`) terminate on Caddy on
|
||||
vhost. Five TLS vhosts (`<svc>.franksdank.cloud`) terminate on Caddy on
|
||||
Dankclaw and route to FrankBook-Pro's published ports
|
||||
(`192.168.0.112:<port>`, all exposed by the gluetun unit since the netns
|
||||
consolidation); the same ports are reachable directly on the LAN.
|
||||
consolidation); the same ports are reachable directly on the LAN. Sonarr is
|
||||
the exception: internal-only by construction — no vhost, no public DNS record;
|
||||
admins reach it at `http://192.168.0.112:8989` from the LAN only (retired
|
||||
2026-09-04; users request TV through [[Seerr]] instead).
|
||||
|
||||
Auth-config history (verified live 2026-08-29): all five arrs shipped with
|
||||
`AuthenticationMethod=None` **plus** `AuthenticationRequired=Enabled`. On the
|
||||
@@ -105,7 +108,8 @@ containers restarted, all five verified serving. Posture = zero-auth arrs on
|
||||
LAN and WAN; the Anubis wall guards homepage/search/hermes/prometheus/romm/files
|
||||
but **not** the arrs — first-account-wins is the current race condition if that
|
||||
ever flips to `External` auth (needs an IdP first; auth method choice remains an
|
||||
operator decision).
|
||||
operator decision). Sonarr is exempt from even that exposure since 2026-09-04:
|
||||
with no vhost and no public DNS record, its zero-auth UI has no WAN path at all.
|
||||
|
||||
## Chain wiring (verified live 2026-08-30)
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@ type: reference
|
||||
title: Sonarr
|
||||
description: Sonarr TV manager in the *arr stack on FrankBook-Pro — live quadlet deployment, ports, volumes, and wiring facts.
|
||||
tags: [sonarr, arr-stack, frankbook-pro]
|
||||
timestamp: 2026-09-03T00:00:00Z
|
||||
timestamp: 2026-09-04T00:00:00Z
|
||||
---
|
||||
|
||||
# Sonarr
|
||||
@@ -13,7 +13,11 @@ Sonarr manages TV shows in the *arr stack. The stack runs on **FrankBook-Pro**
|
||||
It searches, downloads, and organizes episodes from indexers into the Jellyfin
|
||||
TV library.
|
||||
|
||||
**Host:** FrankBook-Pro (podman machine) — **Access:** direct port `8989` (no reverse-proxy vhost; the *arr stack is exempt by construction from the Anubis guard chain) — **Docs:** https://wiki.servarr.com/sonarr
|
||||
**Host:** FrankBook-Pro (podman machine) — **Access:** LAN-direct only at
|
||||
`http://192.168.0.112:8989` — no vhost and no public DNS record by construction
|
||||
(the brief unguarded `sonarr.franksdank.cloud` vhost was retired 2026-09-04;
|
||||
users request TV via [[Seerr]], admins use this UI from the LAN) —
|
||||
**Docs:** https://wiki.servarr.com/sonarr
|
||||
|
||||
## Facts
|
||||
|
||||
|
||||
@@ -389,3 +389,18 @@ timestamp: 2026-09-14
|
||||
- `/frankbook-pro/qbittorrent/quadlet/qbittorrent.container` — pinned `lscr.io/linuxserver/qbittorrent:4.6.7`: `latest` had resolved to qB 5.x, whose `204` empty-body login success Readarr's retired client rejects as "Authentication failure" at runtime (not just in API creates — the prior session's "runtime cookie auth unaffected" assumption was wrong); 4.6.7 answers the legacy `200` + `"Ok."`. Gotcha: after 5.x ran, its conf rewrite left a PBKDF2 line 4.6.7 rejects — every login `invalid credentials`; rewriting the same line fresh (same password, 100k iterations) fixed it.
|
||||
- `/docs/Infrastructure/FrankBook-Pro.md` — wiring, pin rationale, PBKDF2 version-flip gotcha, and E2E result (test torrent through the Panama tunnel at ~17 MB/s, INCOMPLETE → COMPLETE into `Finished Torrents`, deleted with data).
|
||||
- `/scripts/deploy.sh` + `/scripts/deploy-plan.py` + `/tests/dankserver_quadlet.bats` — committed earlier today (`b206f47`): dankserver quadlet standardization units/handlers/routing.
|
||||
|
||||
## 2026-09-04 — Sonarr moved to the admin side; internal-only by construction
|
||||
- Operator directive (fixing an earlier seerr/sonarr mix-up): Sonarr is an
|
||||
**admin-side** service and must be locally reachable only. The homepage
|
||||
registry flipped its card from the user category to **admin** and repointed
|
||||
the link at `http://192.168.0.112:8989` (LAN-direct). Users keep requesting
|
||||
TV through Seerr, which stays on the user side behind the guard chain.
|
||||
- Exposure closure: the unguarded public vhost `sonarr.franksdank.cloud`
|
||||
(direct `reverse_proxy 192.168.0.112:8989`, no auth) and its post-auth
|
||||
`@sonarr` handler were retired from the Caddyfile; the Pi-hole addn-hosts A
|
||||
record for the name was dropped with it. No public Porkbun record ever
|
||||
existed (NXDOMAIN at the authoritative zone), so after this change there is
|
||||
no WAN path to Sonarr at all — manual DNS could previously reach the vhost,
|
||||
which served the zero-auth UI to anyone who resolved the name manually at
|
||||
the public edge; the vhost (added in `e0bade6`, 2026-09-04) is retired.
|
||||
|
||||
@@ -100,9 +100,9 @@
|
||||
},
|
||||
{
|
||||
"name": "Sonarr",
|
||||
"category": "user",
|
||||
"category": "admin",
|
||||
"description": "TV series library and automation.",
|
||||
"url": "http://sonarr.franksdank.cloud",
|
||||
"url": "http://192.168.0.112:8989",
|
||||
"docs": "",
|
||||
"probe": "192.168.0.112:8989",
|
||||
"method": "http",
|
||||
|
||||
Reference in New Issue
Block a user