From 32b4016e551a71cc39f73f892262f7bd93d1d8cf Mon Sep 17 00:00:00 2001 From: Frank Date: Fri, 4 Sep 2026 18:34:02 -0700 Subject: [PATCH] feat(exposure): sonarr to admin side, internal-only by construction Flip the homepage Sonarr card from the user category to admin and repoint its link at the LAN-direct port (192.168.0.112:8989). Retire the unguarded public vhost sonarr.franksdank.cloud (direct reverse_proxy, no auth) and its post-auth @sonarr handler from the Caddyfile; drop the Pi-hole addn-hosts A record with it. No public Porkbun record ever existed (NXDOMAIN at the zone), so after this there is no WAN path to Sonarr: users request TV via Seerr (guarded), admins reach Sonarr's own UI from the LAN only. Fixes the seerr/sonarr mix-up from 19b2589/e0bade6. --- dankclaw/Caddyfile | 14 ++++++-------- dankclaw/pihole/addn-hosts | 1 - serverAppConfigs-docs/Dankserver/ARR-Stack.md | 10 +++++++--- serverAppConfigs-docs/Dankserver/sonarr.md | 8 ++++++-- serverAppConfigs-docs/log.md | 15 +++++++++++++++ shared/homepage/services.json | 4 ++-- 6 files changed, 36 insertions(+), 16 deletions(-) diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile index f910d5c..7e9e4a6 100644 --- a/dankclaw/Caddyfile +++ b/dankclaw/Caddyfile @@ -248,9 +248,12 @@ radarr.franksdank.cloud { reverse_proxy 192.168.0.112:7878 } -sonarr.franksdank.cloud { - reverse_proxy 192.168.0.112:8989 -} +# --- Sonarr: internal-only by construction (retired 2026-09-04) ----------- +# No vhost and no public DNS record for sonarr.franksdank.cloud: the TV-library +# admin UI is reachable only on the LAN at 192.168.0.112:8989 (users request TV +# through Seerr, which sits behind the guard chain; admins reach Sonarr's own +# UI directly). A brief unguarded public vhost lived here and served the +# zero-auth UI to the internet via manual DNS — retired. lidarr.franksdank.cloud { reverse_proxy 192.168.0.112:8686 @@ -362,11 +365,6 @@ http://:8017 { reverse_proxy 192.168.0.112:7878 } - @sonarr host sonarr.franksdank.cloud - handle @sonarr { - reverse_proxy 192.168.0.112:8989 - } - @lidarr host lidarr.franksdank.cloud handle @lidarr { reverse_proxy 192.168.0.112:8686 diff --git a/dankclaw/pihole/addn-hosts b/dankclaw/pihole/addn-hosts index 191a751..d2902c7 100644 --- a/dankclaw/pihole/addn-hosts +++ b/dankclaw/pihole/addn-hosts @@ -27,7 +27,6 @@ 192.168.0.143 files.franksdank.cloud 192.168.0.143 jelly.franksdank.cloud 192.168.0.143 radarr.franksdank.cloud -192.168.0.143 sonarr.franksdank.cloud 192.168.0.143 lidarr.franksdank.cloud 192.168.0.143 readarr.franksdank.cloud 192.168.0.143 prowlarr.franksdank.cloud diff --git a/serverAppConfigs-docs/Dankserver/ARR-Stack.md b/serverAppConfigs-docs/Dankserver/ARR-Stack.md index 8ff1931..d74b98b 100644 --- a/serverAppConfigs-docs/Dankserver/ARR-Stack.md +++ b/serverAppConfigs-docs/Dankserver/ARR-Stack.md @@ -87,10 +87,13 @@ Dankserver (recoverable until purged). No *arr app sits behind the Anubis guard chain — the stack is exempt by construction (its own auth), with an exemption comment in the Caddyfile per -vhost. Six TLS vhosts (`.franksdank.cloud`) terminate on Caddy on +vhost. Five TLS vhosts (`.franksdank.cloud`) terminate on Caddy on Dankclaw and route to FrankBook-Pro's published ports (`192.168.0.112:`, all exposed by the gluetun unit since the netns -consolidation); the same ports are reachable directly on the LAN. +consolidation); the same ports are reachable directly on the LAN. Sonarr is +the exception: internal-only by construction — no vhost, no public DNS record; +admins reach it at `http://192.168.0.112:8989` from the LAN only (retired +2026-09-04; users request TV through [[Seerr]] instead). Auth-config history (verified live 2026-08-29): all five arrs shipped with `AuthenticationMethod=None` **plus** `AuthenticationRequired=Enabled`. On the @@ -105,7 +108,8 @@ containers restarted, all five verified serving. Posture = zero-auth arrs on LAN and WAN; the Anubis wall guards homepage/search/hermes/prometheus/romm/files but **not** the arrs — first-account-wins is the current race condition if that ever flips to `External` auth (needs an IdP first; auth method choice remains an -operator decision). +operator decision). Sonarr is exempt from even that exposure since 2026-09-04: +with no vhost and no public DNS record, its zero-auth UI has no WAN path at all. ## Chain wiring (verified live 2026-08-30) diff --git a/serverAppConfigs-docs/Dankserver/sonarr.md b/serverAppConfigs-docs/Dankserver/sonarr.md index 5bdf482..4277827 100644 --- a/serverAppConfigs-docs/Dankserver/sonarr.md +++ b/serverAppConfigs-docs/Dankserver/sonarr.md @@ -3,7 +3,7 @@ type: reference title: Sonarr description: Sonarr TV manager in the *arr stack on FrankBook-Pro — live quadlet deployment, ports, volumes, and wiring facts. tags: [sonarr, arr-stack, frankbook-pro] -timestamp: 2026-09-03T00:00:00Z +timestamp: 2026-09-04T00:00:00Z --- # Sonarr @@ -13,7 +13,11 @@ Sonarr manages TV shows in the *arr stack. The stack runs on **FrankBook-Pro** It searches, downloads, and organizes episodes from indexers into the Jellyfin TV library. -**Host:** FrankBook-Pro (podman machine) — **Access:** direct port `8989` (no reverse-proxy vhost; the *arr stack is exempt by construction from the Anubis guard chain) — **Docs:** https://wiki.servarr.com/sonarr +**Host:** FrankBook-Pro (podman machine) — **Access:** LAN-direct only at +`http://192.168.0.112:8989` — no vhost and no public DNS record by construction +(the brief unguarded `sonarr.franksdank.cloud` vhost was retired 2026-09-04; +users request TV via [[Seerr]], admins use this UI from the LAN) — +**Docs:** https://wiki.servarr.com/sonarr ## Facts diff --git a/serverAppConfigs-docs/log.md b/serverAppConfigs-docs/log.md index f850316..2d0d1bf 100644 --- a/serverAppConfigs-docs/log.md +++ b/serverAppConfigs-docs/log.md @@ -389,3 +389,18 @@ timestamp: 2026-09-14 - `/frankbook-pro/qbittorrent/quadlet/qbittorrent.container` — pinned `lscr.io/linuxserver/qbittorrent:4.6.7`: `latest` had resolved to qB 5.x, whose `204` empty-body login success Readarr's retired client rejects as "Authentication failure" at runtime (not just in API creates — the prior session's "runtime cookie auth unaffected" assumption was wrong); 4.6.7 answers the legacy `200` + `"Ok."`. Gotcha: after 5.x ran, its conf rewrite left a PBKDF2 line 4.6.7 rejects — every login `invalid credentials`; rewriting the same line fresh (same password, 100k iterations) fixed it. - `/docs/Infrastructure/FrankBook-Pro.md` — wiring, pin rationale, PBKDF2 version-flip gotcha, and E2E result (test torrent through the Panama tunnel at ~17 MB/s, INCOMPLETE → COMPLETE into `Finished Torrents`, deleted with data). - `/scripts/deploy.sh` + `/scripts/deploy-plan.py` + `/tests/dankserver_quadlet.bats` — committed earlier today (`b206f47`): dankserver quadlet standardization units/handlers/routing. + +## 2026-09-04 — Sonarr moved to the admin side; internal-only by construction +- Operator directive (fixing an earlier seerr/sonarr mix-up): Sonarr is an + **admin-side** service and must be locally reachable only. The homepage + registry flipped its card from the user category to **admin** and repointed + the link at `http://192.168.0.112:8989` (LAN-direct). Users keep requesting + TV through Seerr, which stays on the user side behind the guard chain. +- Exposure closure: the unguarded public vhost `sonarr.franksdank.cloud` + (direct `reverse_proxy 192.168.0.112:8989`, no auth) and its post-auth + `@sonarr` handler were retired from the Caddyfile; the Pi-hole addn-hosts A + record for the name was dropped with it. No public Porkbun record ever + existed (NXDOMAIN at the authoritative zone), so after this change there is + no WAN path to Sonarr at all — manual DNS could previously reach the vhost, + which served the zero-auth UI to anyone who resolved the name manually at + the public edge; the vhost (added in `e0bade6`, 2026-09-04) is retired. diff --git a/shared/homepage/services.json b/shared/homepage/services.json index 5ca7037..0b4648f 100644 --- a/shared/homepage/services.json +++ b/shared/homepage/services.json @@ -100,9 +100,9 @@ }, { "name": "Sonarr", - "category": "user", + "category": "admin", "description": "TV series library and automation.", - "url": "http://sonarr.franksdank.cloud", + "url": "http://192.168.0.112:8989", "docs": "", "probe": "192.168.0.112:8989", "method": "http",