dank/serverAppConfigs
1
0
Fork 0
Code Issues 4 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat(exposure): sonarr to admin side, internal-only by construction

Browse Source 
Flip the homepage Sonarr card from the user category to admin and repoint
its link at the LAN-direct port (192.168.0.112:8989). Retire the unguarded
public vhost sonarr.franksdank.cloud (direct reverse_proxy, no auth) and its
post-auth @sonarr handler from the Caddyfile; drop the Pi-hole addn-hosts A
record with it. No public Porkbun record ever existed (NXDOMAIN at the zone),
so after this there is no WAN path to Sonarr: users request TV via Seerr
(guarded), admins reach Sonarr's own UI from the LAN only.

Fixes the seerr/sonarr mix-up from 19b2589/e0bade6.
This commit is contained in:
Frank
2026-09-04 18:34:02 -07:00
parent df4339a82a
commit 32b4016e55
6 changed files with 36 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serverAppConfigs-docs/Dankserver/ARR-Stack.md
+7 -3
View File
@@ -87,10 +87,13 @@ Dankserver (recoverable until purged).
No *arr app sits behind the Anubis guard chain — the stack is exempt by
construction (its own auth), with an exemption comment in the Caddyfile per
vhost. Six TLS vhosts (`<svc>.franksdank.cloud`) terminate on Caddy on
vhost. Five TLS vhosts (`<svc>.franksdank.cloud`) terminate on Caddy on
Dankclaw and route to FrankBook-Pro's published ports
(`192.168.0.112:<port>`, all exposed by the gluetun unit since the netns
consolidation); the same ports are reachable directly on the LAN.
consolidation); the same ports are reachable directly on the LAN. Sonarr is
the exception: internal-only by construction — no vhost, no public DNS record;
admins reach it at `http://192.168.0.112:8989` from the LAN only (retired
2026-09-04; users request TV through [[Seerr]] instead).
Auth-config history (verified live 2026-08-29): all five arrs shipped with
`AuthenticationMethod=None` **plus** `AuthenticationRequired=Enabled`. On the
@@ -105,7 +108,8 @@ containers restarted, all five verified serving. Posture = zero-auth arrs on
LAN and WAN; the Anubis wall guards homepage/search/hermes/prometheus/romm/files
but **not** the arrs — first-account-wins is the current race condition if that
ever flips to `External` auth (needs an IdP first; auth method choice remains an
operator decision).
operator decision). Sonarr is exempt from even that exposure since 2026-09-04:
with no vhost and no public DNS record, its zero-auth UI has no WAN path at all.
## Chain wiring (verified live 2026-08-30)
serverAppConfigs-docs/Dankserver/sonarr.md
+6 -2
View File
@@ -3,7 +3,7 @@ type: reference
title: Sonarr
description: Sonarr TV manager in the *arr stack on FrankBook-Pro — live quadlet deployment, ports, volumes, and wiring facts.
tags: [sonarr, arr-stack, frankbook-pro]
timestamp: 2026-09-03T00:00:00Z
timestamp: 2026-09-04T00:00:00Z
---
# Sonarr
@@ -13,7 +13,11 @@ Sonarr manages TV shows in the *arr stack. The stack runs on **FrankBook-Pro**
It searches, downloads, and organizes episodes from indexers into the Jellyfin
TV library.
**Host:** FrankBook-Pro (podman machine) — **Access:** direct port `8989` (no reverse-proxy vhost; the *arr stack is exempt by construction from the Anubis guard chain) — **Docs:** https://wiki.servarr.com/sonarr
**Host:** FrankBook-Pro (podman machine) — **Access:** LAN-direct only at
`http://192.168.0.112:8989` — no vhost and no public DNS record by construction
(the brief unguarded `sonarr.franksdank.cloud` vhost was retired 2026-09-04;
users request TV via [[Seerr]], admins use this UI from the LAN) —
**Docs:** https://wiki.servarr.com/sonarr
## Facts