dank/serverAppConfigs
1
0
Fork 0
Code Issues 4 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat(exposure): sonarr to admin side, internal-only by construction

Browse Source 
Flip the homepage Sonarr card from the user category to admin and repoint
its link at the LAN-direct port (192.168.0.112:8989). Retire the unguarded
public vhost sonarr.franksdank.cloud (direct reverse_proxy, no auth) and its
post-auth @sonarr handler from the Caddyfile; drop the Pi-hole addn-hosts A
record with it. No public Porkbun record ever existed (NXDOMAIN at the zone),
so after this there is no WAN path to Sonarr: users request TV via Seerr
(guarded), admins reach Sonarr's own UI from the LAN only.

Fixes the seerr/sonarr mix-up from 19b2589/e0bade6.
This commit is contained in:
Frank
2026-09-04 18:34:02 -07:00
parent df4339a82a
commit 32b4016e55
6 changed files with 36 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serverAppConfigs-docs/Dankserver/ARR-Stack.md
+7 -3
View File
@@ -87,10 +87,13 @@ Dankserver (recoverable until purged).
No *arr app sits behind the Anubis guard chain — the stack is exempt by
construction (its own auth), with an exemption comment in the Caddyfile per
vhost. Six TLS vhosts (`<svc>.franksdank.cloud`) terminate on Caddy on
vhost. Five TLS vhosts (`<svc>.franksdank.cloud`) terminate on Caddy on
Dankclaw and route to FrankBook-Pro's published ports
(`192.168.0.112:<port>`, all exposed by the gluetun unit since the netns
consolidation); the same ports are reachable directly on the LAN.
consolidation); the same ports are reachable directly on the LAN. Sonarr is
the exception: internal-only by construction — no vhost, no public DNS record;
admins reach it at `http://192.168.0.112:8989` from the LAN only (retired
2026-09-04; users request TV through [[Seerr]] instead).
Auth-config history (verified live 2026-08-29): all five arrs shipped with
`AuthenticationMethod=None` **plus** `AuthenticationRequired=Enabled`. On the
@@ -105,7 +108,8 @@ containers restarted, all five verified serving. Posture = zero-auth arrs on
LAN and WAN; the Anubis wall guards homepage/search/hermes/prometheus/romm/files
but **not** the arrs — first-account-wins is the current race condition if that
ever flips to `External` auth (needs an IdP first; auth method choice remains an
operator decision).
operator decision). Sonarr is exempt from even that exposure since 2026-09-04:
with no vhost and no public DNS record, its zero-auth UI has no WAN path at all.
## Chain wiring (verified live 2026-08-30)