feat(exposure): sonarr to admin side, internal-only by construction

Flip the homepage Sonarr card from the user category to admin and repoint
its link at the LAN-direct port (192.168.0.112:8989). Retire the unguarded
public vhost sonarr.franksdank.cloud (direct reverse_proxy, no auth) and its
post-auth @sonarr handler from the Caddyfile; drop the Pi-hole addn-hosts A
record with it. No public Porkbun record ever existed (NXDOMAIN at the zone),
so after this there is no WAN path to Sonarr: users request TV via Seerr
(guarded), admins reach Sonarr's own UI from the LAN only.

Fixes the seerr/sonarr mix-up from 19b2589/e0bade6.

dankclaw/Caddyfile

@@ -248,9 +248,12 @@ radarr.franksdank.cloud {
 	reverse_proxy 192.168.0.112:7878
 }
 
-sonarr.franksdank.cloud {
+# --- Sonarr: internal-only by construction (retired 2026-09-04) -----------
-	reverse_proxy 192.168.0.112:8989
+# No vhost and no public DNS record for sonarr.franksdank.cloud: the TV-library
-}
+# admin UI is reachable only on the LAN at 192.168.0.112:8989 (users request TV
+# through Seerr, which sits behind the guard chain; admins reach Sonarr's own
+# UI directly). A brief unguarded public vhost lived here and served the
+# zero-auth UI to the internet via manual DNS — retired.
 
 lidarr.franksdank.cloud {
 	reverse_proxy 192.168.0.112:8686
@@ -362,11 +365,6 @@ http://:8017 {
 		reverse_proxy 192.168.0.112:7878
 	}
 
-	@sonarr host sonarr.franksdank.cloud
-	handle @sonarr {
-		reverse_proxy 192.168.0.112:8989
-	}
-
 	@lidarr host lidarr.franksdank.cloud
 	handle @lidarr {
 		reverse_proxy 192.168.0.112:8686

dankclaw/pihole/addn-hosts

@@ -27,7 +27,6 @@
 192.168.0.143 files.franksdank.cloud
 192.168.0.143 jelly.franksdank.cloud
 192.168.0.143 radarr.franksdank.cloud
-192.168.0.143 sonarr.franksdank.cloud
 192.168.0.143 lidarr.franksdank.cloud
 192.168.0.143 readarr.franksdank.cloud
 192.168.0.143 prowlarr.franksdank.cloud

serverAppConfigs-docs/Dankserver/ARR-Stack.md

@@ -87,10 +87,13 @@ Dankserver (recoverable until purged).
 
 No *arr app sits behind the Anubis guard chain — the stack is exempt by
 construction (its own auth), with an exemption comment in the Caddyfile per
-vhost. Six TLS vhosts (`<svc>.franksdank.cloud`) terminate on Caddy on
+vhost. Five TLS vhosts (`<svc>.franksdank.cloud`) terminate on Caddy on
 Dankclaw and route to FrankBook-Pro's published ports
 (`192.168.0.112:<port>`, all exposed by the gluetun unit since the netns
-consolidation); the same ports are reachable directly on the LAN.
+consolidation); the same ports are reachable directly on the LAN. Sonarr is
+the exception: internal-only by construction — no vhost, no public DNS record;
+admins reach it at `http://192.168.0.112:8989` from the LAN only (retired
+2026-09-04; users request TV through [[Seerr]] instead).
 
 Auth-config history (verified live 2026-08-29): all five arrs shipped with
 `AuthenticationMethod=None` **plus** `AuthenticationRequired=Enabled`. On the
@@ -105,7 +108,8 @@ containers restarted, all five verified serving. Posture = zero-auth arrs on
 LAN and WAN; the Anubis wall guards homepage/search/hermes/prometheus/romm/files
 but **not** the arrs — first-account-wins is the current race condition if that
 ever flips to `External` auth (needs an IdP first; auth method choice remains an
-operator decision).
+operator decision). Sonarr is exempt from even that exposure since 2026-09-04:
+with no vhost and no public DNS record, its zero-auth UI has no WAN path at all.
 
 ## Chain wiring (verified live 2026-08-30)
 

serverAppConfigs-docs/Dankserver/sonarr.md

@@ -3,7 +3,7 @@ type: reference
 title: Sonarr
 description: Sonarr TV manager in the *arr stack on FrankBook-Pro — live quadlet deployment, ports, volumes, and wiring facts.
 tags: [sonarr, arr-stack, frankbook-pro]
-timestamp: 2026-09-03T00:00:00Z
+timestamp: 2026-09-04T00:00:00Z
 ---
 
 # Sonarr
@@ -13,7 +13,11 @@ Sonarr manages TV shows in the *arr stack. The stack runs on **FrankBook-Pro**
 It searches, downloads, and organizes episodes from indexers into the Jellyfin
 TV library.
 
-**Host:** FrankBook-Pro (podman machine) — **Access:** direct port `8989` (no reverse-proxy vhost; the *arr stack is exempt by construction from the Anubis guard chain) — **Docs:** https://wiki.servarr.com/sonarr
+**Host:** FrankBook-Pro (podman machine) — **Access:** LAN-direct only at
+`http://192.168.0.112:8989` — no vhost and no public DNS record by construction
+(the brief unguarded `sonarr.franksdank.cloud` vhost was retired 2026-09-04;
+users request TV via [[Seerr]], admins use this UI from the LAN) —
+**Docs:** https://wiki.servarr.com/sonarr
 
 ## Facts
 

serverAppConfigs-docs/log.md

@@ -389,3 +389,18 @@ timestamp: 2026-09-14
 - `/frankbook-pro/qbittorrent/quadlet/qbittorrent.container` — pinned `lscr.io/linuxserver/qbittorrent:4.6.7`: `latest` had resolved to qB 5.x, whose `204` empty-body login success Readarr's retired client rejects as "Authentication failure" at runtime (not just in API creates — the prior session's "runtime cookie auth unaffected" assumption was wrong); 4.6.7 answers the legacy `200` + `"Ok."`. Gotcha: after 5.x ran, its conf rewrite left a PBKDF2 line 4.6.7 rejects — every login `invalid credentials`; rewriting the same line fresh (same password, 100k iterations) fixed it.
 - `/docs/Infrastructure/FrankBook-Pro.md` — wiring, pin rationale, PBKDF2 version-flip gotcha, and E2E result (test torrent through the Panama tunnel at ~17 MB/s, INCOMPLETE → COMPLETE into `Finished Torrents`, deleted with data).
 - `/scripts/deploy.sh` + `/scripts/deploy-plan.py` + `/tests/dankserver_quadlet.bats` — committed earlier today (`b206f47`): dankserver quadlet standardization units/handlers/routing.
+
+## 2026-09-04 — Sonarr moved to the admin side; internal-only by construction
+- Operator directive (fixing an earlier seerr/sonarr mix-up): Sonarr is an
+  **admin-side** service and must be locally reachable only. The homepage
+  registry flipped its card from the user category to **admin** and repointed
+  the link at `http://192.168.0.112:8989` (LAN-direct). Users keep requesting
+  TV through Seerr, which stays on the user side behind the guard chain.
+- Exposure closure: the unguarded public vhost `sonarr.franksdank.cloud`
+  (direct `reverse_proxy 192.168.0.112:8989`, no auth) and its post-auth
+  `@sonarr` handler were retired from the Caddyfile; the Pi-hole addn-hosts A
+  record for the name was dropped with it. No public Porkbun record ever
+  existed (NXDOMAIN at the authoritative zone), so after this change there is
+  no WAN path to Sonarr at all — manual DNS could previously reach the vhost,
+  which served the zero-auth UI to anyone who resolved the name manually at
+  the public edge; the vhost (added in `e0bade6`, 2026-09-04) is retired.

shared/homepage/services.json

@@ -100,9 +100,9 @@
   },
   {
     "name": "Sonarr",
-    "category": "user",
+    "category": "admin",
     "description": "TV series library and automation.",
-    "url": "http://sonarr.franksdank.cloud",
+    "url": "http://192.168.0.112:8989",
     "docs": "",
     "probe": "192.168.0.112:8989",
     "method": "http",