diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile index 7436c41..7138b27 100644 --- a/dankclaw/Caddyfile +++ b/dankclaw/Caddyfile @@ -290,7 +290,14 @@ audiobooks.franksdank.cloud { } } -# --- Jellyfin --- +# --- Jellyfin (exempt by construction: own auth) -------------------------- +# No Anubis, no outpost: Jellyfin carries its own complete login (its own +# account store, no Authentik link), which is the policy's exempt category — +# the same family as plex/ABS/*arr around it. Accepted exposure: the sign-in +# form is internet-visible with no rate limiter on either side (this Caddy +# build ships no rate_limit module), so accounts need long unique passwords. +# The homepage card opened it to the household on 2026-11-03; accounts are +# created in Jellyfin's own admin UI, not by SSO. jelly.franksdank.cloud { reverse_proxy 192.168.0.235:8096 } diff --git a/serverAppConfigs-docs/Infrastructure/Homepage.md b/serverAppConfigs-docs/Infrastructure/Homepage.md index 03da983..ed1216c 100644 --- a/serverAppConfigs-docs/Infrastructure/Homepage.md +++ b/serverAppConfigs-docs/Infrastructure/Homepage.md @@ -316,7 +316,7 @@ flowchart TD **User services** (root page), in section order: - **AI** — OpenWebUI, and the three LLM fleet cards (frank-dragoon, frank-archon, frank-zealot — status + docs link, no Open link). - **Web Apps** — SearXNG, Gitea, Copyparty, Marreta. -- **Media Library Apps** — Calibre-Web, RomM, Plex, Jellyfin, Seerr. +- **Media Library Apps** — Calibre-Web, RomM, Plex, Jellyfin, Seerr, Audiobookshelf (moved up from the admin page 2026-11-03, once Authentik SSO made it a household app). **Admin services** (`/admin/`), in section order: - **Media Library Apps** — the *arr stack (Prowlarr, Sonarr, Radarr, Lidarr, Readarr), qBittorrent, and Tautulli — live on FrankBook-Pro and Dankserver, operator-only: no vhosts (Tautulli included), direct IP:port access only. See [[FrankBook-Pro]]. @@ -324,6 +324,12 @@ flowchart TD - **AI** — Hermes, ComfyUI. - **Infrastructure** — Caddy, dnsmasq, Gluetun, and the low-level backends (mariadb, valkey, Postgres). The backends show status only. They get a link only where a UI is meaningful. +**The registry is the authority.** `shared/homepage/services.json` decides which +page a card renders on (`category`), whether it shows a WIP badge instead of live +status (`wip`), and whether it gets an Open link (`showLink` + `url`). The two +lists above are a locator only; when they disagree with the registry, the page is +the bug — fix the page. + ## Layout ``` diff --git a/shared/homepage/docs.html b/shared/homepage/docs.html index 7578c2a..7556a5b 100644 --- a/shared/homepage/docs.html +++ b/shared/homepage/docs.html @@ -56,6 +56,10 @@ Jellyfin. Seerr is the front door — requests ride the VPN tunnel from there.
  • Books: Calibre-Web — the e-book library, with its own login.
    • +
  • Audiobooks: Audiobookshelf — the + audiobook library. Same single sign-on as everything else: choose + Continue with authentik and each listener keeps their own + position.
  • Games: RomM — ROM library and emulator collection.
  • Raw files: Copyparty — direct downloads and shares.
  • Search: SearXNG — metasearch, VPN-routed, no AI snoop.
    ⚠ privacy note
    Searches are obfuscated, not anonymous: SearXNG hides you from the upstream engines and the VPN tunnel hides the traffic from the LAN — but the upstream search API keys are tied to Frank’s identity. Don’t treat it as Tor.
    • @@ -109,6 +113,7 @@
  • Best for: complex agentic tasks, programming, system administration, and "claw"-style personal agents.
  • Supervision: safe for autonomous, low-supervision use.
  • Warning:
    ⚠ uncensored model
    Uncensored model: output can include adult content, content that describes harmful, hateful, or illegal acts, content concerning “sensitive offensive cybersecurity topics”, and other output that may carry severe legal risk. Take this warning seriously — don’t ruin this server for everybody.
    • +

    frank-archon — the big one