arr fleet: FrankBook-Pro is the sole deployment, all egress VPN-gated
FrankBook-Pro becomes the only *arr/qBittorrent deployment. Every fleet container (qB + five arrs) now shares gluetun's netns, so all egress — torrent, indexer APIs, metadata lookups — exits the WireGuard tunnel by construction (AllowedIPs=0.0.0.0/0); the arrs' own ports publish on the gluetun unit, none on the arr units themselves. - dankserver/compose.yaml: remove the six arr services (the Aug 20 compose copy — never healthy, superseded; config dirs trashed on the host) - dankclaw/Caddyfile + shared/homepage/services.json: arr vhosts and probes repoint 192.168.0.235 -> 192.168.0.112 (FrankBook-Pro) - frankbook-pro units: five arrs join gluetun netns (Wants/After/Network); gluetun publishes 9696/8989/7878/8686/8787 alongside 8080/6881 - tests/frankbook_quadlet.bats: new VPN egress seam — every arr+qB unit must share gluetun's netns and publish no port; gluetun must publish the whole fleet's ports - deploy-plan.py: gluetun changes carry the whole netns family (a gluetun recreation kills all six joiners); dankserver compose set loses the arrs - AGENTS.md: deployment is complete only when unit tests AND the Playwright E2E suite both pass
This commit is contained in:
1 parent
8a6362401a
commit
4c7465d00d
14 files changed
+101
-163
No files matched your search
@@ -130,6 +130,18 @@ Set `FRANK_SUDO_PW` for headless runs on a host without passwordless sudo
|
||||
(remote sudo reads it from stdin via `sudo -S`). The value is never stored
|
||||
in this repo.
|
||||
|
||||
### Deployment completeness (MANDATORY)
|
||||
|
||||
A deployment is **not complete** when `deploy.sh` exits green. It is complete
|
||||
only when BOTH of the following pass:
|
||||
|
||||
1. **Unit/config tests** — `./tests/run.sh` (all seams green), and
|
||||
2. **Playwright end-to-end tests** — `tests/e2e/run.sh` drives the LIVE fleet
|
||||
(homepage, Anubis/Authentik guard chain, guarded vhosts) in a real
|
||||
browser. The E2E suite is deliberately excluded from `./tests/run.sh`
|
||||
because it needs live hosts and credentials, so it MUST be invoked
|
||||
explicitly after every behavior-affecting deploy.
|
||||
|
||||
```mermaid
|
||||
graph LR
|
||||
A[Edit locally] --> B[Tests pass]
|
||||
|
||||
Reference in new issue
Block a user