arr fleet: FrankBook-Pro is the sole deployment, all egress VPN-gated

FrankBook-Pro becomes the only *arr/qBittorrent deployment. Every fleet
container (qB + five arrs) now shares gluetun's netns, so all egress —
torrent, indexer APIs, metadata lookups — exits the WireGuard tunnel by
construction (AllowedIPs=0.0.0.0/0); the arrs' own ports publish on the
gluetun unit, none on the arr units themselves.

- dankserver/compose.yaml: remove the six arr services (the Aug 20 compose
  copy — never healthy, superseded; config dirs trashed on the host)
- dankclaw/Caddyfile + shared/homepage/services.json: arr vhosts and
  probes repoint 192.168.0.235 -> 192.168.0.112 (FrankBook-Pro)
- frankbook-pro units: five arrs join gluetun netns (Wants/After/Network);
  gluetun publishes 9696/8989/7878/8686/8787 alongside 8080/6881
- tests/frankbook_quadlet.bats: new VPN egress seam — every arr+qB unit
  must share gluetun's netns and publish no port; gluetun must publish the
  whole fleet's ports
- deploy-plan.py: gluetun changes carry the whole netns family (a gluetun
  recreation kills all six joiners); dankserver compose set loses the arrs
- AGENTS.md: deployment is complete only when unit tests AND the Playwright
  E2E suite both pass
This commit is contained in:
Frank committed 2026-09-04 12:54:28 -07:00
1 parent 8a6362401a
commit 4c7465d00d
14 files changed
+101 -163

No files matched your search

+12
View File
@@ -130,6 +130,18 @@ Set `FRANK_SUDO_PW` for headless runs on a host without passwordless sudo
(remote sudo reads it from stdin via `sudo -S`). The value is never stored
in this repo.
### Deployment completeness (MANDATORY)
A deployment is **not complete** when `deploy.sh` exits green. It is complete
only when BOTH of the following pass:
1. **Unit/config tests** — `./tests/run.sh` (all seams green), and
2. **Playwright end-to-end tests** — `tests/e2e/run.sh` drives the LIVE fleet
(homepage, Anubis/Authentik guard chain, guarded vhosts) in a real
browser. The E2E suite is deliberately excluded from `./tests/run.sh`
because it needs live hosts and credentials, so it MUST be invoked
explicitly after every behavior-affecting deploy.
```mermaid
graph LR
A[Edit locally] --> B[Tests pass]