dank/serverAppConfigs
1
0 Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases Wiki Activity

arr fleet: FrankBook-Pro is the sole deployment, all egress VPN-gated

Browse Source 
FrankBook-Pro becomes the only *arr/qBittorrent deployment. Every fleet
container (qB + five arrs) now shares gluetun's netns, so all egress —
torrent, indexer APIs, metadata lookups — exits the WireGuard tunnel by
construction (AllowedIPs=0.0.0.0/0); the arrs' own ports publish on the
gluetun unit, none on the arr units themselves.

- dankserver/compose.yaml: remove the six arr services (the Aug 20 compose
  copy — never healthy, superseded; config dirs trashed on the host)
- dankclaw/Caddyfile + shared/homepage/services.json: arr vhosts and
  probes repoint 192.168.0.235 -> 192.168.0.112 (FrankBook-Pro)
- frankbook-pro units: five arrs join gluetun netns (Wants/After/Network);
  gluetun publishes 9696/8989/7878/8686/8787 alongside 8080/6881
- tests/frankbook_quadlet.bats: new VPN egress seam — every arr+qB unit
  must share gluetun's netns and publish no port; gluetun must publish the
  whole fleet's ports
- deploy-plan.py: gluetun changes carry the whole netns family (a gluetun
  recreation kills all six joiners); dankserver compose set loses the arrs
- AGENTS.md: deployment is complete only when unit tests AND the Playwright
  E2E suite both pass
This commit is contained in:
Frank committed 2026-09-04 12:54:28 -07:00
1 parent 8a6362401a
commit 4c7465d00d
14 files changed
+101 -163
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

frankbook-pro/gluetun/quadlet/gluetun.container
+11 -5
View File
@@ -5,11 +5,12 @@
# (installed by the frankbook-pro handler in scripts/deploy-remote.sh —
# install_quadlet targets the Linux hosts' systemctl --user, not the VM).
#
# WireGuard tunnel to ProtonVPN. qBittorrent shares this container's network
# namespace (Network=gluetun.container) so torrent egress never touches the
# residential IP. qBittorrent's WebUI and BitTorrent ports publish HERE — a
# netns-sharer publishes no ports of its own (same invariant as the dankclaw
# searxng/gluetun pair). Credentials live in
# WireGuard tunnel to ProtonVPN. qBittorrent and all five *arrs share this
# container's network namespace (Network=gluetun.container) so every fleet
# container's egress — torrent traffic, indexer APIs, metadata lookups —
# exits ONLY through the tunnel (AllowedIPs=0.0.0.0/0). Every fleet port
# publishes HERE; a netns-sharer publishes no ports of its own (same
# invariant as the dankclaw searxng/gluetun pair). Credentials live in
# /home/core/Containers/gluetun/env inside the VM (mode 0600, never
# committed); the private key is Mac-tunnel-specific and MUST NOT be copied
# from dankclaw — one WireGuard peer key cannot serve two machines at once.
@@ -33,6 +34,11 @@ Environment=WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=${WIREGUARD_PERSISTENT_KEEPA
PublishPort=8080:8080
PublishPort=6881:6881
PublishPort=6881:6881/udp
PublishPort=9696:9696
PublishPort=8989:8989
PublishPort=7878:7878
PublishPort=8686:8686
PublishPort=8787:8787
[Service]
EnvironmentFile=/home/core/Containers/gluetun/env
frankbook-pro/lidarr/quadlet/lidarr.container
+6 -1
View File
@@ -3,10 +3,15 @@
# Install path is INSIDE the machine VM:
# /home/core/.config/containers/systemd/lidarr.container
#
#
# Joins gluetun's network namespace: all egress exits through the WireGuard
# tunnel; 8686 publishes on the gluetun unit.
# Grab-only: no media binds; config migrated from dankserver's retired
# bare container.
[Unit]
Description=Lidarr (FrankBook-Pro)
Wants=gluetun.service
After=gluetun.service
[Container]
ContainerName=lidarr
@@ -16,7 +21,7 @@ Environment=PGID=0
Environment=TZ=America/Los_Angeles
Environment=UMASK_SET=022
Volume=/Volumes/COMPLETE/lidarr-data:/config
PublishPort=8686:8686
Network=gluetun.container
[Service]
TimeoutStartSec=900
frankbook-pro/prowlarr/quadlet/prowlarr.container
+9 -2
View File
@@ -3,6 +3,10 @@
# Install path is INSIDE the machine VM:
# /home/core/.config/containers/systemd/prowlarr.container
#
#
# Joins gluetun's network namespace: all egress (indexer APIs, metadata
# lookups) exits through the WireGuard tunnel; 9696 publishes on the
# gluetun unit. Same-netns targets (qB, the arrs) are loopback addresses.
# Arr on the Mac is grab-only: indexer + app-sync management lives here, the
# arrs never auto-import media (the user reviews completed torrents in
# /Volumes/COMPLETE/"Finished Torrents" and moves files manually into the
@@ -11,9 +15,12 @@
# Config is migrated from dankserver's retired bare container
# (tar-archived first, per the Phase 4 cutover note) — indexers and app
# settings survive; stale host pointers (old qbit at 192.168.0.235:8080)
# are re-pointed to the Mac's qbit via its API after first boot.
# are re-pointed to loopback qBittorrent (127.0.0.1:8080, same netns) via
# its API after first boot.
[Unit]
Description=Prowlarr (FrankBook-Pro)
Wants=gluetun.service
After=gluetun.service
[Container]
ContainerName=prowlarr
@@ -23,7 +30,7 @@ Environment=PGID=0
Environment=TZ=America/Los_Angeles
Environment=UMASK_SET=022
Volume=/Volumes/COMPLETE/prowlarr-data:/config
PublishPort=9696:9696
Network=gluetun.container
[Service]
TimeoutStartSec=900
frankbook-pro/radarr/quadlet/radarr.container
+6 -1
View File
@@ -3,10 +3,15 @@
# Install path is INSIDE the machine VM:
# /home/core/.config/containers/systemd/radarr.container
#
#
# Joins gluetun's network namespace: all egress exits through the WireGuard
# tunnel; 7878 publishes on the gluetun unit.
# Grab-only: no media binds; config migrated from dankserver's retired
# bare container.
[Unit]
Description=Radarr (FrankBook-Pro)
Wants=gluetun.service
After=gluetun.service
[Container]
ContainerName=radarr
@@ -16,7 +21,7 @@ Environment=PGID=0
Environment=TZ=America/Los_Angeles
Environment=UMASK_SET=022
Volume=/Volumes/COMPLETE/radarr-data:/config
PublishPort=7878:7878
Network=gluetun.container
[Service]
TimeoutStartSec=900
frankbook-pro/readarr/quadlet/readarr.container
+6 -1
View File
@@ -3,6 +3,9 @@
# Install path is INSIDE the machine VM:
# /home/core/.config/containers/systemd/readarr.container
#
#
# Joins gluetun's network namespace: all egress exits through the WireGuard
# tunnel; 8787 publishes on the gluetun unit.
# Grab-only: no media binds; config migrated from dankserver's retired
# bare container.
#
@@ -11,6 +14,8 @@
# of a broken 1.x nightly for Readarr; the pin avoids surprises.
[Unit]
Description=Readarr (FrankBook-Pro)
Wants=gluetun.service
After=gluetun.service
[Container]
ContainerName=readarr
@@ -20,7 +25,7 @@ Environment=PGID=0
Environment=TZ=America/Los_Angeles
Environment=UMASK_SET=022
Volume=/Volumes/COMPLETE/readarr-data:/config
PublishPort=8787:8787
Network=gluetun.container
[Service]
TimeoutStartSec=900
frankbook-pro/sonarr/quadlet/sonarr.container
+6 -1
View File
@@ -3,11 +3,16 @@
# Install path is INSIDE the machine VM:
# /home/core/.config/containers/systemd/sonarr.container
#
#
# Joins gluetun's network namespace: all egress exits through the WireGuard
# tunnel; 8989 publishes on the gluetun unit.
# Grab-only: no media binds (the TV library lives on dankserver's entropy
# disk, which the Mac never mounts); config migrated from dankserver's
# retired bare container.
[Unit]
Description=Sonarr (FrankBook-Pro)
Wants=gluetun.service
After=gluetun.service
[Container]
ContainerName=sonarr
@@ -17,7 +22,7 @@ Environment=PGID=0
Environment=TZ=America/Los_Angeles
Environment=UMASK_SET=022
Volume=/Volumes/COMPLETE/sonarr-data:/config
PublishPort=8989:8989
Network=gluetun.container
[Service]
TimeoutStartSec=900