marreta: content-cleaning proxy on Dankclaw, gluetun netns, guard-chained

Deploy manualdousuario/marreta (Laravel / serversideup php:8.4-fpm-nginx)
as a rootless Quadlet pair (marreta + marreta-browser/Lightpanda), both
joining gluetun's netns so all fetch egress exits the same ProtonVPN
tunnel as SearXNG.

- marreta relocated to NGINX_HTTP_PORT=8085 (netns already has searxng on
  8080); gluetun publishes 8082:8085; Caddy dials 192.168.0.143:8082.
- Guard chain: marreta.franksdank.cloud -> Anubis :8923 -> Authentik ->
  post-auth :8017 @marreta -> 8082. Access = any authenticated user.
- Secrets seeded to /home/dank/Containers/marreta/env (0600) from
  MARRETA_APP_KEY / MARRETA_ADMIN_EMAIL / MARRETA_ADMIN_PASSWORD.
- deploy-plan.py: marreta joins the gluetun netns family.
- New seam tests/marreta_quadlet.bats (17 contracts); scoping test updated
  for the widened netns family. Doc: Dankclaw/Marreta.md + index + log.

dankclaw/.env.example

@@ -61,3 +61,16 @@ AUTHENTIK_PG_PASS=changeme
 # AUTHENTIK_SECRET_KEY: the server's secret key (64+ chars).
 #   Generate: openssl rand -base64 48
 AUTHENTIK_SECRET_KEY=changeme
+
+# Marreta (content-cleaning proxy, behind the Authentik guard chain).
+# deploy-remote.sh seeds /home/dank/Containers/marreta/env from these three
+# values (only if that file does not already exist) and the marreta quadlet
+# maps them to the app's APP_KEY / ADMIN_EMAIL / ADMIN_PASSWORD.
+# MARRETA_APP_KEY: Laravel encryption key. Generate:
+#   openssl rand -base64 32
+# Changing it after first boot invalidates encrypted session/cookie data.
+MARRETA_APP_KEY=changeme
+# Admin panel login (marreta.franksdank.cloud/admin). The app creates this
+# account on first boot from these values.
+MARRETA_ADMIN_EMAIL=admin@franksdank.cloud
+MARRETA_ADMIN_PASSWORD=changeme

dankclaw/Caddyfile

@@ -152,6 +152,16 @@ seerr.franksdank.cloud {
 	}
 }
 
+# --- Marreta (guarded: Anubis → Authentik; marreta provider, internal_host caddy:8017) ---
+# Content-cleaning proxy. Any authentik-authenticated user may use it (no
+# group gate). Egress rides the searxng gluetun tunnel; reached via the
+# host-published port 8082 (gluetun netns), not by container name.
+marreta.franksdank.cloud {
+	reverse_proxy anubis:8923 {
+		header_up X-Real-Ip {remote_host}
+	}
+}
+
 # --- Pi-hole (quadlet on slirp4netns; published 8083) ---
 pihole.franksdank.cloud {
 	basicauth {
@@ -379,6 +389,11 @@ http://:8017 {
 	handle @qbittorrent {
 		reverse_proxy 192.168.0.112:8080
 	}
+
+	@marreta host marreta.franksdank.cloud
+	handle @marreta {
+		reverse_proxy 192.168.0.143:8082
+	}
 }
 
 # --- Optional: Jackett ---

dankclaw/marreta/quadlet/marreta-browser.container

@@ -0,0 +1,34 @@
+# Quadlet unit: Marreta browser companion — Lightpanda (rootless, boot-persistent).
+#
+# Install path on dankclaw: ~/.config/containers/systemd/marreta-browser.container
+# Unit name: marreta-browser.service (container name: marreta_browser)
+#
+# Lightpanda is a headless browser that exposes the Chrome DevTools Protocol
+# over a WebSocket on port 9222. Marreta drives it to render JS-heavy pages
+# the plain curl fetch cannot. It shares gluetun's network namespace so the
+# browser's OWN outbound fetches also exit the WireGuard tunnel — this is
+# required because marreta's PROXY_URL only covers the curl strategy; the
+# CDP session passes no proxy to the browser, so without netns sharing the
+# browser would leak the host's real egress IP.
+#
+# Marreta reaches it on loopback (same netns): ws://127.0.0.1:9222. No
+# published port — nothing outside the netns talks to it directly.
+# See serverAppConfigs-docs/Dankclaw/Marreta.md.
+
+[Unit]
+Description=Marreta Lightpanda browser companion container
+Wants=gluetun.service
+After=gluetun.service network.target
+
+[Container]
+ContainerName=marreta_browser
+Network=gluetun.container
+Image=docker.io/lightpanda/browser:nightly
+
+[Service]
+TimeoutStartSec=300
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=default.target

dankclaw/marreta/quadlet/marreta.container

@@ -0,0 +1,66 @@
+# Quadlet unit: Marreta content-cleaning proxy (rootless, boot-persistent).
+#
+# Install path on dankclaw: ~/.config/containers/systemd/marreta.container
+# Unit name: marreta.service (container name: marreta)
+#
+# Marreta is a Laravel app (serversideup/php:8.4-fpm-nginx) that strips
+# paywalls/tracking from a fetched page. It reuses gluetun's network
+# namespace (Network=gluetun.container) so ALL of its outbound fetches exit
+# the same WireGuard tunnel as SearXNG — the curl strategy AND, because the
+# browser companion shares the same netns, the Lightpanda fetches too
+# (marreta's PROXY_URL does NOT cover the browser: the CDP connection passes
+# no proxy, so netns sharing is the only way to keep the browser's egress on
+# the tunnel).
+#
+# Port: the shared netns already has SearXNG on 8080, so marreta must NOT
+# bind 8080. NGINX_HTTP_PORT=8085 relocates it (the fpm-nginx image does
+# not bake conf.d/*.conf; the site config is envsubst'd from
+# ${NGINX_HTTP_PORT} at container start). Gluetun publishes host 8082 ->
+# 8085 so Caddy can reach it; see dankclaw/searxng/quadlet/gluetun.container.
+# The app reaches its browser companion over loopback (same netns):
+# ws://127.0.0.1:9222.
+#
+# Secrets (APP_KEY, admin creds) live in /home/dank/Containers/marreta/env
+# (mode 0600, dank-owned so the rootless unit can read it); this file holds
+# none. See serverAppConfigs-docs/Dankclaw/Marreta.md.
+
+[Unit]
+Description=Marreta content-cleaning proxy container
+Wants=gluetun.service marreta-browser.service
+After=gluetun.service marreta-browser.service network.target
+
+[Container]
+ContainerName=marreta
+Network=gluetun.container
+Image=ghcr.io/manualdousuario/marreta:latest
+# Relocate off SearXNG's 8080 inside the shared netns.
+Environment=NGINX_HTTP_PORT=8085
+Environment=APP_NAME=Marreta
+Environment=APP_ENV=production
+Environment=APP_DEBUG=false
+Environment=APP_URL=https://marreta.franksdank.cloud
+Environment=APP_LOCALE=en
+Environment="APP_DESCRIPTION=Paywall-free reading"
+Environment=BROWSER_WS_ENDPOINT=ws://127.0.0.1:9222
+Environment=DISABLE_CACHE=false
+# Secrets expanded from the EnvironmentFile below.
+Environment=APP_KEY=${MARRETA_APP_KEY}
+Environment=ADMIN_EMAIL=${MARRETA_ADMIN_EMAIL}
+Environment=ADMIN_PASSWORD=${MARRETA_ADMIN_PASSWORD}
+# Named volume: podman auto-creates it and copyups the image's storage/app
+# ownership (www-data), so the app can write its SQLite DB + cache.
+Volume=marreta_storage:/var/www/html/storage/app
+HealthCmd=["curl","-fsS","-o","/dev/null","http://127.0.0.1:8085/up"]
+HealthInterval=30s
+HealthTimeout=10s
+HealthRetries=5
+HealthStartPeriod=120s
+
+[Service]
+EnvironmentFile=/home/dank/Containers/marreta/env
+TimeoutStartSec=900
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=default.target

dankclaw/pihole/addn-hosts

@@ -44,3 +44,4 @@
 192.168.0.143 loki.franksdank.cloud
 192.168.0.143 pihole.franksdank.cloud
 192.168.0.143 seerr.franksdank.cloud
+192.168.0.143 marreta.franksdank.cloud

dankclaw/searxng/quadlet/gluetun.container

@@ -29,6 +29,7 @@ Environment=WIREGUARD_ENDPOINT_PORT=${WIREGUARD_ENDPOINT_PORT}
 Environment=WIREGUARD_ALLOWED_IPS=${WIREGUARD_ALLOWED_IPS}
 Environment=WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=${WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL}
 PublishPort=8081:8080
+PublishPort=8082:8085
 
 [Service]
 EnvironmentFile=/opt/searxng/.env