dank/serverAppConfigs
1
0
Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases Wiki Activity

marreta: content-cleaning proxy on Dankclaw, gluetun netns, guard-chained

Browse Source 
Deploy manualdousuario/marreta (Laravel / serversideup php:8.4-fpm-nginx)
as a rootless Quadlet pair (marreta + marreta-browser/Lightpanda), both
joining gluetun's netns so all fetch egress exits the same ProtonVPN
tunnel as SearXNG.

- marreta relocated to NGINX_HTTP_PORT=8085 (netns already has searxng on
  8080); gluetun publishes 8082:8085; Caddy dials 192.168.0.143:8082.
- Guard chain: marreta.franksdank.cloud -> Anubis :8923 -> Authentik ->
  post-auth :8017 @marreta -> 8082. Access = any authenticated user.
- Secrets seeded to /home/dank/Containers/marreta/env (0600) from
  MARRETA_APP_KEY / MARRETA_ADMIN_EMAIL / MARRETA_ADMIN_PASSWORD.
- deploy-plan.py: marreta joins the gluetun netns family.
- New seam tests/marreta_quadlet.bats (17 contracts); scoping test updated
  for the widened netns family. Doc: Dankclaw/Marreta.md + index + log.
This commit is contained in:
Frank
2026-09-12 10:09:12 -07:00
parent 9530bffad6
commit 73e46a1d85
13 changed files with 547 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serverAppConfigs-docs/log.md
+25
View File
@@ -11,6 +11,31 @@ timestamp: 2026-09-14
# Bundle Change Log
## 2026-09-12 — Marreta content-cleaning proxy deployed on Dankclaw
- Added `manualdousuario/marreta` (Laravel / `serversideup/php:8.4-fpm-nginx`)
as a rootless Quadlet pair: `marreta` + `marreta-browser` (Lightpanda),
both joining **gluetun's netns** so all fetch egress exits the same
ProtonVPN tunnel as [[SearXNG]].
- **Port-collision fix:** the shared netns already has SearXNG on 8080, so
marreta is relocated to `NGINX_HTTP_PORT=8085` (verified against the
serversideup source: the image does not bake `conf.d/*.conf`; the
entrypoint `envsubst`s `${NGINX_HTTP_PORT}` at start). Gluetun publishes
`8082:8085` on marreta's behalf; Caddy dials `192.168.0.143:8082`.
- **Egress rationale:** netns sharing, not `PROXY_URL` — the browser's CDP
fetch passes no proxy, so only netns keeps the browser off the home IP.
- **Guard chain:** `marreta.franksdank.cloud` → Anubis `:8923` → Authentik
→ post-auth `:8017` `@marreta` → `192.168.0.143:8082`. Access model is
**any authenticated user** (no group gate). Requires a one-time
`ProxyProvider` (external_host `https://marreta.franksdank.cloud/`,
internal_host `http://caddy:8017`) on the embedded outpost.
- Secrets seeded to `/home/dank/Containers/marreta/env` (0600, dank-owned)
from `MARRETA_APP_KEY` / `MARRETA_ADMIN_EMAIL` / `MARRETA_ADMIN_PASSWORD`.
- New test seam `tests/marreta_quadlet.bats` (17 contracts). deploy-plan.py:
marreta joins the gluetun netns family. Doc: [[Marreta]].
- **Not yet run live:** this box has no deploy key for Dankclaw. The deploy
and the Authentik provider registration must be run from a host with
access; see the doc's Deploy + Guard chain sections.
## 2026-09-04 — *arr fleet consolidated on FrankBook-Pro; all egress VPN-gated
- Operator decision: **FrankBook-Pro is the sole *arr deployment.** The
Dankserver compose copy (booted earlier the same day) was removed;