From 792eb19febdf7ddd249c00c77e4d6847a0d91926 Mon Sep 17 00:00:00 2001 From: Frank Date: Tue, 1 Sep 2026 14:47:54 -0700 Subject: [PATCH] docs: Seerr service page, index entry, and 2026-09-01 work log --- serverAppConfigs-docs/Dankclaw/Seerr.md | 39 +++++++++++++++++++++++++ serverAppConfigs-docs/index.md | 1 + serverAppConfigs-docs/log.md | 6 ++++ 3 files changed, 46 insertions(+) create mode 100644 serverAppConfigs-docs/Dankclaw/Seerr.md diff --git a/serverAppConfigs-docs/Dankclaw/Seerr.md b/serverAppConfigs-docs/Dankclaw/Seerr.md new file mode 100644 index 0000000..3a6c3f9 --- /dev/null +++ b/serverAppConfigs-docs/Dankclaw/Seerr.md @@ -0,0 +1,39 @@ +# Seerr + +Seerr is the unified request manager for the *arr stack (the maintained `seerr-team/seerr` successor to the archived Overseerr/Jellyseerr line). Frank's household uses it to request movies/TV/music; Seerr routes approvals to Sonarr/Radarr/Lidarr/Readarr on FrankBook-Pro and pushes downloads to qBittorrent. + +**Host:** Dankclaw — **Hostname:** `seerr.franksdank.cloud` (Caddy, guarded) — **Docs:** https://github.com/seerr-team/seerr + +## Facts (verified live, 2026-09-01) + +| Item | Value | +|------|-------| +| Image | `ghcr.io/seerr-team/seerr:v3.4.1` (runs as in-image `node`, uid 1000) | +| Port | 5055 (container), published `127.0.0.1:5055` on the host (loopback-only) | +| Data | `/home/dank/Containers/seerr/data` → `/app/config` (SQLite settings store) | +| Unit | `dankclaw/seerr/quadlet/seerr.container` → `seerr.service` | +| Network | `dankclaw_default` (post-auth listener reachability) | +| Guard | Caddy TLS edge → Anubis :8923 → Authentik outpost provider `seerr-proxy` → Caddy :8017 `@seerr` handler → `seerr:5055` | +| DNS | Pi-hole addn-hosts + Porkbun public A `seerr.franksdank.cloud → 192.168.0.143` | + +## Why loopback-only publishing + +Seerr is browser-facing; the only sanctioned user path is the guard chain (Caddy → Anubis → Authentik SSO). `PublishPort=127.0.0.1:5055:5055` keeps the app off the LAN entirely while still letting the homepage probe agent and host-local checks reach it — the same loopback convention as other guarded hosts (see [[Homepage Design Grilling]]). + +## *arr wiring + +Seerr reaches the *arr services on FrankBook-Pro (192.168.0.112, gluetun-NetNS stack inside the Mac's podman machine VM) by IP-based base URLs (`http://192.168.0.112:`), configured inside Seerr's own web settings — not in env or quadlet. The `.lan` hostname variant was deliberately dropped: addn-hosts records are for fleet public-domain hosts, and IP bases match the Mac stack's verified LAN reachability. API keys live in each arr's config.xml on the Mac and are entered through Seerr's settings store. + +OIDC single-sign-on for Seerr (Authentik OIDC provider + Seerr OIDC config) remains an open option; the guard chain already authenticates the front door, so this is an in-app setting deferred to Frank's first-run session. + +## UID mapping gotcha + +The container runs as `node` (uid 1000 in-image). Rootless podman's continuous mapping is container uid N → host uid `100000 + N - 1`, so uid 1000 → **100999**. The first deploy chowned the data dir to 100999 + 1 (= 101000) and crash-looped with `EACCES mkdir /app/config/logs`. Rule: read the real mapping from any container's `/proc/self/uid_map` before chowning bind roots for non-root images. + +## Deployment + +`./scripts/deploy.sh dankclaw --service seerr`. The deployer pre-creates the bind-source dir, installs the unit, and restarts. First visit after deploy: complete the Seerr local-admin setup wizard (the guard chain bounces through Authentik first). TLS issuance for a new vhost fires at Caddy reload (dns-01) — allow ~15 s before the first HTTPS probe. + +## Citations + +- Seerr image and volume contract: https://github.com/seerr-team/seerr (official docs recommend `/app/config` persistence) diff --git a/serverAppConfigs-docs/index.md b/serverAppConfigs-docs/index.md index 98a42f6..cf7b6fc 100644 --- a/serverAppConfigs-docs/index.md +++ b/serverAppConfigs-docs/index.md @@ -67,6 +67,7 @@ covers both workloads). - [[Hermes-WebUI]] — the Hermex server (loopback API for the iPhone app, SSH-tunneled) - [[Gitea]] — Git hosting (migrated) - [[Postgres]] — Gitea database backend +- [[Seerr]] — unified *arr request manager (guard-chained; fronts FrankBook-Pro's stack) ## Infrastructure diff --git a/serverAppConfigs-docs/log.md b/serverAppConfigs-docs/log.md index 036877e..6e542f2 100644 --- a/serverAppConfigs-docs/log.md +++ b/serverAppConfigs-docs/log.md @@ -221,3 +221,9 @@ timestamp: 2026-09-14 - `frankbook-pro` — full 7-service deploy run: gluetun + qbittorrent SKIP cleanly (WireGuard credentials pending — the Mac needs its own peer; reusing Dankclaw's key would flip its tunnel), prowlarr/sonarr/radarr/lidarr/readarr deployed, healthy, and reachable from dankserver over the LAN via the socat LaunchAgents (192.168.0.112). - jellyfin GPU posture on dankserver: `AddDevice=/dev/dri` + `GroupAdd=keep-groups` in the unit (parity with pre-migration reality — no `/dev/nvidia*` in the container, no working VA-API driver in the image; the old bare container had the same. CPU/direct-play serves the household). - `/docs/Infrastructure/FrankBook-Pro.md` (new), `/docs/index.md` — documented the Mac stack: VM placement, WireGuard gate, deploy flow, socat LaunchAgents, and the qBittorrent PBKDF2 seed. +- `/dankclaw/seerr/quadlet/seerr.container` — New Seerr (seerr-team/seerr v3.4.1) request-manager unit on Dankclaw: loopback-only publish 127.0.0.1:5055, SQLite under /home/dank/Containers/seerr/data, on dankclaw_default for the post-auth route. +- `/dankclaw/Caddyfile`, `/dankclaw/pihole/addn-hosts` — seerr.franksdank.cloud vhost (Anubis guard + :8017 @seerr post-auth handler) and LAN DNS record, deployed in lockstep with the Authentik outpost provider `seerr-proxy` (external_host https://seerr.franksdank.cloud/, internal_host http://caddy:8017) and the Porkbun A record 192.168.0.143. +- `/scripts/deploy-remote.sh` — deploy_seerr handler (install_quadlet + pre-create bind dir + restart). +- `/tests/seerr_quadlet.bats` — new seam: boot persistence, self-healing, pinned tag, loopback-only publish, data-root contract, appnet join, no env/envfile secrets. +- `/serverAppConfigs-docs/Dankclaw/Seerr.md`, `/serverAppConfigs-docs/index.md` — service doc + index entry. +- Lessons: rootless podman uid mapping is continuous (container N → host 100000+N-1; uid 1000 → 100999 — an off-by-one chown EACCES-crash-looped first boot); new quadlet bind-source dirs must pre-exist on target (statfs 125 otherwise); new vhost TLS issues at Caddy reload (~15 s dns-01), not at first request.