docs: rename frank-default-large/small/sightsound to frank-large/small/npu across vault

Mechanical identity rename across the knowledge base, AGENTS.md, README, the
hermes config example, and homepage services.json. No behavior change; served
aliases on the LLM endpoints change with the deploy of commit 69f87c8.

serverAppConfigs-docs/Dankserver/mariadb.md

@@ -1,47 +1,82 @@
+---
+type: reference
+title: MariaDB (RomM Backend)
+description: MariaDB 11 database backend for RomM on Dankserver — quadlet unit, network alias, env-file secret handling, and backup path.
+tags: [mariadb, romm, dankserver]
+timestamp: 2026-09-03T00:00:00Z
+---
+
 # MariaDB (RomM Backend)
 
-MariaDB 11 provides the database backend for RomM on Dankserver. RomM 5.2.0 requires MariaDB (or PostgreSQL) for its data store.
+MariaDB 11 provides the database backend for [[RomM]] on Dankserver. RomM's
+current release requires MariaDB (or PostgreSQL) for its data store; this
+deployment uses MariaDB.
 
-**Host:** Dankserver — **Docs:** https://mariadb.com/kb/en/docker-mariadb-information/
+**Host:** Dankserver — container name `romm-mariadb`, unit
+`romm-mariadb.service` (user-manager quadlet from
+`dankserver/romm/quadlet/romm-mariadb.container`).
 
-## Facts
+## Facts (verified from the live unit)
 
 | Item | Value |
 |------|-------|
-| Image | `docker.io/mariadb:11` |
-| Port | 3306 (internal, within `appnet`) |
-| Database name | `romm` |
-| Data volume | `/opt/romm/mariadb` |
+| Image | `docker.io/library/mariadb:11` |
+| Port | 3306 — internal only; the unit publishes **no** port, so the DB is unreachable from the host network by construction |
+| Network | `dankserver_appnet` with `alias=mariadb` — RomM reaches it via `DB_HOST=mariadb` |
+| Database / user | `romm` / `romm` |
+| Data volume | `/home/dank/Containers/romm/mariadb:/var/lib/mysql` |
+| Secrets | supplied via `EnvironmentFile=/home/dank/Containers/romm/env` (mode 0600, host-local — `MARIADB_ROOT_PASSWORD` and friends never enter the repo) |
 
-## Docker Compose
+## Unit shape (as deployed)
 
-```yaml
-mariadb:
-  image: docker.io/mariadb:11
-  container_name: romm-mariadb
-  restart: unless-stopped
-  environment:
-    MARIADB_ROOT_PASSWORD: "${MARIADB_ROOT_PASSWORD}"
-    MARIADB_DATABASE: romm
-    MARIADB_USER: "${ROMM_DB_USER}"
-    MARIADB_PASSWORD: "${ROMM_DB_PASSWD}"
-  volumes:
-    - /opt/romm/mariadb:/var/lib/mysql
-  healthcheck:
-    test: ["CMD", "mariadb-admin", "ping", "-h", "localhost"]
-    interval: 10s
-    timeout: 5s
-    retries: 3
+```ini
+[Unit]
+Description=RomM mariadb container
+After=network.target
+Wants=romm-redis.service
+
+[Container]
+ContainerName=romm-mariadb
+Image=docker.io/library/mariadb:11
+Network=dankserver_appnet:alias=mariadb
+EnvironmentFile=/home/dank/Containers/romm/env
+Environment=MARIADB_DATABASE=romm
+Environment=MARIADB_USER=romm
+Volume=/home/dank/Containers/romm/mariadb:/var/lib/mysql
+HealthCmd=mariadb-admin ping -h localhost
+HealthInterval=30s
+HealthTimeout=10s
+HealthRetries=3
+
+[Service]
+Restart=always
+RestartSec=5
 ```
 
+`MARIADB_ROOT_PASSWORD` and `MARIADB_PASSWORD` are read from the env file at
+container-create time (`EnvironmentFile=` appears in both `[Container]` and
+`[Service]` so `podman generate systemd`-style regeneration keeps them). The
+root password is a real secret — per repo secret rules it lives only in the
+host-local env file, never in git.
+
+## Boot order
+
+RomM declares `Wants=romm-mariadb.service` + `After=romm-mariadb.service`, so
+a cold boot starts the database first; the health ping (`mariadb-admin ping`)
+is what marks the unit healthy for anything gating on it.
+
 ## Backup
 
-Back up the volume directory periodically:
+Back up the volume directory periodically (stop-free: rsync of a quiet DB dir):
 
 ```bash
-sudo rsync -a /opt/romm/mariadb /mnt/backup/romm-mariadb/
+sudo rsync -a /home/dank/Containers/romm/mariadb /mnt/backup/romm-mariadb/
 ```
 
+For consistency-critical dumps prefer `mariadb-dump` over file copy; the data
+dir copy is only safe while RomM traffic is idle.
+
 ## See Also
 
 - [[RomM]] — service that uses this database
+- [[redis]] — the sibling cache/queue container on the same network