diff --git a/serverAppConfigs-docs/Dankserver/ARR-Stack.md b/serverAppConfigs-docs/Dankserver/ARR-Stack.md index ec76c83..2498c1c 100644 --- a/serverAppConfigs-docs/Dankserver/ARR-Stack.md +++ b/serverAppConfigs-docs/Dankserver/ARR-Stack.md @@ -1,19 +1,21 @@ --- type: reference title: *arr Stack -description: The *arr automation stack (Prowlarr, Sonarr, Radarr, Lidarr, Readarr, qBittorrent) on FrankBook-Pro — topology, wiring, auth posture, and gotchas. -tags: [arr-stack, prowlarr, sonarr, radarr, lidarr, readarr, qbittorrent, frankbook-pro] -timestamp: 2026-09-03T00:00:00Z +description: The *arr automation stack (Prowlarr, Sonarr, Radarr, Lidarr, Readarr, qBittorrent) — FrankBook-Pro quadlets and the Dankserver compose deployment (reactivated 2026-09-04): topology, wiring, auth posture, and gotchas. +tags: [arr-stack, prowlarr, sonarr, radarr, lidarr, readarr, qbittorrent, frankbook-pro, dankserver] +timestamp: 2026-09-04T00:00:00Z --- # *arr Stack The *arr suite is a collection of automated media management tools for Usenet -and BitTorrent. The stack runs on **FrankBook-Pro** — the Mac mini that fronts -this household's downloads — as quadlet units inside its podman machine, not on -Dankserver. It provides automatic downloading and library management that -Copyparty alone does not cover: quality profile enforcement, series/movie -discovery, metadata enrichment, and automated file organization. +and BitTorrent. The stack runs in two places: **FrankBook-Pro** — the Mac mini +that fronts this household's downloads — as quadlet units inside its podman +machine (the documented wiring below), and on **Dankserver** as a compose +stack behind six Caddy vhosts (reactivated 2026-09-04; see below). It provides +automatic downloading and library management that Copyparty alone does not +cover: quality profile enforcement, series/movie discovery, metadata +enrichment, and automated file organization. The core chain is: **Prowlarr** (indexer API aggregator) → **Sonarr/Radarr/Lidarr/Readarr** (media-specific managers) → **qBittorrent** @@ -49,21 +51,67 @@ qBittorrent is special: it shares the [[Gluetun]] container's network namespace IP. A netns-sharer publishes no ports of its own — qB's WebUI (8080) and BitTorrent port (6881 TCP+UDP) are published on the gluetun unit instead. -## Historical design-era compose (retired) +## Dankserver compose deployment (reactivated 2026-09-04) -The original design deployed the stack on Dankserver via -`dankserver/compose.yaml` with `/opt//config` data roots and -`TZ=America/New_York`. That layout is retired; `dankserver/compose.yaml` is -kept as reference only. Reality (unit files above) wins: data roots are the -Mac's `/Volumes/COMPLETE` (completed media) and `/Volumes/INCOMPLETE` -(in-flight downloads) volumes, mounted into qB at identical paths, and every -unit runs `TZ=America/Los_Angeles`. +The original Dankserver compose stack (`dankserver/compose.yaml`, +`/opt//config` data roots) was committed 2026-08-29 but **never booted**: +the config dirs were created root-owned (`root:root 755`), and every app +crashed at logger init (`UnauthorizedAccessException: Access to the path +'/config/Sentry' is denied`) before binding any port — which read as a dead +port, not a boot crash, until `podman logs ` was checked. + +Fix and restart (2026-09-04): `sudo chown -R 1000:1000 +/opt/{prowlarr,qbittorrent,radarr,sonarr,lidarr,readarr}/config`, then +`podman-compose -f dankserver/compose.yaml up -d` for the six services. All +six now serve 200 on their ports and through the Caddy vhosts. + +### Rootless identity model (verified, do not "fix" it) + +- On Dankserver's podman 5.7.0 rootless, a container's default user namespace + maps **container root (PUID=0) → host uid 1000 (dank)** and container uid + *N* → host `100000 + N - 1`. Verified via `/proc//uid_map` + (`0 1000 1` / `1 100000 65536`) across plex, tautulli, jellyfin, + calibre-web, copyparty, romm, and the arr stack. This is why PUID=0 + services write as `dank` and why data roots are owned `1000:1000`. +- **Never add `userns_mode: host` to compose services here.** podman-compose + 1.5.0 runs every compose service inside a pod, and podman rejects the + combination (`--userns and --pod cannot be set together`) — the stack then + fails to recreate with no recourse. The default mapping already gives the + fleet identity; PUID=0 + `1000:1000`-owned data roots is the whole recipe. +- qBittorrent's first boot (PUID=0, empty config) prints a one-time WebUI + admin password in `podman logs qbittorrent` — persist it via the PBKDF2 + recipe in [[qBittorrent]] before restarting the container. + +### Differences from the FrankBook-Pro deployment + +- **No gluetun on Dankserver:** this qBittorrent's torrent egress leaves via + the residential IP (the FrankBook qB is the VPN-gated one). Route + privacy-sensitive grabs through FrankBook-Pro. +- **Empty config:** the Dankserver arrs have no indexers, no qB download + clients, and no quality profiles configured — the Chain wiring section + below describes FrankBook-Pro. Configure test-first per that section if + wiring this stack up. +- **Six vhosts:** `prowlarr/sonarr/radarr/lidarr/readarr/qbittorrent + .franksdank.cloud` are exempt from the Anubis chain (own auth) with a + documented exemption reason per the guard policy. +- Homepage: Sonarr sits in the user section; Prowlarr/Radarr/Readarr/Lidarr/ + qBittorrent sit in admin. + +## Historical note + +The compose file briefly carried `userns_mode: host` on all six services +(2026-09-04, reverted same day in `e454159`) — an incorrect fix for the boot +crash that podman-compose 1.5.0 could not apply anyway (pod/userns conflict +above). The real fix was the chown; see the identity model section. ## Access / auth posture -There is **no Caddy vhost for any arr app** — the *arr stack is exempt by -construction from the Anubis guard chain (its own auth). The stack is reached -directly by IP:port on the LAN (`http://:8989` etc.). +No *arr app sits behind the Anubis guard chain — the stack is exempt by +construction (its own auth), with an exemption comment in the Caddyfile per +vhost. FrankBook-Pro's stack is reached directly by IP:port on the LAN +(`http://:8989` etc.); the Dankserver stack additionally has +six TLS vhosts (`.franksdank.cloud`) that terminate on Caddy on Dankclaw +and route to Dankserver's published ports. Auth-config history (verified live 2026-08-29): all five arrs shipped with `AuthenticationMethod=None` **plus** `AuthenticationRequired=Enabled`. On the diff --git a/serverAppConfigs-docs/log.md b/serverAppConfigs-docs/log.md index 67b0ba4..f68383f 100644 --- a/serverAppConfigs-docs/log.md +++ b/serverAppConfigs-docs/log.md @@ -11,6 +11,19 @@ timestamp: 2026-09-14 # Bundle Change Log +## 2026-09-04 — dankserver *arr stack reactivated; rootless identity model documented +- ARR-Stack: the Dankserver compose deployment (committed 2026-08-29, never + booted — root-owned `/opt//config` dirs crashed every app at logger + init before any port bound) is live as of 2026-09-04 behind six own-auth + TLS vhosts (`.franksdank.cloud`), all verified 200, homepage probes + green. Documented the verified rootless identity model — container root + (PUID=0) maps to host uid 1000 (dank) by default on podman 5.7.0 + (`/proc//uid_map` = `0 1000 1`, `1 100000 65536`), so data roots are + `1000:1000` and **`userns_mode` must never be added to compose services** + (podman-compose 1.5.0 runs services in pods; `--userns` + `--pod` is + rejected). FrankBook-Pro differences noted: no gluetun egress gate on the + Dankserver qB, empty (fresh) app configs, Sonarr in the homepage user + section and the rest in admin. ## 2026-09-03 — full fact-check sweep of the docs tree (docs-only, deploy no-op) - Scope: every page under `/serverAppConfigs-docs/` re-verified against live hosts (read-only SSH), quadlet unit files, and the Caddyfile; surgical edits