docs(arr): dankserver compose stack reactivated 2026-09-04; rootless identity model

serverAppConfigs-docs/Dankserver/ARR-Stack.md

@@ -1,19 +1,21 @@
 ---
 type: reference
 title: *arr Stack
-description: The *arr automation stack (Prowlarr, Sonarr, Radarr, Lidarr, Readarr, qBittorrent) on FrankBook-Pro — topology, wiring, auth posture, and gotchas.
-tags: [arr-stack, prowlarr, sonarr, radarr, lidarr, readarr, qbittorrent, frankbook-pro]
-timestamp: 2026-09-03T00:00:00Z
+description: The *arr automation stack (Prowlarr, Sonarr, Radarr, Lidarr, Readarr, qBittorrent) — FrankBook-Pro quadlets and the Dankserver compose deployment (reactivated 2026-09-04): topology, wiring, auth posture, and gotchas.
+tags: [arr-stack, prowlarr, sonarr, radarr, lidarr, readarr, qbittorrent, frankbook-pro, dankserver]
+timestamp: 2026-09-04T00:00:00Z
 ---
 
 # *arr Stack
 
 The *arr suite is a collection of automated media management tools for Usenet
-and BitTorrent. The stack runs on **FrankBook-Pro** — the Mac mini that fronts
-this household's downloads — as quadlet units inside its podman machine, not on
-Dankserver. It provides automatic downloading and library management that
-Copyparty alone does not cover: quality profile enforcement, series/movie
-discovery, metadata enrichment, and automated file organization.
+and BitTorrent. The stack runs in two places: **FrankBook-Pro** — the Mac mini
+that fronts this household's downloads — as quadlet units inside its podman
+machine (the documented wiring below), and on **Dankserver** as a compose
+stack behind six Caddy vhosts (reactivated 2026-09-04; see below). It provides
+automatic downloading and library management that Copyparty alone does not
+cover: quality profile enforcement, series/movie discovery, metadata
+enrichment, and automated file organization.
 
 The core chain is: **Prowlarr** (indexer API aggregator) →
 **Sonarr/Radarr/Lidarr/Readarr** (media-specific managers) → **qBittorrent**
@@ -49,21 +51,67 @@ qBittorrent is special: it shares the [[Gluetun]] container's network namespace
 IP. A netns-sharer publishes no ports of its own — qB's WebUI (8080) and
 BitTorrent port (6881 TCP+UDP) are published on the gluetun unit instead.
 
-## Historical design-era compose (retired)
+## Dankserver compose deployment (reactivated 2026-09-04)
 
-The original design deployed the stack on Dankserver via
-`dankserver/compose.yaml` with `/opt/<svc>/config` data roots and
-`TZ=America/New_York`. That layout is retired; `dankserver/compose.yaml` is
-kept as reference only. Reality (unit files above) wins: data roots are the
-Mac's `/Volumes/COMPLETE` (completed media) and `/Volumes/INCOMPLETE`
-(in-flight downloads) volumes, mounted into qB at identical paths, and every
-unit runs `TZ=America/Los_Angeles`.
+The original Dankserver compose stack (`dankserver/compose.yaml`,
+`/opt/<svc>/config` data roots) was committed 2026-08-29 but **never booted**:
+the config dirs were created root-owned (`root:root 755`), and every app
+crashed at logger init (`UnauthorizedAccessException: Access to the path
+'/config/Sentry' is denied`) before binding any port — which read as a dead
+port, not a boot crash, until `podman logs <svc>` was checked.
+
+Fix and restart (2026-09-04): `sudo chown -R 1000:1000
+/opt/{prowlarr,qbittorrent,radarr,sonarr,lidarr,readarr}/config`, then
+`podman-compose -f dankserver/compose.yaml up -d` for the six services. All
+six now serve 200 on their ports and through the Caddy vhosts.
+
+### Rootless identity model (verified, do not "fix" it)
+
+- On Dankserver's podman 5.7.0 rootless, a container's default user namespace
+  maps **container root (PUID=0) → host uid 1000 (dank)** and container uid
+  *N* → host `100000 + N - 1`. Verified via `/proc/<pid>/uid_map`
+  (`0 1000 1` / `1 100000 65536`) across plex, tautulli, jellyfin,
+  calibre-web, copyparty, romm, and the arr stack. This is why PUID=0
+  services write as `dank` and why data roots are owned `1000:1000`.
+- **Never add `userns_mode: host` to compose services here.** podman-compose
+  1.5.0 runs every compose service inside a pod, and podman rejects the
+  combination (`--userns and --pod cannot be set together`) — the stack then
+  fails to recreate with no recourse. The default mapping already gives the
+  fleet identity; PUID=0 + `1000:1000`-owned data roots is the whole recipe.
+- qBittorrent's first boot (PUID=0, empty config) prints a one-time WebUI
+  admin password in `podman logs qbittorrent` — persist it via the PBKDF2
+  recipe in [[qBittorrent]] before restarting the container.
+
+### Differences from the FrankBook-Pro deployment
+
+- **No gluetun on Dankserver:** this qBittorrent's torrent egress leaves via
+  the residential IP (the FrankBook qB is the VPN-gated one). Route
+  privacy-sensitive grabs through FrankBook-Pro.
+- **Empty config:** the Dankserver arrs have no indexers, no qB download
+  clients, and no quality profiles configured — the Chain wiring section
+  below describes FrankBook-Pro. Configure test-first per that section if
+  wiring this stack up.
+- **Six vhosts:** `prowlarr/sonarr/radarr/lidarr/readarr/qbittorrent
+  .franksdank.cloud` are exempt from the Anubis chain (own auth) with a
+  documented exemption reason per the guard policy.
+- Homepage: Sonarr sits in the user section; Prowlarr/Radarr/Readarr/Lidarr/
+  qBittorrent sit in admin.
+
+## Historical note
+
+The compose file briefly carried `userns_mode: host` on all six services
+(2026-09-04, reverted same day in `e454159`) — an incorrect fix for the boot
+crash that podman-compose 1.5.0 could not apply anyway (pod/userns conflict
+above). The real fix was the chown; see the identity model section.
 
 ## Access / auth posture
 
-There is **no Caddy vhost for any arr app** — the *arr stack is exempt by
-construction from the Anubis guard chain (its own auth). The stack is reached
-directly by IP:port on the LAN (`http://<frankbook-pro>:8989` etc.).
+No *arr app sits behind the Anubis guard chain — the stack is exempt by
+construction (its own auth), with an exemption comment in the Caddyfile per
+vhost. FrankBook-Pro's stack is reached directly by IP:port on the LAN
+(`http://<frankbook-pro>:8989` etc.); the Dankserver stack additionally has
+six TLS vhosts (`<svc>.franksdank.cloud`) that terminate on Caddy on Dankclaw
+and route to Dankserver's published ports.
 
 Auth-config history (verified live 2026-08-29): all five arrs shipped with
 `AuthenticationMethod=None` **plus** `AuthenticationRequired=Enabled`. On the