docs(arr): dankserver compose stack reactivated 2026-09-04; rootless identity model

serverAppConfigs-docs/log.md

@@ -11,6 +11,19 @@ timestamp: 2026-09-14
 
 # Bundle Change Log
 
+## 2026-09-04 — dankserver *arr stack reactivated; rootless identity model documented
+- ARR-Stack: the Dankserver compose deployment (committed 2026-08-29, never
+  booted — root-owned `/opt/<svc>/config` dirs crashed every app at logger
+  init before any port bound) is live as of 2026-09-04 behind six own-auth
+  TLS vhosts (`<svc>.franksdank.cloud`), all verified 200, homepage probes
+  green. Documented the verified rootless identity model — container root
+  (PUID=0) maps to host uid 1000 (dank) by default on podman 5.7.0
+  (`/proc/<pid>/uid_map` = `0 1000 1`, `1 100000 65536`), so data roots are
+  `1000:1000` and **`userns_mode` must never be added to compose services**
+  (podman-compose 1.5.0 runs services in pods; `--userns` + `--pod` is
+  rejected). FrankBook-Pro differences noted: no gluetun egress gate on the
+  Dankserver qB, empty (fresh) app configs, Sonarr in the homepage user
+  section and the rest in admin.
 ## 2026-09-03 — full fact-check sweep of the docs tree (docs-only, deploy no-op)
 - Scope: every page under `/serverAppConfigs-docs/` re-verified against live
   hosts (read-only SSH), quadlet unit files, and the Caddyfile; surgical edits