frankbook-pro: *arr stack + qbittorrent quadlets inside podman machine

Seven units installed INSIDE the Mac VM (/home/core/.config/containers/
systemd) by a new deploy_frankbook_stack handler: gluetun (ProtonVPN
WireGuard, env-file credentials, publishes qbit's 8080/6881), qbittorrent
(Network=gluetun.container, verbatim /Volumes data roots, first-boot
config seed with fresh machine-local WebUI password and the Finished
Torrents category), and prowlarr/sonarr/radarr/lidarr/readarr (grab-only,
config migrated from dankserver at provisioning, readarr pinned to
amd64-1.0.980). deploy.sh routes the new target through the ssh-config
alias with REMOTE_SHELL=/usr/local/bin/bash (macOS bash 3.2 lacks
associative arrays); the planner learns FRANKBOOK_SERVICES and the
gluetun->qbittorrent netns pairing; new seam test pins the contract.

scripts/deploy.sh

@@ -7,7 +7,7 @@
 # restarted only when its own files (or the shared chat template) are selected.
 #
 # Usage:
-#   ./scripts/deploy.sh <dankclaw|dankserver> [--service NAME]... [--dry-run]
+#   ./scripts/deploy.sh <dankclaw|dankserver|frankbook-pro> [--service NAME]... [--dry-run]
 #
 # Without --service, the planner selects services changed since origin/main and
 # the remote runner also applies pending service changes from its state store.
@@ -20,10 +20,11 @@ REPO_ROOT="$(cd -- "$SCRIPT_DIR/.." && pwd)"
 PLANNER="$SCRIPT_DIR/deploy-plan.py"
 REMOTE_USER="dank"
 REMOTE_DIR="/home/dank/serverAppConfigs"
+REMOTE_SHELL="bash"
 
 usage() {
     cat <<'EOF'
-Usage: deploy.sh <dankclaw|dankserver> [options]
+Usage: deploy.sh <dankclaw|dankserver|frankbook-pro> [options]
 
 Options:
   --service NAME  deploy only NAME (repeatable; bypasses automatic planning)
@@ -50,8 +51,21 @@ fi
 shift
 
 case "$TARGET" in
-    dankclaw) REMOTE_HOST="dankclaw" ;;
-    dankserver) REMOTE_HOST="dankserver" ;;
+    dankclaw)
+        REMOTE_HOST="dankclaw"
+        ;;
+    dankserver)
+        REMOTE_HOST="dankserver"
+        ;;
+    frankbook-pro)
+        REMOTE_HOST="frankbook-pro"
+        REMOTE_USER="dank"
+        REMOTE_DIR="/Users/dank/Projects/serverAppConfigs"
+        # macOS ships bash 3.2; the runner needs bash >= 4 (associative
+        # arrays). /usr/local/bin/bash is the Intel-homebrew interpreter,
+        # provisioned with the Mac checkout.
+        REMOTE_SHELL="/usr/local/bin/bash"
+        ;;
     *)
         echo "Unknown target: $TARGET" >&2
         usage >&2
@@ -126,7 +140,10 @@ valid_service() {
         dankserver:copyparty|dankserver:jellyfin|dankserver:calibre-web|dankserver:prowlarr|\
         dankserver:qbittorrent|dankserver:radarr|dankserver:sonarr|\
         dankserver:lidarr|dankserver:readarr|dankserver:node-exporter|\
-        dankserver:frank-default-small)
+        dankserver:frank-default-small|\
+        frankbook-pro:gluetun|frankbook-pro:qbittorrent|frankbook-pro:prowlarr|\
+        frankbook-pro:radarr|frankbook-pro:sonarr|frankbook-pro:lidarr|\
+        frankbook-pro:readarr)
             return 0
             ;;
         *)
@@ -174,7 +191,7 @@ else
 fi
 
 REMOTE="${REMOTE_USER}@${REMOTE_HOST}"
-REMOTE_ARGS=("$TARGET" "$HEAD_REVISION")
+REMOTE_ARGS=("$TARGET" "$HEAD_REVISION" "$REMOTE_DIR" "$REMOTE_SHELL")
 if [[ "${#EXPLICIT_SERVICES[@]}" -eq 0 ]]; then
     REMOTE_ARGS+=(--pending)
 fi
@@ -196,12 +213,15 @@ echo "[2/2] Pulling and deploying on $REMOTE_HOST..."
 # The target runner computes any pending revisions from its own state after
 # the pull. This keeps a target that missed an earlier service deployment
 # recoverable without restarting services that are already current.
-ssh "$REMOTE" bash -s -- "${REMOTE_ARGS[@]}" <<'REMOTE_EOF'
+ssh "$REMOTE" "$REMOTE_SHELL" -s -- "${REMOTE_ARGS[@]}" <<'REMOTE_EOF'
 set -euo pipefail
 TARGET="$1"
 EXPECTED_REVISION="$2"
-shift 2
-cd "/home/dank/serverAppConfigs"
+REPO_DIR="$3"
+REMOTE_SHELL="$4"
+shift 4
+export REMOTE_DIR="$REPO_DIR"
+cd "$REPO_DIR"
 OLD_REVISION="$(git rev-parse HEAD)"
 echo "  pulling origin/main..."
 git pull --ff-only origin main
@@ -210,7 +230,7 @@ if [[ "$NEW_REVISION" != "$EXPECTED_REVISION" ]]; then
     echo "FAIL: target checkout is $NEW_REVISION, expected $EXPECTED_REVISION" >&2
     exit 1
 fi
-exec ./scripts/deploy-remote.sh "$TARGET" "$NEW_REVISION" "$@" \
+exec "$REMOTE_SHELL" ./scripts/deploy-remote.sh "$TARGET" "$NEW_REVISION" "$@" \
     --from-revision "$OLD_REVISION"
 REMOTE_EOF