dankserver: quadlet units + deploy handlers for romm trio, jellyfin, calibre-web, copyparty

Cutover of the six surviving dankserver services from compose-era bare containers to boot-persistent Quadlet units (WantedBy=default.target; podman 5.x v1 generator honors it at user-manager start). Units are faithful to live inspect ground truth (image pins = running tags, not compose inventory): - romm trio shares one data root: /home/dank/Containers/romm mounted whole at /romm; mariadb datadir and redis data dir live inside it. Aliases mariadb/ redis preserved on dankserver_appnet via Network=...:alias=. Secrets stay in the host-local env file (EnvironmentFile + ${VAR} expansion in the generated ExecStart, gitea precedent). copyparty passes its admin account via Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD} (Exec= not Command=: the v1 generator hard-fails on Command=); entropy stays rw only there. - jellyfin keeps every creation-time env as Environment= lines (zero drift); Device=/dev/dri + GroupAdd=keep-groups preserve hardware transcoding. - calibre-web pins the exact running image tag (id 986277563e76 = 0.6.27-ls397), pasta network preserved. Deployer: first-cutover handlers retire the old container, rescue unshadowed anonymous-volume content (podman volume export + tar --skip-old-files), mv data roots on the same fs, then start units in dependency order with health gates. Re-deploys restart only the selected unit. deploy-plan.py maps compose keys mariadb/redis to the new unit names; allowlists updated. New seam test tests/dankserver_quadlet.bats pins boot-persistence + v1-generator contract; test-changed.sh maps the new dirs to it. Full suite green (209 tests).
2026-09-01 04:14:08 -07:00
parent 11638442e7
commit b206f477ad
11 changed files with 425 additions and 11 deletions
@@ -0,0 +1,43 @@
+# Quadlet unit: Calibre-Web library server (rootless, boot-persistent).
+#
+# Install path on dankserver:
+# ~/.config/containers/systemd/calibre-web.container
+# Unit name: calibre-web.service (podman 5.x drops the container- prefix)
+#
+# The data roots already lived under /home/dank/Containers/calibre-web in the
+# compose era; this unit keeps those exact paths. The image pin is the exact
+# tag of the image the live container runs (image id 986277563e76), so the
+# cutover recreation changes zero bits of application code. No secrets: this
+# unit takes no EnvironmentFile.
+
+[Unit]
+Description=Calibre-Web library server container
+After=network.target
+
+[Container]
+ContainerName=calibre-web
+Image=lscr.io/linuxserver/calibre-web:0.6.27-ls397
+Network=pasta
+Environment=DOCKER_MODS=linuxserver/mods:universal-calibre
+Environment=LANG=en_US.UTF-8
+Environment=LANGUAGE=en_US.UTF-8
+Environment=LSIO_FIRST_PARTY=true
+Environment=OAUTHLIB_RELAX_TOKEN_SCOPE=1
+Environment=PGID=1000
+Environment=PUID=1000
+Environment=QTWEBENGINE_CHROMIUM_FLAGS=--no-sandbox
+Environment=S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0
+Environment=S6_STAGE2_HOOK=/docker-mods
+Environment=TERM=xterm
+Environment=TZ=America/Vancouver
+Environment=VIRTUAL_ENV=/lsiopy
+PublishPort=8083:8083
+Volume=/home/dank/Containers/calibre-web/config:/config
+Volume=/home/dank/Containers/calibre-web/books:/books
+
+[Service]
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target
@@ -0,0 +1,37 @@
+# Quadlet unit: Copyparty file server (rootless, boot-persistent).
+#
+# Install path on dankserver: ~/.config/containers/systemd/copyparty.container
+# Unit name: copyparty.service (podman 5.x drops the container- prefix)
+#
+# The image's default entrypoint is /bin/ash /z/cpp.sh -c /z/initcfg; the
+# Command= line below reproduces the compose-era argv exactly: the admin
+# account is passed as -a <user>:<password>. ${COPAY_ACCOUNT} and
+# ${COPAY_PASSWORD} are expanded by systemd at ExecStart time from the
+# host-local env file /home/dank/Containers/copyparty/env (mode 0600).
+# This file holds no secrets. The deployer refuses to start this unit before
+# that env file exists, so a missing env file fails the unit instead of
+# creating an admin account with a garbage password.
+#
+# /w is the entropy volume: copyparty's dank admin account is the only write
+# path into it; every other service mounts the share read-only or not at all.
+
+[Unit]
+Description=Copyparty file server container
+After=network.target
+
+[Container]
+ContainerName=copyparty
+Image=ghcr.io/9001/copyparty-ac:latest
+Network=dankserver_appnet
+EnvironmentFile=/home/dank/Containers/copyparty/env
+Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD} -v /w::r:ra,dank
+Volume=/mnt/entropy:/w
+Volume=/home/dank/Containers/copyparty/cfg:/cfg
+
+[Service]
+EnvironmentFile=/home/dank/Containers/copyparty/env
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target
@@ -0,0 +1,58 @@
+# Quadlet unit: Jellyfin media server (rootless, boot-persistent).
+#
+# Install path on dankserver: ~/.config/containers/systemd/jellyfin.container
+# Unit name: jellyfin.service (podman 5.x drops the container- prefix)
+#
+# Data roots migrated from /opt/jellyfin to /home/dank/Containers/jellyfin at
+# cutover. The entropy volume is mounted read-only: nothing automated ever
+# writes there; copyparty is the only write path for /mnt/entropy. Every
+# creation-time environment variable of the compose-era container is kept as
+# an Environment= line (zero drift); none of them are secrets, so this unit
+# needs no EnvironmentFile.
+
+[Unit]
+Description=Jellyfin media server container
+After=network.target
+
+[Container]
+ContainerName=jellyfin
+Image=ghcr.io/jellyfin/jellyfin:latest
+Network=dankserver_appnet
+Environment=DEBIAN_FRONTEND=noninteractive
+Environment=DOTNET_SYSTEM_IO_DISABLEFILELOCKING=true
+Environment=JELLYFIN_CACHE_DIR=/cache
+Environment=JELLYFIN_CONFIG_DIR=/config/config
+Environment=JELLYFIN_DATA_DIR=/config
+Environment=JELLYFIN_FFMPEG=/usr/lib/jellyfin-ffmpeg/ffmpeg
+Environment=JELLYFIN_LOG_DIR=/config/log
+Environment=JELLYFIN_PublishedServerUrl=http://192.168.0.235:8096
+Environment=JELLYFIN_WEB_DIR=/jellyfin/jellyfin-web
+Environment=LANG=en_US.UTF-8
+Environment=LANGUAGE=en_US:en
+Environment=LC_ALL=en_US.UTF-8
+Environment=LD_PRELOAD=/usr/lib/jellyfin/libjemalloc.so.2
+Environment=MALLOC_TRIM_THRESHOLD_=131072
+Environment=NVIDIA_DRIVER_CAPABILITIES=compute,video,utility
+Environment=NVIDIA_VISIBLE_DEVICES=all
+Environment=XDG_CACHE_HOME=/cache
+PublishPort=8096:8096
+PublishPort=8920:8920
+PublishPort=7359:7359/udp
+PublishPort=1900:1900/udp
+Volume=/home/dank/Containers/jellyfin/config:/config
+Volume=/home/dank/Containers/jellyfin/cache:/cache
+Volume=/mnt/entropy/Movies:/data/movies:ro
+Volume=/mnt/entropy/TVShows:/data/shows:ro
+Device=/dev/dri
+GroupAdd=keep-groups
+HealthCmd=curl -f http://localhost:8096/health
+HealthInterval=30s
+HealthTimeout=10s
+HealthRetries=3
+
+[Service]
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target
@@ -0,0 +1,34 @@
+# Quadlet unit: MariaDB backing store for RomM (rootless, boot-persistent).
+#
+# Install path on dankserver: ~/.config/containers/systemd/romm-mariadb.container
+# Unit name: romm-mariadb.service (podman 5.x drops the container- prefix)
+#
+# The alias `mariadb` on dankserver_appnet is what makes DB_HOST=mariadb in
+# the RomM unit resolve. Secrets (MARIADB_ROOT_PASSWORD, MARIADB_PASSWORD)
+# live in the shared host-local env file /home/dank/Containers/romm/env
+# (mode 0600); this file holds no secrets.
+
+[Unit]
+Description=RomM MariaDB database container
+After=network.target
+
+[Container]
+ContainerName=romm-mariadb
+Image=docker.io/library/mariadb:11
+Network=dankserver_appnet:alias=mariadb
+EnvironmentFile=/home/dank/Containers/romm/env
+Environment=MARIADB_DATABASE=romm
+Environment=MARIADB_USER=romm
+Volume=/home/dank/Containers/romm/mariadb:/var/lib/mysql
+HealthCmd=mariadb-admin ping -h localhost
+HealthInterval=10s
+HealthTimeout=5s
+HealthRetries=3
+
+[Service]
+EnvironmentFile=/home/dank/Containers/romm/env
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target
@@ -0,0 +1,28 @@
+# Quadlet unit: Redis cache for RomM (rootless, boot-persistent).
+#
+# Install path on dankserver: ~/.config/containers/systemd/romm-redis.container
+# Unit name: romm-redis.service (podman 5.x drops the container- prefix)
+#
+# The alias `redis` on dankserver_appnet is what makes REDIS_HOST=redis in
+# the RomM unit resolve. No secrets: this unit takes no EnvironmentFile.
+
+[Unit]
+Description=RomM Redis cache container
+After=network.target
+
+[Container]
+ContainerName=romm-redis
+Image=docker.io/library/redis:7-alpine
+Network=dankserver_appnet:alias=redis
+Volume=/home/dank/Containers/romm/redis:/data
+HealthCmd=redis-cli ping
+HealthInterval=10s
+HealthTimeout=5s
+HealthRetries=3
+
+[Service]
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target
@@ -0,0 +1,42 @@
+# Quadlet unit: RomM library manager (rootless, boot-persistent).
+#
+# Install path on dankserver: ~/.config/containers/systemd/romm.container
+# Unit name: romm.service (podman 5.x drops the container- prefix)
+#
+# The whole data root lives at /home/dank/Containers/romm and is mounted at
+# /romm, so config/, library/, resources/ and assets/ sit inside it exactly as
+# the compose-era bind mounts + anonymous volume did. Secrets (DB_PASSWD,
+# ROMM_AUTH_SECRET_KEY, ROMM_PASSWORD, SCREENSCRAPER_DEV_*) live in the
+# host-local env file /home/dank/Containers/romm/env (mode 0600); this file
+# holds no secrets. The network dankserver_appnet must exist before first
+# start (it is the compose-era network; on a fresh host create it first).
+
+[Unit]
+Description=RomM library manager container
+Wants=romm-mariadb.service
+After=romm-mariadb.service romm-redis.service network.target
+
+[Container]
+ContainerName=romm
+Image=ghcr.io/rommapp/romm:latest
+Network=dankserver_appnet
+EnvironmentFile=/home/dank/Containers/romm/env
+Environment=DB_HOST=mariadb
+Environment=DB_NAME=romm
+Environment=DB_USER=romm
+Environment=REDIS_HOST=redis
+Environment=HASHEOUS_API_ENABLED=true
+PublishPort=8085:8080
+Volume=/home/dank/Containers/romm:/romm
+HealthCmd=curl -f http://localhost:8080/health
+HealthInterval=30s
+HealthTimeout=10s
+HealthRetries=3
+
+[Service]
+EnvironmentFile=/home/dank/Containers/romm/env
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target
@@ -42,8 +42,8 @@ SERVICE_ORDER = (
    "authentik-outpost",
    "caddy",
    "homepage",
-    "mariadb",
-    "redis",
+    "romm-mariadb",
+    "romm-redis",
    "romm",
    "copyparty",
    "jellyfin",
@@ -89,8 +89,8 @@ DANKCLAW_SERVICES = {
 }

 DANKSERVER_SERVICES = {
-    "mariadb",
-    "redis",
+    "romm-mariadb",
+    "romm-redis",
    "romm",
    "copyparty",
    "jellyfin",
@@ -134,6 +134,8 @@ DANKSERVER_COMPOSE_SERVICES = {
    "lidarr",
    "readarr",
 }
+COMPOSE_NAME_MAP = {"mariadb": "romm-mariadb", "redis": "romm-redis"}
+


 def _add(services: set[str], *names: str) -> None:
@@ -191,7 +193,7 @@ def compose_changes(repo: str, target: str, base: str, head: str) -> set[str]:
    # An unavailable or malformed revision is safer as a broad compose plan
    # than as a silent no-op. It still cannot include LLM units.
    if (old_doc and not new_doc) or (new_doc and not old_doc and names):
-        return allowed
+        return {COMPOSE_NAME_MAP.get(n, n) for n in allowed}

    # Top-level networks/configuration can affect every compose service even
    # when no individual service mapping changed. Ignore the services key while
@@ -199,9 +201,10 @@ def compose_changes(repo: str, target: str, base: str, head: str) -> set[str]:
    old_globals = {key: value for key, value in old_doc.items() if key != "services"}
    new_globals = {key: value for key, value in new_doc.items() if key != "services"}
    if old_globals != new_globals:
-        return allowed
+        return {COMPOSE_NAME_MAP.get(n, n) for n in allowed}

-    return {name for name in names if name in allowed and old.get(name) != new.get(name)}
+    changed = {name for name in names if name in allowed and old.get(name) != new.get(name)}
+    return {COMPOSE_NAME_MAP.get(n, n) for n in changed}


 def services_for_path(path: str, target: str) -> set[str]:
@@ -297,7 +300,17 @@ def services_for_path(path: str, target: str) -> set[str]:

    if parts[0] == "dankserver":
        if len(parts) >= 2 and parts[1] == "compose.yaml":
-            _add(services, *DANKSERVER_COMPOSE_SERVICES)
+            # Compose service keys map onto the deployed unit names.
+            _add(services, *(COMPOSE_NAME_MAP.get(n, n) for n in DANKSERVER_COMPOSE_SERVICES))
+            return services
+        if len(parts) >= 3 and parts[2] == "quadlet":
+            quadlet_services = {
+                "romm": {"romm", "romm-mariadb", "romm-redis"},
+                "jellyfin": {"jellyfin"},
+                "calibre-web": {"calibre-web"},
+                "copyparty": {"copyparty"},
+            }
+            _add(services, *quadlet_services.get(parts[1], set()))
        return services

    if parts[0] == "scripts":
@@ -92,7 +92,7 @@ service_is_allowed() {
        dankclaw:caddy|dankclaw:homepage|\
        dankclaw:frank-default-large|dankclaw:frank-default-npu|\
        dankclaw:frank-default-sightsound|\
-        dankserver:mariadb|dankserver:redis|dankserver:romm|\
+        dankserver:romm-mariadb|dankserver:romm-redis|dankserver:romm|\
        dankserver:copyparty|dankserver:jellyfin|dankserver:calibre-web|\
        dankserver:prowlarr|dankserver:qbittorrent|dankserver:radarr|\
        dankserver:sonarr|dankserver:lidarr|dankserver:readarr|\
@@ -526,6 +526,108 @@ wait_container_healthy() {
    return 1
 }

+# --- dankserver media/library stack ----------------------------------------------
+# These services migrated from compose-era bare containers to boot-persistent
+# Quadlet units installed from this repo (podman 5.x v1 generator honors the
+# WantedBy=default.target inside each .container file). The first deploy of a
+# service retires the old container and migrates the data root before starting
+# the unit; re-running the handler on an already-active unit restarts only the
+# selected unit.
+
+migrate_data_root() { # $1 = old /opt path, $2 = new data-root path (same fs: rename)
+    local from="$1" to="$2"
+    [[ -d "$from" ]] || return 0
+    mv -- "$from" "$to"
+    chown -R "$(id -u):$(id -g)" "$to"
+}
+
+deploy_romm_stack() {
+    local service="$1" unit vol tmp
+    case "$service" in
+        mariadb) service=romm-mariadb ;;
+        redis) service=romm-redis ;;
+    esac
+    for unit in romm-mariadb romm-redis romm; do
+        cp "dankserver/romm/quadlet/$unit.container" "$quadlet_unit_dir/"
+    done
+    systemctl --user daemon-reload
+    if ! systemctl --user is-active --quiet romm-mariadb.service; then
+        # First cutover: the env file must exist before the first start, or
+        # the units would boot with empty secrets. Fail before stopping anything.
+        [[ -f /home/dank/Containers/romm/env ]] || {
+            echo "FAIL: /home/dank/Containers/romm/env does not exist; seed it before the first romm deploy" >&2
+            return 1
+        }
+        # Capture anonymous volume names while the containers are still inspectable,
+        # then stop and rm the compose-era trio.
+        local vols
+        vols="$(podman inspect -f '{{range .Mounts}}{{if eq .Type "volume"}}{{.Name}} {{end}}{{end}}' romm 2>/dev/null || true)"
+        podman stop -t 60 romm-mariadb romm-redis romm || true
+        podman rm romm-mariadb romm-redis romm || true
+        for vol in $vols; do
+            tmp="$(mktemp -d)"
+            podman volume export --output "$tmp/v.tar" "$vol"
+            # --skip-old-files keeps live bind-mounted content (config/, library/,
+            # resources/, mariadb/, redis/) and rescues only unshadowed entries like assets/.
+            tar --skip-old-files -C /home/dank/Containers/romm -xf "$tmp/v.tar"
+            rm -rf -- "$tmp"
+        done
+        migrate_data_root /opt/romm /home/dank/Containers/romm
+        systemctl --user start romm-mariadb.service
+        wait_container_healthy romm-mariadb 120 || return 1
+        systemctl --user start romm-redis.service
+        wait_container_healthy romm-redis 60 || return 1
+        if [[ "$service" == "romm" ]]; then
+            systemctl --user start romm.service
+        fi
+        return 0
+    fi
+    systemctl --user restart "$service.service"
+}
+
+deploy_jellyfin() {
+    cp "dankserver/jellyfin/quadlet/jellyfin.container" "$quadlet_unit_dir/"
+    systemctl --user daemon-reload
+    if ! systemctl --user is-active -q jellyfin.service; then
+        podman stop -t 30 jellyfin || true
+        podman rm jellyfin || true
+        migrate_data_root /opt/jellyfin /home/dank/Containers/jellyfin
+    fi
+    systemctl --user restart jellyfin.service
+}
+
+deploy_calibre_web() {
+    cp "dankserver/calibre-web/quadlet/calibre-web.container" "$quadlet_unit_dir/"
+    systemctl --user daemon-reload
+    if ! systemctl --user is-active -q calibre-web.service; then
+        # The compose-era container ran under a podman-generate-systemd unit; stop
+        # that unit first so its Restart=always cannot resurrect the old container
+        # and collide with the new ContainerName.
+        systemctl --user stop container-calibre-web.service 2>/dev/null || true
+        podman stop calibre-web || true
+        podman rm calibre-web || true
+    fi
+    systemctl --user restart calibre-web.service
+}
+
+deploy_copyparty() {
+    # The admin account is created from ${COPAY_ACCOUNT}:${COPAY_PASSWORD} expanded
+    # at ExecStart time; a missing env file must fail the unit, not boot copyparty
+    # with a garbage admin password.
+    [[ -f /home/dank/Containers/copyparty/env ]] || {
+        echo "FAIL: /home/dank/Containers/copyparty/env does not exist; seed it before the first copyparty deploy" >&2
+        return 1
+    }
+    cp "dankserver/copyparty/quadlet/copyparty.container" "$quadlet_unit_dir/"
+    systemctl --user daemon-reload
+    if ! systemctl --user is-active -q copyparty.service; then
+        podman stop -t 15 copyparty || true
+        podman rm copyparty || true
+        migrate_data_root /opt/copyparty /home/dank/Containers/copyparty
+    fi
+    systemctl --user restart copyparty.service
+}
+
 deploy_authentik() {
    local unit
    mkdir -p "$quadlet_unit_dir"
@@ -696,6 +798,10 @@ deploy_service() {
        frank-default-npu) deploy_llm_npu ;;
        frank-default-sightsound) deploy_llm_sightsound ;;
        hermes|hermes-dashboard|hermes-webui) deploy_hermes ;;
+        romm|romm-mariadb|romm-redis|mariadb|redis) deploy_romm_stack "$service" ;;
+        jellyfin) deploy_jellyfin ;;
+        calibre-web) deploy_calibre_web ;;
+        copyparty) deploy_copyparty ;;
        *) deploy_compose_service "$service" ;;
    esac
 }
@@ -122,8 +122,8 @@ valid_service() {
        dankclaw:authentik-worker|dankclaw:authentik-outpost|dankclaw:anubis|\
        dankclaw:frank-default-large|dankclaw:frank-default-npu|\
        dankclaw:frank-default-sightsound|\
-        dankserver:mariadb|dankserver:redis|dankserver:romm|dankserver:copyparty|\
-        dankserver:jellyfin|dankserver:calibre-web|dankserver:prowlarr|\
+        dankserver:romm-mariadb|dankserver:romm-redis|dankserver:romm|\
+        dankserver:copyparty|dankserver:jellyfin|dankserver:calibre-web|dankserver:prowlarr|\
        dankserver:qbittorrent|dankserver:radarr|dankserver:sonarr|\
        dankserver:lidarr|dankserver:readarr|dankserver:node-exporter|\
        dankserver:frank-default-small)
@@ -205,6 +205,14 @@ for path in "${CHANGED[@]}"; do
        old/scripts/*|old/scripts/**)
            add_test tests/scripts_syntax.bats
            ;;
+        # Cutover-era dankserver quadlet units (romm trio, jellyfin, calibre-web,
+        # copyparty): the seam checks boot-persistence + v1-generator contract;
+        # deploy-flow seams guard the deployer routing that installs them.
+        dankserver/romm/*|dankserver/jellyfin/*|dankserver/calibre-web/*|dankserver/copyparty/*)
+            add_test tests/dankserver_quadlet.bats
+            add_test tests/deployment_flow.bats
+            add_test tests/deployment_scoping.bats
+            ;;
        report/*)
            # Frozen audit reports are point-in-time artifacts; not testable.
            ;;
@@ -0,0 +1,45 @@
+#!/usr/bin/env bats
+# Seam: the six cutover-era dankserver quadlet units (romm trio, jellyfin,
+# calibre-web, copyparty) must keep their boot-persistence and v1-generator
+# contracts. The podman 5.x v1 Quadlet generator silently drops or hard-fails
+# on several keys; these tests pin the contract that keeps the units loadable
+# and secret-free in the repo.
+
+load helpers
+
+@test "all six cutover units exist under dankserver/<svc>/quadlet/" {
+    for unit in romm/quadlet/romm romm/quadlet/romm-mariadb romm/quadlet/romm-redis jellyfin/quadlet/jellyfin calibre-web/quadlet/calibre-web copyparty/quadlet/copyparty; do
+        [ -f "$REPO_ROOT/dankserver/$unit.container" ] || return 1
+    done
+}
+
+@test "every cutover unit is boot-persistent (WantedBy=default.target)" {
+    for unit in romm/quadlet/romm romm/quadlet/romm-mariadb romm/quadlet/romm-redis jellyfin/quadlet/jellyfin calibre-web/quadlet/calibre-web copyparty/quadlet/copyparty; do
+        grep -q '^WantedBy=default.target$' "$REPO_ROOT/dankserver/$unit.container" || return 1
+    done
+}
+
+@test "copyparty uses Exec= not Command= (v1 generator hard-fails on Command=)" {
+    unit="$REPO_ROOT/dankserver/copyparty/quadlet/copyparty.container"
+    grep -q '^Command=' "$unit" && return 1
+    grep -q '^Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD}' "$unit" || return 1
+}
+
+@test "copyparty and romm consume host-local env files, never in-repo secrets" {
+    grep -q '^EnvironmentFile=/home/dank/Containers/copyparty/env$' \
+        "$REPO_ROOT/dankserver/copyparty/quadlet/copyparty.container" || return 1
+    for unit in romm/quadlet/romm romm/quadlet/romm-mariadb; do
+        grep -q '^EnvironmentFile=/home/dank/Containers/romm/env$' \
+            "$REPO_ROOT/dankserver/$unit.container" || return 1
+    done
+    # No literal credential may ever appear in a tracked unit file: the only
+    # Exec= arguments must be variable expansions, never a literal account:secret.
+    ! grep -qE '\-a [A-Za-z0-9]+:[A-Za-z0-9]' "$REPO_ROOT/dankserver/copyparty/quadlet/copyparty.container" || return 1
+}
+
+@test "romm db services keep their service-discovery aliases on the appnet" {
+    grep -q '^Network=dankserver_appnet:alias=mariadb$' \
+        "$REPO_ROOT/dankserver/romm/quadlet/romm-mariadb.container" || return 1
+    grep -q '^Network=dankserver_appnet:alias=redis$' \
+        "$REPO_ROOT/dankserver/romm/quadlet/romm-redis.container" || return 1
+}