dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(inventory): one service inventory drives planner, allow-lists, and seams

Browse Source 
rank 3. shared/services.yml is the single source of truth for every
deployable service (hosts, unit dirs, units, path claims, tests, scrape/
dns/probe facts, aliases, stacks); scripts/service-map.py is its only
reader (hosts/services/allows/plan/seams/owner/units/stack/get/render/
check). deploy-plan.py becomes a thin CLI wrapper; both --service
allow-lists (deploy.sh, deploy-remote.sh) and the changed-test mapper are
the inventory. Selection semantics: host scoping (a host's tree selects
only its own services), the quadlet netns/network coupling graph resolved
across directories (gluetun's riders live in their own dirs), stacks, and
canonical restart order.

Against the pinned old-planner fixture: 921 raw deltas reduced to 17, all
intentional (anubis now maps; cross-host paths select nothing; the retired
qwen-sharp template plans nothing and the live froggeric template plans
frank-archon; dankserver/romm/romm.container, missed by the old filename
rule, plans the romm trio). The fixture is regenerated as the new pin.

Integrity gates: schema, unit claims, quadlet-file ownership, path-glob
liveness, Pi-hole hosts / Prometheus jobs / DNS / homepage probes drift.
tests/service_inventory.bats pins all of it plus the plan fixture and the
deploy-plan CLI. Allow-list grep seams in hermes_webui/observability_quadlet
become behavioral allows calls.
This commit is contained in:
Frank
2026-10-13 22:35:07 -07:00
parent 156ea71879
commit bdead570e2
17 changed files with 3435 additions and 699 deletions
Download Patch File Download Diff File Expand all files Collapse all files
shared/services.yml
+598
View File
@@ -0,0 +1,598 @@
# =============================================================================
# services.yml — THE service inventory.
#
# One entry per deployable service, in canonical deploy order (dependencies
# before consumers, the LLM fleet last). Four hand-maintained lists used to
# agree with each other by discipline alone; every one of them now READS this
# file:
#
# scripts/deploy-plan.py which services a changed path selects
# scripts/deploy-remote.sh which services a target accepts (allow-list)
# scripts/test-changed.sh which Bats seams a changed path must re-run
# scripts/service-map.py renderers + drift gates (`check`)
#
# `service-map.py check` is the referee: every quadlet unit file and every
# root unit in the tree is claimed by exactly one entry, every repo file is
# owned by a service or listed in `unowned:` with a reason, every seam exists,
# the rendered Pi-hole hosts file equals the render, and Prometheus' scrape
# targets plus the homepage probes equal the `scrape:` / `probe:` facts.
#
# --- fields ------------------------------------------------------------------
# name the deployer's service word == the systemd unit name for
# quadlet / root-unit / vm-quadlet kinds
# hosts targets that accept it (the deploy-remote.sh allow-list)
# kind quadlet rootless user unit from a .container file
# root-unit systemd system unit symlinked out of scripts/
# vm-quadlet quadlet inside the FrankBook-Pro podman machine
# host a host-level script/timer, no container
# deployed_by this service deploys as part of another deployable's handler
# (the trio/pair shape). It has no dirs/files of its own; the
# owner names the deployable whose handler installs it.
# unit_dir repo dir holding <unit>.container — a scalar, or a per-host map
# when one service carries its unit on two hosts (node-exporter)
# units container names this deployable owns (netns coupling is derived
# from the `Network=` lines in those files, never declared here)
# dirs repo dirs whose every file selects this service
# files exact repo files that select this service (root-unit trios,
# vendored templates, host scripts installed by this handler)
# retires files whose DELETION selects this service (the unit the
# handler must remove before it can claim the ports)
# only Dankserver's media stack still has one)
# health the deployer's readiness URL; `wait` its 2 s poll budget
# scrape Prometheus jobs: {job, target, metrics_path?, labels?}
# dns names this service answers at (rendered into the Pi-hole
# addn-hosts; every vhost resolves at the Dankclaw Caddy edge)
# probe host:port the homepage checker dials (per-host map if on 2 hosts)
# tests the Bats seams a change to this service must re-run
# =============================================================================
hosts:
dankclaw:
address: 192.168.0.143
# Caddy is consolidated on Dankclaw: it fronts every service on every
# host, so every DNS name in the fleet resolves here.
dns_edge: 192.168.0.143
dankserver:
address: 192.168.0.235
frankbook-pro:
address: 192.168.0.112
# Repo files no service owns. Each entry is a fact about the tree, not a
# fallback: the census gate fails on anything unowned that is NOT listed, so
# retirement work shrinks this list and a new stray file cannot slip in.
unowned:
shared/services.yml: the inventory this tool reads
scripts: repo tooling (build, fetch, bench, deploy, test); the deployers'
files are claimed by name in the service entries
autoresearch.sh: bench scratch at the repo root (retirement pending)
echo_prompt.txt: bench fixture at the repo root (retirement pending)
echo_request.json: bench fixture at the repo root (retirement pending)
prose_prompt.txt: bench fixture at the repo root (retirement pending)
prose_request.json: bench fixture at the repo root (retirement pending)
dankclaw/apply_qwen21_patch.py: retired patch script (its target runtime is gone)
dankclaw/comfyui-start.sh: superseded by the comfyui quadlet + Containerfile
dankclaw/udev: host udev rules, applied by manual sudo install + udevadm trigger
tests: the seams themselves
report: frozen point-in-time audit reports
old: retired scripts, reference only
.githooks: the commit hooks that run the seams
services:
# --- Search stack: one netns family, gluetun owns it ---------------------
- name: gluetun
hosts: [dankclaw]
kind: quadlet
unit_dir: dankclaw/searxng/quadlet
units: [gluetun]
tests: [tests/searxng_quadlet.bats]
# The tunnel's WireGuard bind — the homepage card for the tunnel itself.
probe: 127.0.0.1:51820
- name: searxng-valkey
hosts: [dankclaw]
kind: quadlet
unit_dir: dankclaw/searxng/quadlet
units: [searxng-valkey]
# The app-level law, not a network one: deploy_searxng_valkey restarts
# SearXNG after its cache, so the cache's files select both.
dependents: [searxng]
tests: [tests/searxng_quadlet.bats]
probe: 127.0.0.1:6379
- name: searxng
hosts: [dankclaw]
kind: quadlet
unit_dir: dankclaw/searxng/quadlet
units: [searxng]
dirs: [shared/searxng]
tests: [tests/searxng_limiter.bats, tests/searxng_quadlet.bats]
scrape:
- job: services
target: 192.168.0.143:8081
metrics_path: /
dns: [search.franksdank.cloud]
probe: 127.0.0.1:8081
- name: marreta
hosts: [dankclaw]
kind: quadlet
unit_dir: dankclaw/marreta/quadlet
units: [marreta, marreta-browser]
tests: [tests/marreta_quadlet.bats]
dns: [marreta.franksdank.cloud]
probe: 127.0.0.1:8082
# --- DNS ------------------------------------------------------------------
- name: pihole
hosts: [dankclaw]
kind: quadlet
unit_dir: dankclaw/pihole/quadlet
units: [pihole]
dirs: [dankclaw/pihole]
tests: [tests/pihole.bats, tests/docs_completeness.bats]
dns: [pihole.franksdank.cloud]
probe: 192.168.0.143:8083
# --- Chat front end -------------------------------------------------------
- name: open-webui
hosts: [dankclaw]
kind: quadlet
unit_dir: dankclaw/open-webui/quadlet
units: [open-webui]
tests: [tests/open_webui_quadlet.bats, tests/caddyfile.bats]
scrape:
- job: services
target: 192.168.0.143:3005
metrics_path: /
dns: [ai.franksdank.cloud]
probe: 127.0.0.1:3005
# --- Git hosting ----------------------------------------------------------
- name: gitea-postgres
hosts: [dankclaw]
kind: quadlet
unit_dir: dankclaw/gitea/quadlet
units: [gitea-postgres]
deployed_by: gitea-server
tests: [tests/caddyfile.bats, tests/docs_completeness.bats]
probe: 127.0.0.1:5432
- name: gitea-server
hosts: [dankclaw]
kind: quadlet
unit_dir: dankclaw/gitea/quadlet
units: [gitea-server]
tests: [tests/caddyfile.bats, tests/docs_completeness.bats]
scrape:
- job: gitea
target: 192.168.0.143:3000
metrics_path: /metrics
dns: [gitea.franksdank.cloud]
probe: 127.0.0.1:3000
# --- Image generation -----------------------------------------------------
- name: comfyui
hosts: [dankclaw]
kind: quadlet
unit_dir: dankclaw/comfyui/quadlet
units: [comfyui]
dirs: [dankclaw/comfyui]
files: [dankclaw/Containerfile.comfyui]
health: http://127.0.0.1:8188/
wait: 300
tests: [tests/comfyui_rocm.bats, tests/docs_completeness.bats]
scrape:
- job: comfyui
target: comfyui:8188
metrics_path: /
dns: [comfyui.franksdank.cloud]
probe: 127.0.0.1:8188
# --- Requests -------------------------------------------------------------
- name: seerr
hosts: [dankclaw]
kind: quadlet
unit_dir: dankclaw/seerr/quadlet
units: [seerr]
tests: [tests/seerr_quadlet.bats, tests/deployment_flow.bats]
dns: [seerr.franksdank.cloud]
probe: 127.0.0.1:5055
# --- Agent stack: one handler, four containers ----------------------------
- name: hermes
hosts: [dankclaw]
kind: quadlet
unit_dir: dankclaw/hermes/quadlet
units: [hermes, hermes-dashboard, hermes-webui, chrome-devtools-protocol]
dirs: [dankclaw/hermes]
tests: [tests/hermes_webui.bats, tests/docs_completeness.bats]
dns: [hermes.franksdank.cloud]
probe: 127.0.0.1:8787
- name: hermes-dashboard
hosts: [dankclaw]
kind: quadlet
deployed_by: hermes
tests: [tests/hermes_webui.bats, tests/docs_completeness.bats]
dns: [hermesadmin.franksdank.cloud]
probe: 192.168.0.143:9119
- name: hermes-webui
hosts: [dankclaw]
kind: quadlet
deployed_by: hermes
tests: [tests/hermes_webui.bats, tests/docs_completeness.bats]
# --- Observability --------------------------------------------------------
- name: prometheus
hosts: [dankclaw]
kind: quadlet
unit_dir: dankclaw/observability/quadlet
units: [prometheus]
dirs: [shared/prometheus]
tests: [tests/observability_quadlet.bats, tests/caddyfile.bats,
tests/docs_completeness.bats]
scrape:
- job: prometheus
target: localhost:9090
dns: [prometheus.franksdank.cloud]
probe: 127.0.0.1:9090
- name: grafana
hosts: [dankclaw]
kind: quadlet
unit_dir: dankclaw/observability/quadlet
units: [grafana]
dirs: [shared/grafana]
tests: [tests/observability_quadlet.bats, tests/caddyfile.bats,
tests/docs_completeness.bats]
scrape:
- job: grafana
target: grafana:3000
metrics_path: /metrics
dns: [grafana.franksdank.cloud]
probe: 127.0.0.1:3002
- name: loki
hosts: [dankclaw]
kind: quadlet
unit_dir: dankclaw/observability/quadlet
units: [loki]
dirs: [dankclaw/loki, shared/loki]
tests: [tests/observability_quadlet.bats, tests/caddyfile.bats,
tests/docs_completeness.bats]
scrape:
- job: loki
target: loki:3100
metrics_path: /metrics
dns: [loki.franksdank.cloud]
probe: 127.0.0.1:3100
- name: alloy
hosts: [dankclaw]
kind: quadlet
unit_dir: dankclaw/observability/quadlet
units: [alloy]
dirs: [dankclaw/alloy, shared/alloy]
tests: [tests/observability_quadlet.bats, tests/caddyfile.bats,
tests/docs_completeness.bats]
probe: 127.0.0.1:12345
- name: node-exporter
# One service on two hosts: the same exporter, its own unit per host.
hosts: [dankclaw, dankserver]
kind: quadlet
unit_dir:
dankclaw: dankclaw/observability/quadlet
dankserver: dankserver/observability/quadlet
units: [node-exporter]
tests: [tests/observability_quadlet.bats, tests/caddyfile.bats,
tests/docs_completeness.bats]
scrape:
- job: node-dankclaw
target: host.containers.internal:9100
- job: node-dankserver
target: 192.168.0.235:9100
probe: 127.0.0.1:9100
- name: alertmanager
hosts: [dankclaw]
kind: quadlet
unit_dir: dankclaw/observability/quadlet
units: [alertmanager]
# The Alertmanager config ships from Prometheus' directory, and the Signal
# relay is a HOST unit this handler installs: a change to either reaches
# the machine only through an alertmanager deploy.
files:
- shared/prometheus/alertmanager.yml
- scripts/signal-relay.py
- scripts/signal-relay.service
tests: [tests/observability_quadlet.bats, tests/caddyfile.bats,
tests/docs_completeness.bats]
probe: 127.0.0.1:9093
# --- Identity -------------------------------------------------------------
- name: authentik-postgres
hosts: [dankclaw]
kind: quadlet
unit_dir: dankclaw/authentik/quadlet
units: [authentik-postgres]
deployed_by: authentik-server
tests: [tests/authentik.bats]
- name: authentik-server
hosts: [dankclaw]
kind: quadlet
unit_dir: dankclaw/authentik/quadlet
units: [authentik-server]
tests: [tests/authentik.bats]
dns: [auth.franksdank.cloud]
- name: authentik-worker
hosts: [dankclaw]
kind: quadlet
unit_dir: dankclaw/authentik/quadlet
units: [authentik-worker]
deployed_by: authentik-server
tests: [tests/authentik.bats]
- name: authentik-outpost
hosts: [dankclaw]
kind: quadlet
unit_dir: dankclaw/authentik/quadlet
units: [authentik-outpost]
tests: [tests/authentik.bats]
- name: authentik-outpost-ldap
hosts: [dankclaw]
kind: quadlet
unit_dir: dankclaw/authentik/quadlet
units: [authentik-outpost-ldap]
tests: [tests/authentik.bats]
# --- The auth chain's edge, then the edge itself --------------------------
- name: anubis
hosts: [dankclaw]
kind: quadlet
unit_dir: dankclaw/anubis/quadlet
units: [anubis]
dirs: [dankclaw/anubis]
tests: [tests/anubis.bats, tests/caddyfile.bats, tests/homepage_caddy.bats]
- name: caddy
hosts: [dankclaw]
kind: quadlet
unit_dir: dankclaw/caddy/quadlet
units: [caddy]
dirs: [dankclaw/caddy]
files: [dankclaw/Caddyfile]
# Retiring the old split proxy selects Caddy: it must remove the installed
# unit and container before it can claim 80/443.
retires: [dankclaw/gitea/quadlet/gitea-caddy.container]
tests: [tests/caddy_quadlet.bats, tests/caddyfile.bats,
tests/homepage_caddy.bats, tests/docs_completeness.bats]
dns:
- franksdank.cloud
- www.franksdank.cloud
- dankclaw.franksdank.cloud
- dankserver.franksdank.cloud
probe: 127.0.0.1:80
- name: homepage
hosts: [dankclaw]
kind: host
dirs: [shared/homepage]
files:
- scripts/homepage-status.py
- scripts/homepage-status.service
- scripts/homepage-status.timer
tests: [tests/homepage_caddy.bats, tests/homepage_config.bats,
tests/homepage_deploy.bats, tests/homepage_pages.bats,
tests/homepage_checker.bats]
# --- Dankserver media stack ----------------------------------------------
# The romm trio is one handler and one directory: every file in it selects
# all three, exactly as the deployer restarts all three.
- name: romm-mariadb
hosts: [dankserver]
kind: quadlet
unit_dir: dankserver/romm/quadlet
units: [romm-mariadb]
deployed_by: romm
dirs: [dankserver/romm]
tests: [tests/dankserver_quadlet.bats, tests/deployment_flow.bats]
probe: 192.168.0.235:3306
- name: romm-redis
hosts: [dankserver]
kind: quadlet
unit_dir: dankserver/romm/quadlet
units: [romm-redis]
deployed_by: romm
dirs: [dankserver/romm]
tests: [tests/dankserver_quadlet.bats, tests/deployment_flow.bats]
- name: romm
hosts: [dankserver]
kind: quadlet
unit_dir: dankserver/romm/quadlet
units: [romm]
dirs: [dankserver/romm]
tests: [tests/dankserver_quadlet.bats, tests/deployment_flow.bats]
dns: [romm.franksdank.cloud]
probe: 192.168.0.235:8085
- name: copyparty
hosts: [dankserver]
kind: quadlet
unit_dir: dankserver/copyparty/quadlet
units: [copyparty]
tests: [tests/dankserver_quadlet.bats, tests/deployment_flow.bats]
dns: [files.franksdank.cloud]
probe: 192.168.0.235:3923
- name: jellyfin
hosts: [dankserver]
kind: quadlet
unit_dir: dankserver/jellyfin/quadlet
units: [jellyfin]
tests: [tests/dankserver_quadlet.bats, tests/deployment_flow.bats]
dns: [jelly.franksdank.cloud]
probe: 192.168.0.235:8096
- name: calibre-web
hosts: [dankserver]
kind: quadlet
unit_dir: dankserver/calibre-web/quadlet
units: [calibre-web]
tests: [tests/dankserver_quadlet.bats, tests/deployment_flow.bats]
dns: [books.franksdank.cloud]
probe: 192.168.0.235:8083
- name: calibre-server
hosts: [dankserver]
kind: quadlet
unit_dir: dankserver/calibre-server/quadlet
units: [calibre-server]
tests: [tests/dankserver_quadlet.bats, tests/deployment_flow.bats]
- name: plex
hosts: [dankserver]
kind: quadlet
unit_dir: dankserver/plex/quadlet
units: [plex]
tests: [tests/dankserver_quadlet.bats, tests/deployment_flow.bats]
dns: [plex.franksdank.cloud, plex.franksdank.casa]
probe: 192.168.0.235:32400
- name: tautulli
hosts: [dankserver]
kind: quadlet
unit_dir: dankserver/tautulli/quadlet
units: [tautulli]
tests: [tests/dankserver_quadlet.bats, tests/deployment_flow.bats]
probe: 192.168.0.235:8181
# --- FrankBook-Pro: the *arr stack inside the podman machine --------------
# Every container rides gluetun's netns, and that coupling is DERIVED: each
# arr's unit file says `Network=gluetun.container`, so a gluetun unit change
# selects the whole stack with no declaration here.
- name: gluetun
hosts: [frankbook-pro]
kind: vm-quadlet
unit_dir: frankbook-pro/gluetun/quadlet
units: [gluetun]
tests: [tests/frankbook_quadlet.bats, tests/deployment_flow.bats]
- name: prowlarr
hosts: [frankbook-pro]
kind: vm-quadlet
unit_dir: frankbook-pro/prowlarr/quadlet
units: [prowlarr]
tests: [tests/frankbook_quadlet.bats, tests/deployment_flow.bats]
dns: [prowlarr.franksdank.cloud]
probe: 192.168.0.112:9696
- name: qbittorrent
hosts: [frankbook-pro]
kind: vm-quadlet
unit_dir: frankbook-pro/qbittorrent/quadlet
units: [qbittorrent]
tests: [tests/frankbook_quadlet.bats, tests/deployment_flow.bats]
dns: [qbittorrent.franksdank.cloud]
probe: 192.168.0.112:8080
- name: radarr
hosts: [frankbook-pro]
kind: vm-quadlet
unit_dir: frankbook-pro/radarr/quadlet
units: [radarr]
tests: [tests/frankbook_quadlet.bats, tests/deployment_flow.bats]
dns: [radarr.franksdank.cloud]
probe: 192.168.0.112:7878
- name: sonarr
hosts: [frankbook-pro]
kind: vm-quadlet
unit_dir: frankbook-pro/sonarr/quadlet
units: [sonarr]
tests: [tests/frankbook_quadlet.bats, tests/deployment_flow.bats]
probe: 192.168.0.112:8989
- name: lidarr
hosts: [frankbook-pro]
kind: vm-quadlet
unit_dir: frankbook-pro/lidarr/quadlet
units: [lidarr]
tests: [tests/frankbook_quadlet.bats, tests/deployment_flow.bats]
dns: [lidarr.franksdank.cloud]
probe: 192.168.0.112:8686
- name: readarr
hosts: [frankbook-pro]
kind: vm-quadlet
unit_dir: frankbook-pro/readarr/quadlet
units: [readarr]
tests: [tests/frankbook_quadlet.bats, tests/deployment_flow.bats]
dns: [readarr.franksdank.cloud]
probe: 192.168.0.112:8787
# --- The LLM fleet (last: never implied by a generic change) --------------
- name: frank-dragoon
hosts: [dankclaw]
kind: root-unit
files:
- scripts/frank-dragoon.env
- scripts/frank-dragoon.service
- scripts/serve-frank-dragoon.sh
health: http://127.0.0.1:7770/health
wait: 1200
tests: [tests/frank_dragoon_unit.bats, tests/llm_units.bats,
tests/llm_deploy_gates.bats, tests/llm_secrets.bats,
tests/scripts_syntax.bats, tests/docs_completeness.bats]
scrape:
- job: frank-dragoon
target: host.containers.internal:7770
metrics_path: /metrics
labels: {service: frank-dragoon}
probe: 127.0.0.1:7770
- name: frank-zealot
hosts: [dankclaw]
kind: root-unit
files:
- scripts/frank-zealot.env
- scripts/frank-zealot.service
- scripts/serve-frank-zealot.sh
health: http://127.0.0.1:7771/health
wait: 900
tests: [tests/frank_zealot_unit.bats, tests/llm_units.bats,
tests/llm_deploy_gates.bats, tests/llm_secrets.bats,
tests/scripts_syntax.bats]
scrape:
- job: frank-zealot
target: host.containers.internal:7771
metrics_path: /metrics
labels: {service: frank-zealot}
probe: 127.0.0.1:7771
- name: frank-archon
hosts: [dankserver]
kind: root-unit
files:
- scripts/frank-archon.env
- scripts/frank-archon.service
- scripts/serve-frank-archon.sh
# The vendored chat template the engine renders with.
- scripts/qwen38-froggeric-v22.5.jinja
health: http://127.0.0.1:7770/health
wait: 900
tests: [tests/frank_archon_unit.bats, tests/llm_units.bats,
tests/llm_deploy_gates.bats, tests/llm_secrets.bats,
tests/scripts_syntax.bats]
scrape:
- job: frank-archon
target: 192.168.0.235:7770
metrics_path: /metrics
labels: {service: frank-archon}
probe: 192.168.0.235:7770