feat: initialize serverAppConfigs with podman stacks for Dankserver and Dankclaw

- Dankserver stack: RomM, Copyparty, Calibre-Web, node-exporter
- Dankclaw stack: Gluetun VPN (SearXNG tunnel), SearXNG+Valkey, ComfyUI
  (CPU backend), OpenWebUI, Hermes, Gitea+Postgres (migrated), Caddy
  reverse proxy, Grafana+Prometheus+Loki+Alloy observability
- Caddyfiles with .local hostname convention and basicauth homepage
- bind-mount storage policy, no named volumes
- deploy.sh mirroring vllmScripts git workflow (push -> pull -> restart -> health)
- docs/ Obsidian vault: per-service docs from frank-default-small research
  subagents (promtail EOL -> Alloy; gitea SECRET_KEY preservation; ComfyUI --cpu)
- bats test suite at 6 seams — 22 tests green

shared/alloy/config.alloy

@@ -0,0 +1,37 @@
+// Alloy configuration — ships host and container logs to Loki.
+// One instance per host. Deployed to /opt/alloy/config/config.alloy.
+
+logging {
+  level = "info"
+}
+
+// Local listener so the container healthcheck can probe us.
+server {
+  http_listen_addr = "0.0.0.0:12345"
+  grpc_listen_addr = "0.0.0.0:12346"
+}
+
+// Ship logs to Loki (container name on the podman network).
+loki.write "default" {
+  endpoint {
+    url = "http://loki:3100/loki/api/v1/push"
+  }
+}
+
+// Systemd journal from the host socket.
+loki.source.journal "journal" {
+  format_as_json = true
+  labels = {
+    job = "systemd-journal",
+  }
+  forward_to = [loki.write.default.receiver]
+}
+
+// Container logs (podman storage path; adjust for docker).
+loki.source.file "containers" {
+  targets = [
+    {__path__ = "/var/lib/containers/storage/overlay-containers/*/userdata/ctr.log", job = "podman"},
+    {__path__ = "/var/log/containers/*.log", job = "containers"},
+  ]
+  forward_to = [loki.write.default.receiver]
+}

shared/homepage/app.js

@@ -0,0 +1,79 @@
+// Dankclaw homepage status checker.
+// Loads services.json, renders cards, probes each service URL for up/down.
+(function () {
+  "use strict";
+
+  function probe(url, timeoutMs) {
+    // Same-origin fetch only; cross-origin will throw -> counted as checking
+    // via proxy. For LAN hostnames Caddy proxies everything, so URLs here are
+    // Caddy hostnames and fetch works same-origin.
+    var controller = new AbortController();
+    var timer = setTimeout(function () { controller.abort(); }, timeoutMs);
+    return fetch(url, { signal: controller.signal, cache: "no-store" })
+      .then(function (r) { return r.ok; })
+      .catch(function () { return false; })
+      .finally(function () { clearTimeout(timer); });
+  }
+
+  function card(svc) {
+    var el = document.createElement("article");
+    el.className = "card";
+
+    var top = document.createElement("div");
+    top.className = "top";
+    var badge = document.createElement("span");
+    badge.className = "badge checking";
+    badge.title = "checking";
+    var h2 = document.createElement("h2");
+    h2.textContent = svc.name;
+    top.appendChild(badge);
+    top.appendChild(h2);
+
+    var desc = document.createElement("p");
+    desc.textContent = svc.description;
+
+    var links = document.createElement("div");
+    links.className = "links";
+    var aOpen = document.createElement("a");
+    aOpen.href = svc.url;
+    aOpen.target = "_blank";
+    aOpen.rel = "noopener";
+    aOpen.textContent = "Open";
+    var aDocs = document.createElement("a");
+    aDocs.href = svc.docs;
+    aDocs.textContent = "Docs";
+    links.appendChild(aOpen);
+    links.appendChild(aDocs);
+
+    el.appendChild(top);
+    el.appendChild(desc);
+    el.appendChild(links);
+    return { el: el, badge: badge };
+  }
+
+  fetch("services.json")
+    .then(function (r) { return r.json(); })
+    .then(function (data) {
+      var grid = document.getElementById("services");
+      data.services.forEach(function (svc) {
+        var c = card(svc);
+        grid.appendChild(c.el);
+        // For the homepage itself, mark up immediately.
+        if (svc.url === "/") {
+          c.badge.className = "badge up";
+          c.badge.title = "up";
+          return;
+        }
+        probe(svc.url, 6000).then(function (ok) {
+          c.badge.className = "badge " + (ok ? "up" : "down");
+          c.badge.title = ok ? "up" : "down";
+        });
+      });
+    })
+    .catch(function (err) {
+      var grid = document.getElementById("services");
+      var p = document.createElement("p");
+      p.textContent = "Failed to load services.json: " + err.message;
+      grid.appendChild(p);
+    });
+})();

shared/homepage/dankserver.services.json

@@ -0,0 +1,35 @@
+{
+  "host": "dankserver",
+  "services": [
+    {
+      "name": "Homepage",
+      "url": "/",
+      "description": "This page. Password-protected service index.",
+      "docs": "docs/Infrastructure/Homepage.md"
+    },
+    {
+      "name": "RomM",
+      "url": "http://romm.dankserver.local",
+      "description": "Retro game manager and player for the ROM collection.",
+      "docs": "docs/Dankserver/RomM.md"
+    },
+    {
+      "name": "Copyparty",
+      "url": "http://files.dankserver.local",
+      "description": "High-speed file sharing and streaming server.",
+      "docs": "docs/Dankserver/Copyparty.md"
+    },
+    {
+      "name": "Calibre-Web",
+      "url": "http://books.dankserver.local",
+      "description": "E-book library browser and reader.",
+      "docs": "docs/Dankserver/Calibre-Web.md"
+    },
+    {
+      "name": "Plex",
+      "url": "http://plex.dankserver.local",
+      "description": "Media server (existing host service, proxied).",
+      "docs": "docs/Dankserver/Dankserver Stack.md"
+    }
+  ]
+}

shared/homepage/index.html

@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Dankclaw Services</title>
+<link rel="stylesheet" href="style.css">
+</head>
+<body>
+<main>
+  <header>
+    <h1>Dankclaw Services</h1>
+    <p class="subtitle">Local server services — click a name to open it.</p>
+  </header>
+  <section id="services" class="grid" aria-live="polite"></section>
+  <footer>
+    <p>Status is checked from this page. See <a href="docs/Infrastructure/Homepage.md">Homepage</a> for details.</p>
+  </footer>
+</main>
+<script src="app.js"></script>
+</body>
+</html>

shared/homepage/services.json

@@ -0,0 +1,59 @@
+{
+  "host": "dankclaw",
+  "services": [
+    {
+      "name": "Homepage",
+      "url": "/",
+      "description": "This page. Password-protected service index.",
+      "docs": "docs/Infrastructure/Homepage.md"
+    },
+    {
+      "name": "SearXNG",
+      "url": "http://search.dankclaw.local",
+      "description": "Privacy-respecting metasearch engine (through Gluetun VPN).",
+      "docs": "docs/Dankclaw/SearXNG.md"
+    },
+    {
+      "name": "ComfyUI",
+      "url": "http://comfyui.dankclaw.local",
+      "description": "Node-based AI image generation (CPU backend on Strix Halo).",
+      "docs": "docs/Dankclaw/ComfyUI.md"
+    },
+    {
+      "name": "OpenWebUI",
+      "url": "http://chat.dankclaw.local",
+      "description": "Chat interface for local LLMs (llama.cpp on :7770).",
+      "docs": "docs/Dankclaw/OpenWebUI.md"
+    },
+    {
+      "name": "Hermes",
+      "url": "http://hermes.dankclaw.local",
+      "description": "Self-improving AI agent (Nous Research).",
+      "docs": "docs/Dankclaw/Hermes.md"
+    },
+    {
+      "name": "Gitea",
+      "url": "http://gitea.dankclaw.local",
+      "description": "Self-hosted Git service with issues and PRs.",
+      "docs": "docs/Dankclaw/Gitea.md"
+    },
+    {
+      "name": "Grafana",
+      "url": "http://grafana.dankclaw.local",
+      "description": "Dashboards for metrics and logs.",
+      "docs": "docs/Infrastructure/Grafana.md"
+    },
+    {
+      "name": "Prometheus",
+      "url": "http://prometheus.dankclaw.local",
+      "description": "Metrics collection for the whole stack.",
+      "docs": "docs/Infrastructure/Prometheus.md"
+    },
+    {
+      "name": "Loki",
+      "url": "http://loki.dankclaw.local",
+      "description": "Log storage and query backend.",
+      "docs": "docs/Infrastructure/Loki.md"
+    }
+  ]
+}

shared/homepage/style.css

@@ -0,0 +1,63 @@
+:root {
+  --bg: #0f1115;
+  --card: #171a21;
+  --border: #2a2f3a;
+  --text: #e6e8eb;
+  --muted: #8b93a1;
+  --up: #3fb950;
+  --down: #f85149;
+  --accent: #58a6ff;
+}
+
+* { box-sizing: border-box; margin: 0; padding: 0; }
+
+body {
+  background: var(--bg);
+  color: var(--text);
+  font-family: system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
+  line-height: 1.5;
+  min-height: 100vh;
+}
+
+main { max-width: 960px; margin: 0 auto; padding: 2rem 1.5rem; }
+
+header { margin-bottom: 2rem; }
+h1 { font-size: 2rem; font-weight: 650; letter-spacing: -0.02em; }
+.subtitle { color: var(--muted); margin-top: 0.25rem; }
+
+.grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
+  gap: 1rem;
+}
+
+.card {
+  background: var(--card);
+  border: 1px solid var(--border);
+  border-radius: 10px;
+  padding: 1rem 1.1rem;
+  display: flex;
+  flex-direction: column;
+  gap: 0.4rem;
+  transition: border-color 0.15s ease;
+}
+
+.card:hover { border-color: var(--accent); }
+
+.card .top { display: flex; align-items: center; gap: 0.6rem; }
+.card h2 { font-size: 1.05rem; font-weight: 600; }
+
+.badge {
+  width: 10px; height: 10px; border-radius: 50%;
+  background: var(--muted); flex-shrink: 0;
+}
+.badge.up { background: var(--up); box-shadow: 0 0 6px var(--up); }
+.badge.down { background: var(--down); box-shadow: 0 0 6px var(--down); }
+.badge.checking { background: var(--accent); }
+
+.card p { color: var(--muted); font-size: 0.9rem; }
+.card .links { margin-top: auto; display: flex; gap: 1rem; font-size: 0.85rem; }
+.card a { color: var(--accent); text-decoration: none; }
+.card a:hover { text-decoration: underline; }
+
+footer { margin-top: 2.5rem; color: var(--muted); font-size: 0.8rem; }

shared/loki/loki-config.yaml

@@ -0,0 +1,48 @@
+# Loki configuration — single-binary mode for a small homelab.
+# Deployed to /opt/loki/config/loki-config.yaml on Dankclaw.
+
+auth_enabled: false
+
+server:
+  http_listen_port: 3100
+  grpc_listen_port: 9096
+
+common:
+  path_prefix: /loki
+  storage:
+    filesystem:
+      chunks_directory: /loki/chunks
+      rules_directory: /loki/rules
+  replication_factor: 1
+  ring:
+    instance_addr: 127.0.0.1
+    kvstore:
+      store: inmemory
+
+schema_config:
+  configs:
+    - from: "2024-01-01"
+      store: tsdb
+      object_store: filesystem
+      schema: v13
+      index:
+        prefix: index_
+        period: 24h
+
+limits_config:
+  retention_period: 720h   # 30 days
+  allow_structured_metadata: true
+  volume_enabled: true
+
+compactor:
+  working_directory: /loki/compactor
+  compaction_interval: 10m
+  retention_enabled: true
+  retention_delete_delay: 2m
+  retention_delete_worker_count: 1
+
+ruler:
+  storage:
+    type: local
+    local:
+      directory: /loki/rules

shared/prometheus/prometheus.yml

@@ -0,0 +1,56 @@
+# Prometheus configuration for the homelab.
+# Deployed to /opt/prometheus/config/prometheus.yml on Dankclaw.
+
+global:
+  scrape_interval: 15s
+  scrape_timeout: 10s
+  evaluation_interval: 15s
+
+scrape_configs:
+  # Prometheus itself
+  - job_name: "prometheus"
+    static_configs:
+      - targets: ["localhost:9090"]
+
+  # Host metrics — both hosts
+  - job_name: "node-dankclaw"
+    static_configs:
+      - targets: ["192.168.0.143:9100"]
+
+  - job_name: "node-dankserver"
+    static_configs:
+      - targets: ["192.168.0.235:9100"]
+
+  # Gitea metrics
+  - job_name: "gitea"
+    static_configs:
+      - targets: ["gitea:3000"]
+    metrics_path: "/metrics"
+
+  # Grafana metrics
+  - job_name: "grafana"
+    static_configs:
+      - targets: ["grafana:3000"]
+    metrics_path: "/metrics"
+
+  # Loki metrics
+  - job_name: "loki"
+    static_configs:
+      - targets: ["loki:3100"]
+    metrics_path: "/metrics"
+
+  # ComfyUI (no native /metrics; probe the UI)
+  - job_name: "comfyui"
+    metrics_path: "/"
+    static_configs:
+      - targets: ["comfyui:8188"]
+
+  # Blackbox-style probes for service up/down
+  - job_name: "services"
+    metrics_path: "/"
+    static_configs:
+      - targets:
+          - "http://search.dankclaw.local"
+          - "http://chat.dankclaw.local"
+          - "http://gitea.dankclaw.local"
+          - "http://comfyui.dankclaw.local"

shared/searxng/settings.yml

@@ -0,0 +1,38 @@
+# SearXNG settings — deployed to /opt/searxng/config/settings.yml on Dankclaw.
+# Secret key and base URL come from environment variables (see .env.example).
+
+use_default_settings: true
+
+server:
+  secret_key: "${SEARXNG_SECRET}"
+  base_url: "${SEARXNG_BASE_URL}"
+  limiter: true
+  method: "POST"
+
+search:
+  default_lang: "en"
+  default_locale: "en-US"
+  safe_search: 0
+  formats:
+    - html
+    - json
+
+valkey:
+  url: "valkey://searxng-valkey:6379/0"
+
+outgoing:
+  request_timeout: 3.0
+  max_request_timeout: 10.0
+  pool_connections: 100
+  pool_maxsize: 20
+  enable_http2: true
+  keepalive_expiry: 5.0
+  retries: 3
+
+plugins:
+  searx.plugins.unit_converter.SXNGPlugin:
+    active: true
+  searx.plugins.calculator.SXNGPlugin:
+    active: true
+  searx.plugins.self_info.SXNGPlugin:
+    active: true