seerr: quadlet on dankclaw + guard-chain vhost + deployer wiring

Unit: ghcr.io/seerr-team/seerr:v3.4.1, loopback-only 5055 publish
(homepage probe; users go through Anubis->Authentik->caddy:8017->seerr),
Containers data root, no env secrets. Guard chain: seerr.franksdank.cloud
vhost behind anubis:8923 with post-auth handler on 8017; addn-hosts record;
homepage widget; deploy-remote/deploy-plan/deploy.sh routing; seam test.

scripts/deploy-plan.py

@@ -28,6 +28,7 @@ SERVICE_ORDER = (
     "gitea-postgres",
     "gitea-server",
     "comfyui",
+    "seerr",
     "hermes",
     "hermes-dashboard",
     "hermes-webui",
@@ -70,6 +71,7 @@ DANKCLAW_SERVICES = {
     "gitea-postgres",
     "gitea-server",
     "comfyui",
+    "seerr",
     "hermes",
     "hermes-dashboard",
     "prometheus",
@@ -269,7 +271,7 @@ def services_for_path(path: str, target: str) -> set[str]:
         if len(parts) >= 2 and parts[1] == "Containerfile.comfyui":
             _add(services, "comfyui")
             return services
-        if len(parts) >= 2 and parts[1] in {"caddy", "comfyui", "loki", "alloy", "hermes", "anubis"}:
+        if len(parts) >= 2 and parts[1] in {"caddy", "comfyui", "loki", "alloy", "hermes", "anubis", "seerr"}:
             _add(services, parts[1])
             return services
         if len(parts) >= 4 and parts[1] == "authentik" and parts[2] == "quadlet":

scripts/deploy-remote.sh

@@ -89,7 +89,7 @@ service_is_allowed() {
         dankclaw:loki|dankclaw:alloy|dankclaw:node-exporter|\
         dankclaw:authentik-postgres|dankclaw:authentik-server|\
         dankclaw:authentik-worker|dankclaw:authentik-outpost|dankclaw:anubis|\
-        dankclaw:caddy|dankclaw:homepage|\
+        dankclaw:caddy|dankclaw:homepage|dankclaw:seerr|\
         dankclaw:frank-default-large|dankclaw:frank-default-npu|\
         dankclaw:frank-default-sightsound|\
         dankserver:romm-mariadb|dankserver:romm-redis|dankserver:romm|\
@@ -952,6 +952,11 @@ VM_START
     echo "  $service answers on 127.0.0.1:$port"
 }
 
+deploy_seerr() {
+    install_quadlet seerr dankclaw/seerr/quadlet seerr
+    systemctl --user restart seerr.service
+}
+
 deploy_service() {
     local service="$1"
     if [[ "$TARGET" == "frankbook-pro" ]]; then
@@ -977,6 +982,7 @@ deploy_service() {
             deploy_authentik_outpost
             ;;
         anubis) deploy_anubis ;;
+        seerr) deploy_seerr ;;
         frank-default-large) deploy_llm_large ;;
         frank-default-small) deploy_llm_small ;;
         frank-default-npu) deploy_llm_npu ;;

scripts/deploy.sh

@@ -133,7 +133,7 @@ valid_service() {
         dankclaw:comfyui|dankclaw:hermes|dankclaw:hermes-dashboard|\
         dankclaw:hermes-webui|dankclaw:prometheus|dankclaw:grafana|dankclaw:loki|dankclaw:alloy|\
         dankclaw:node-exporter|dankclaw:authentik-postgres|dankclaw:authentik-server|\
-        dankclaw:authentik-worker|dankclaw:authentik-outpost|dankclaw:anubis|\
+        dankclaw:authentik-worker|dankclaw:authentik-outpost|dankclaw:anubis|dankclaw:seerr|\
         dankclaw:frank-default-large|dankclaw:frank-default-npu|\
         dankclaw:frank-default-sightsound|\
         dankserver:romm-mariadb|dankserver:romm-redis|dankserver:romm|\

scripts/test-changed.sh

@@ -221,6 +221,13 @@ for path in "${CHANGED[@]}"; do
             add_test tests/deployment_flow.bats
             add_test tests/deployment_scoping.bats
             ;;
+        # Seerr unit on dankclaw: boot persistence, loopback-only port
+        # posture, and the deployer routing that installs it.
+        dankclaw/seerr/*)
+            add_test tests/seerr_quadlet.bats
+            add_test tests/deployment_flow.bats
+            add_test tests/deployment_scoping.bats
+            ;;
         report/*)
             # Frozen audit reports are point-in-time artifacts; not testable.
             ;;