2 Commits

Include renames

Author	SHA1	Message	Date
Frank	65bd5ccea7	feat(rank6): node-exporter renders from a template; guard chain is one snippet ... - service-map render node-exporter-unit --host H: the MIRROR pair comment ('keep this file in step') becomes a template. Per-host title, LAN address from the hosts map, port from the node-<host> scrape job. Both tracked quadlets are now rendered artifacts; check_drift gates them. - dankclaw/Caddyfile: the nine verbatim Anubis pre-auth chains (reverse_proxy anubis:8923 + X-Real-Ip) collapse into the (guarded) named snippet; guarded vhosts are 'import guarded'. Validated with real caddy 2.11.7 (import resolution clean; the stock image stops at the porkbun module and the git basicauth placeholder, as designed). - vhost-scoped guard greps (authentik, homepage_caddy, marreta_quadlet) now pin 'import guarded' in the vhost block. - Service Inventory + Authentik docs carry the new laws.	2026-10-13 22:40:50 -07:00
Frank	73e46a1d85	marreta: content-cleaning proxy on Dankclaw, gluetun netns, guard-chained ... Deploy manualdousuario/marreta (Laravel / serversideup php:8.4-fpm-nginx) as a rootless Quadlet pair (marreta + marreta-browser/Lightpanda), both joining gluetun's netns so all fetch egress exits the same ProtonVPN tunnel as SearXNG. - marreta relocated to NGINX_HTTP_PORT=8085 (netns already has searxng on 8080); gluetun publishes 8082:8085; Caddy dials 192.168.0.143:8082. - Guard chain: marreta.franksdank.cloud -> Anubis :8923 -> Authentik -> post-auth :8017 @marreta -> 8082. Access = any authenticated user. - Secrets seeded to /home/dank/Containers/marreta/env (0600) from MARRETA_APP_KEY / MARRETA_ADMIN_EMAIL / MARRETA_ADMIN_PASSWORD. - deploy-plan.py: marreta joins the gluetun netns family. - New seam tests/marreta_quadlet.bats (17 contracts); scoping test updated for the widened netns family. Doc: Dankclaw/Marreta.md + index + log.	2026-09-12 10:09:12 -07:00