2 Commits

Include renames

Author	SHA1	Message	Date
Frank	d2810ab610	feat(security): digest-pin every registry image on all three hosts (fleet law) ... Closing the command-center security queue #70/#71/#72/#73/#74: rolling tags let a rebuild move under a running service with nobody approving it, and make a CVE audit ungradeable. 36 quadlet units across dankclaw, dankserver and frankbook-pro now carry tag@sha256; localhost/* builds stay exempt (their build is the pin). The pihole and copyparty pins pull the fixed builds; valkey 9.1.2 (already running) and redis 7.4.11 are pinned in place, vendor fixes TBD. New gate tests/quadlet_image_pins.bats: no unpinned registry image, no generator-rejected key anywhere. Three seams that pinned the old exact-tag law (frankbook readarr, open_webui, seerr) now require tag AND digest - strictly stronger. Quadlet Lifecycle docs: batch-abort law, entrypoint flags-only law, pin law.	2026-10-21 16:32:36 -07:00
Frank	f4c9b4f381	seerr: quadlet on dankclaw + guard-chain vhost + deployer wiring ... Unit: ghcr.io/seerr-team/seerr:v3.4.1, loopback-only 5055 publish (homepage probe; users go through Anubis->Authentik->caddy:8017->seerr), Containers data root, no env secrets. Guard chain: seerr.franksdank.cloud vhost behind anubis:8923 with post-auth handler on 8017; addn-hosts record; homepage widget; deploy-remote/deploy-plan/deploy.sh routing; seam test.	2026-09-01 14:40:10 -07:00