docs(caddy): the exposure gates measured, and the guarded set published
Live change first, docs in this PR: the authentik-guarded vhosts that had no
public A record are now published, so the admin tools are reachable from the
internet through the guard, not around it.
What changed in DNS (Porkbun, franksdank.cloud, ttl 300 → 71.227.227.172)
Created: grafana., prometheus., loki., seerr., marreta., notebook. —
the six names that were behind Anubis + authentik with no public record. The
other machinery was already in place: the 443 forward reaches Caddy, every vhost
has a DNS-01 certificate, and all eleven proxy providers are claimed by the
embedded outpost. marreta-proxy and prometheus-proxy had an external_host
without the trailing slash the fleet convention requires; both normalized.
Evidence
Anonymous path is enforced. With cookies cleared at CDP level
(Storage.clearCookies, verified cookiesLeft: 0), prometheus. and the www. control both land on auth.franksdank.cloud/if/flow/default-authentication-flow/ — the outpost
redirects, it does not serve the app. An earlier pass looked like Prometheus
was open; that was the shared browser's pre-existing authentik SSO session
silently re-authorizing (/outpost.goauthentik.io/start → authorize → callback), not a missing guard.
Authenticated path reaches the apps.prometheus. → query console, grafana. → Grafana /login with "Sign in with Authentik", notebook. → Open
Notebook password screen, marreta. → Marreta, seerr. → Seerr setup, loki. → its API (404 on /, it has no web UI).
Non-browser clients still get challenged: curl against each new name
returns the 7.4 KB Anubis page, not app bytes.
Propagation: authoritative NS and Quad9 answered immediately; 1.1.1.1 kept
NXDOMAIN for two names because it had cached the negative answer from the
earlier census (zone negative TTL 1800 s).
Docs
Infrastructure/Caddy.md § Gotchas now records the measured law — exposure is
two gates (the router's 80/443 forward, and Caddy's vhost list), so a public A
record buys discoverability, not access; internal-only means no A record — plus
the current posture (guarded set published; exempt self-authenticating names and
legacy redirects still unpublished), the dynamic-WAN caveat, and the
negative-cache trap that makes a fresh record look broken.
Not my change, noticed while verifying: seerr. is in its setup flow and reports
it cannot load libraries from Jellyfin (a stale media-server link), and the WAN
address is dynamic so every A record is a copy of the current one.
# docs(caddy): the exposure gates measured, and the guarded set published
Live change first, docs in this PR: the authentik-guarded vhosts that had no
public A record are now published, so the admin tools are reachable from the
internet **through the guard**, not around it.
## What changed in DNS (Porkbun, `franksdank.cloud`, ttl 300 → `71.227.227.172`)
Created: `grafana.`, `prometheus.`, `loki.`, `seerr.`, `marreta.`, `notebook.` —
the six names that were behind Anubis + authentik with no public record. The
other machinery was already in place: the 443 forward reaches Caddy, every vhost
has a DNS-01 certificate, and all eleven proxy providers are claimed by the
embedded outpost. `marreta-proxy` and `prometheus-proxy` had an `external_host`
without the trailing slash the fleet convention requires; both normalized.
## Evidence
- **Anonymous path is enforced.** With cookies cleared at CDP level
(`Storage.clearCookies`, verified `cookiesLeft: 0`), `prometheus.` and the
`www.` control both land on
`auth.franksdank.cloud/if/flow/default-authentication-flow/` — the outpost
redirects, it does not serve the app. An earlier pass looked like Prometheus
was open; that was the shared browser's pre-existing authentik SSO session
silently re-authorizing (`/outpost.goauthentik.io/start` → `authorize` →
`callback`), not a missing guard.
- **Authenticated path reaches the apps.** `prometheus.` → query console,
`grafana.` → Grafana `/login` with "Sign in with Authentik", `notebook.` → Open
Notebook password screen, `marreta.` → Marreta, `seerr.` → Seerr setup,
`loki.` → its API (404 on `/`, it has no web UI).
- **Non-browser clients still get challenged**: `curl` against each new name
returns the 7.4 KB Anubis page, not app bytes.
- **Propagation**: authoritative NS and Quad9 answered immediately; 1.1.1.1 kept
NXDOMAIN for two names because it had cached the negative answer from the
earlier census (zone negative TTL 1800 s).
## Docs
`Infrastructure/Caddy.md` § Gotchas now records the measured law — exposure is
two gates (the router's 80/443 forward, and Caddy's vhost list), so **a public A
record buys discoverability, not access**; internal-only means no A record — plus
the current posture (guarded set published; exempt self-authenticating names and
legacy redirects still unpublished), the dynamic-WAN caveat, and the
negative-cache trap that makes a fresh record look broken.
Not my change, noticed while verifying: `seerr.` is in its setup flow and reports
it cannot load libraries from Jellyfin (a stale media-server link), and the WAN
address is dynamic so every A record is a copy of the current one.
---
cwd: /home/blank/.omp/wt/wt-20261104-104444-6d1fc1f · session: 01a1a7eb-c584-72d3-9d7e-c02d981cd662
Measured 2026-11-04: the router's 80/443 forward plus Caddy's vhost list are the
only gates — a public A record buys discoverability, not access — so internal-
only means an absent record. Publishes the outstanding fact: the whole
authentik-guarded set now carries a record; the exempt self-authenticating names
and the legacy redirects do not. Adds the dynamic-WAN caveat and the 1800 s
negative-cache trap that makes a fresh record look broken.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
docs(caddy): the exposure gates measured, and the guarded set published
Live change first, docs in this PR: the authentik-guarded vhosts that had no
public A record are now published, so the admin tools are reachable from the
internet through the guard, not around it.
What changed in DNS (Porkbun,
franksdank.cloud, ttl 300 →71.227.227.172)Created:
grafana.,prometheus.,loki.,seerr.,marreta.,notebook.—the six names that were behind Anubis + authentik with no public record. The
other machinery was already in place: the 443 forward reaches Caddy, every vhost
has a DNS-01 certificate, and all eleven proxy providers are claimed by the
embedded outpost.
marreta-proxyandprometheus-proxyhad anexternal_hostwithout the trailing slash the fleet convention requires; both normalized.
Evidence
(
Storage.clearCookies, verifiedcookiesLeft: 0),prometheus.and thewww.control both land onauth.franksdank.cloud/if/flow/default-authentication-flow/— the outpostredirects, it does not serve the app. An earlier pass looked like Prometheus
was open; that was the shared browser's pre-existing authentik SSO session
silently re-authorizing (
/outpost.goauthentik.io/start→authorize→callback), not a missing guard.prometheus.→ query console,grafana.→ Grafana/loginwith "Sign in with Authentik",notebook.→ OpenNotebook password screen,
marreta.→ Marreta,seerr.→ Seerr setup,loki.→ its API (404 on/, it has no web UI).curlagainst each new namereturns the 7.4 KB Anubis page, not app bytes.
NXDOMAIN for two names because it had cached the negative answer from the
earlier census (zone negative TTL 1800 s).
Docs
Infrastructure/Caddy.md§ Gotchas now records the measured law — exposure istwo gates (the router's 80/443 forward, and Caddy's vhost list), so a public A
record buys discoverability, not access; internal-only means no A record — plus
the current posture (guarded set published; exempt self-authenticating names and
legacy redirects still unpublished), the dynamic-WAN caveat, and the
negative-cache trap that makes a fresh record look broken.
Not my change, noticed while verifying:
seerr.is in its setup flow and reportsit cannot load libraries from Jellyfin (a stale media-server link), and the WAN
address is dynamic so every A record is a copy of the current one.
cwd: /home/blank/.omp/wt/wt-20261104-104444-6d1fc1f · session: 01a1a7eb-c584-72d3-9d7e-c02d981cd662