2026-11-03 03:32:49 -08:00
6 changed files with 52 additions and 45 deletions
@@ -290,7 +290,14 @@ audiobooks.franksdank.cloud {
 	}
 }

-# --- Jellyfin ---
+# --- Jellyfin (exempt by construction: own auth) --------------------------
+# No Anubis, no outpost: Jellyfin carries its own complete login (its own
+# account store, no Authentik link), which is the policy's exempt category —
+# the same family as plex/ABS/*arr around it. Accepted exposure: the sign-in
+# form is internet-visible with no rate limiter on either side (this Caddy
+# build ships no rate_limit module), so accounts need long unique passwords.
+# The homepage card opened it to the household on 2026-11-03; accounts are
+# created in Jellyfin's own admin UI, not by SSO.
 jelly.franksdank.cloud {
 	reverse_proxy 192.168.0.235:8096
 }
@@ -3,7 +3,7 @@ type: reference
 title: Jellyfin
 description: "Jellyfin on Dankserver: quadlet unit, overlay metadata view, provider keys, ports, access, transcode status."
 tags: [jellyfin, dankserver, media-server]
-timestamp: 2026-11-02T11:00:00Z
+timestamp: 2026-11-03T11:40:00Z
 ---

 # Jellyfin
@@ -383,6 +383,30 @@ folder created under `/data/Movies`: it stays invisible until a recursive refres
 names it. So every pass that writes into a library ends by firing one, and "Jellyfin
 does not see the file I just moved in" is the designed answer, not a fault to chase.

+## API-key ledger and rotation
+
+`/Auth/Keys` is the ledger. `GET` lists every key **with its `AccessToken` in
+cleartext**, so an admin token in hand prints the whole fleet's keys;
+`POST /Auth/Keys?app=<name>` mints one and answers `204` **with no body** — the
+new token is read back from the `GET`, never from the create response.
+`DELETE /Auth/Keys/{token}` revokes **by the token string**, and a parameter that
+matches nothing answers `204` too, so `204` there is not proof anything was
+removed. Discover a route's verb from the `Allow` header of an `OPTIONS` (or
+`GET`) response — never by firing `DELETE` at a guess.
+
+- `IsActive` reads `False` on rows that authenticate `200`. It is not a usability
+  signal; only an authenticated request is.
+- `DateLastActivity` never moves off `0001-01-01` on 12.4, so "is this key in
+  use?" cannot be answered from the ledger. The census is repo + host credential
+  stores + the `Devices` table (whose `DateLastActivity` *is* real).
+- Rotation order: mint → rewrite **both** stores (`~/.config/secrets/jellyfin`
+  and `JELLYFIN_API_KEY` in the ignored `dankserver/.env`) → prove the new key on
+  `/System/Info` → `DELETE` the old token → prove `401`. Revoking while a store
+  still holds that value breaks the scan door silently.
+- Blast radius as measured 2026-11-03: no repo script reads `JELLYFIN_API_KEY`;
+  Seerr keeps a key of its own in its own DB (which of its two rows it uses was
+  never confirmed), so revoke by token and never by app name.
+
 ## See Also

 - [[Plex]] — co-resident media server on the same volume
@@ -316,7 +316,7 @@ flowchart TD
 **User services** (root page), in section order:
 - **AI** — OpenWebUI, and the three LLM fleet cards (frank-dragoon, frank-archon, frank-zealot — status + docs link, no Open link).
 - **Web Apps** — SearXNG, Gitea, Copyparty, Marreta.
- **Media Library Apps** — Calibre-Web, RomM, Plex, Jellyfin, Seerr.
+- **Media Library Apps** — Calibre-Web, RomM, Plex, Jellyfin, Seerr, Audiobookshelf (moved up from the admin page 2026-11-03, once Authentik SSO made it a household app).

 **Admin services** (`/admin/`), in section order:
 - **Media Library Apps** — the *arr stack (Prowlarr, Sonarr, Radarr, Lidarr, Readarr), qBittorrent, and Tautulli — live on FrankBook-Pro and Dankserver, operator-only: no vhosts (Tautulli included), direct IP:port access only. See [[FrankBook-Pro]].
@@ -324,6 +324,12 @@ flowchart TD
 - **AI** — Hermes, ComfyUI.
 - **Infrastructure** — Caddy, dnsmasq, Gluetun, and the low-level backends (mariadb, valkey, Postgres). The backends show status only. They get a link only where a UI is meaningful.

+**The registry is the authority.** `shared/homepage/services.json` decides which
+page a card renders on (`category`), whether it shows a WIP badge instead of live
+status (`wip`), and whether it gets an Open link (`showLink` + `url`). The two
+lists above are a locator only; when they disagree with the registry, the page is
+the bug — fix the page.
+
 ## Layout

 ```
@@ -1,35 +0,0 @@
-{
-  "host": "dankserver",
-  "services": [
-    {
-      "name": "Homepage",
-      "url": "/",
-      "description": "This page. Password-protected service index.",
-      "docs": "serverAppConfigs-docs/Infrastructure/Homepage.md"
-    },
-    {
-      "name": "RomM",
-      "url": "http://romm.franksdank.cloud",
-      "description": "Retro game manager and player for the ROM collection.",
-      "docs": "serverAppConfigs-docs/Dankserver/RomM.md"
-    },
-    {
-      "name": "Copyparty",
-      "url": "http://files.franksdank.cloud",
-      "description": "High-speed file sharing and streaming server.",
-      "docs": "serverAppConfigs-docs/Dankserver/Copyparty.md"
-    },
-    {
-      "name": "Calibre-Web",
-      "url": "http://books.franksdank.cloud",
-      "description": "E-book library browser and reader.",
-      "docs": "serverAppConfigs-docs/Dankserver/Calibre-Web.md"
-    },
-    {
-      "name": "Plex",
-      "url": "http://plex.franksdank.cloud/web/index.html",
-      "description": "Media server (existing host service, proxied).",
-      "docs": "serverAppConfigs-docs/Dankserver/Dankserver Stack.md"
-    }
-  ]
-}
@@ -56,6 +56,10 @@
    <a href="https://jelly.franksdank.cloud">Jellyfin</a>. Seerr is the front door —
    requests ride the VPN tunnel from there.</li>
    <li><strong>Books:</strong> <a href="https://books.franksdank.cloud">Calibre-Web</a> — the e-book library, with its own login.</li>
+    <li><strong>Audiobooks:</strong> <a href="https://audiobooks.franksdank.cloud">Audiobookshelf</a> &mdash; the
+    audiobook library. Same single sign-on as everything else: choose
+    <strong>Continue with authentik</strong> and each listener keeps their own
+    position.</li>
    <li><strong>Games:</strong> <a href="https://romm.franksdank.cloud">RomM</a> — ROM library and emulator collection.</li>
    <li><strong>Raw files:</strong> <a href="https://files.franksdank.cloud">Copyparty</a> — direct downloads and shares.</li>
    <li><strong>Search:</strong> <a href="https://search.franksdank.cloud">SearXNG</a> — metasearch, VPN-routed, no AI snoop. <details class="key-warn"><summary>&#9888; privacy note</summary><div class="warn-body">Searches are obfuscated, not anonymous: SearXNG hides you from the upstream engines and the VPN tunnel hides the traffic from the LAN &mdash; but the upstream search API keys are tied to Frank&rsquo;s identity. Don&rsquo;t treat it as Tor.</div></details></li>
@@ -109,6 +113,7 @@
    <li><strong>Best for:</strong> complex agentic tasks, programming, system administration, and "claw"-style personal agents.</li>
    <li><strong>Supervision:</strong> safe for autonomous, low-supervision use.</li>
    <li><strong>Warning:</strong> <details class="key-warn"><summary>&#9888; uncensored model</summary><div class="warn-body">Uncensored model: output can include adult content, content that describes harmful, hateful, or illegal acts, content concerning &ldquo;sensitive offensive cybersecurity topics&rdquo;, and other output that may carry severe legal risk. Take this warning seriously &mdash; don&rsquo;t ruin this server for everybody.</div></details></li>
+  </ul>

  <h2>frank-archon — the big one</h2>
  <ul>
@@ -110,13 +110,13 @@
    "name": "Jellyfin",
    "category": "user",
    "section": "Media Library Apps",
-    "description": "Open source media server. Work in progress: not open to family users yet.",
-    "url": "",
+    "description": "Open source media server for the film and TV library: its own logins (no Authentik here), so ask Frank for an account.",
+    "url": "http://jelly.franksdank.cloud",
    "docs": "",
    "probe": "192.168.0.235:8096",
    "method": "http",
-    "wip": "down",
-    "showLink": false,
+    "wip": false,
+    "showLink": true,
    "art": "/img/apps/jellyfin.svg"
  },
  {
@@ -136,7 +136,7 @@
    "name": "Marreta",
    "category": "user",
    "section": "Web Apps",
-    "description": "Clean, ad-free article reader. Paste any URL, get just the article.",
+    "description": "Paywall sledgehammer: hand it an article URL and it drags the page back through the VPN with the paywall chrome, cookie wall and trackers stripped; a headless browser renders the JS-heavy ones. Best effort — hard paywalls and login walls still win.",
    "url": "http://marreta.franksdank.cloud",
    "docs": "",
    "probe": "127.0.0.1:8082",
@@ -513,9 +513,9 @@
  },
  {
    "name": "Audiobookshelf",
-    "category": "admin",
+    "category": "user",
    "section": "Media Library Apps",
-    "description": "Audiobook server for the entropy library: its own SQLite library, its own login, per-listener positions.",
+    "description": "Audiobook server for the library: sign in with your Authentik account and every listener keeps their own position.",
    "url": "http://audiobooks.franksdank.cloud/audiobookshelf/",
    "docs": "",
    "probe": "192.168.0.235:8000",