Frank
a5fe045b58
Structural repair: - 13 pages were the same document twice (each exactly 2x its HEAD size), a second frontmatter block whose closing fence had been glued onto a body line by a frontmatter rewrite that re-read its own output. Un-doubled by cutting at the second frontmatter and keeping the copy whose body is a superset; the orphan census reports 0 lost tokens against HEAD. - log.md: one entry per date, bare `## YYYY-MM-DD` headings, newest first — 66 dated headings merged into 34, titles demoted to bold leads, every content line verified present. The file had been descending at the head and ascending at the tail. Ownership moves: - New `LLM/frank-medium.md` is the locator for the retired Dankserver endpoint: era windows quoted from each era page's own banner, no numbers restated, and the two unresolved date conflicts recorded instead of silently resolved. `frank-archon.md` links to it instead of restating the pre-rename window. - The four Pipeline-Parallelism stubs (frontmatter only, no body) are gone; `Multi-Node Runtimes.md` owns runtime construction, launch, mixed-vendor verdicts and cross-split spec decode, and the four links that pointed at the stubs were repointed at it or at the drafter page. - Authentik's three stub pages fold into `Authentik.md`, with the process detail and the outpost reference split out so the parent stays under the length hint. Verified corrections (host census + live probe, 2026-10-19): - The MXFP4 checkpoint two pages called the "on-disk rollback" is gone: /home/dank/models/ holds StillDeadcode, rad and tpl.jinja. Stated once, on the era page that owns that payload; the swap page now links to it. - frank-medium-radiance-mxfp4: the 4.24/7 accept rate belongs to the DFlash2 arm measured on the FP8 target, not to the MXFP4 era; the 3-family soak run census is kept once (155 requests) instead of twice (~120 and 155). - Fleet shapes re-confirmed against the live endpoints before touching any page: 3x200000 fp8 KV, 2x200704, 2x262144. Index rows are regenerated, not hand-carved. Net -1,849 vault lines.
77 lines
3.2 KiB
Markdown
77 lines
3.2 KiB
Markdown
---
|
|
type: reference
|
|
description: "The three core Authentik containers — database, server and worker — with their units, images, roles and probes."
|
|
tags:
|
|
- infrastructure
|
|
- authentik
|
|
- postgres
|
|
timestamp: 2026-10-19
|
|
---
|
|
|
|
# Authentik Processes
|
|
|
|
The three core containers of the [[Authentik]] stack on Dankclaw. The two
|
|
outpost units are not covered here — they live on [[Authentik]] and
|
|
[[Authentik Outpost Reference]]. Server and worker run the same image; the
|
|
`command` selects the role (`server` / `worker`). Data persists under
|
|
`/home/dank/Containers/authentik/` as bind mounts (repo policy — no named
|
|
volumes), moved from `/home/dank/authentik/` in the 2026-09-01 quadlet
|
|
standardization; the retired stubs this page replaces recorded the pre-move
|
|
paths `/home/dank/authentik/data` (server and worker) and
|
|
`/home/dank/authentik/postgres` (database).
|
|
|
|
## authentik-postgres
|
|
|
|
The PostgreSQL 16 database for Authentik — the only stateful store in the stack
|
|
(users, flows, sessions, events). Sessions, caching, and WebSockets moved to
|
|
PostgreSQL in 2025.10 (Redis removed).
|
|
|
|
- **Image:** `docker.io/library/postgres:16-alpine`
|
|
- **Data:** `/home/dank/Containers/authentik/postgres` (bind mount; no named
|
|
volumes)
|
|
- **Health:** `pg_isready -d authentik -U authentik`
|
|
- **Retired wording:** the stub called this a "Compose service … in
|
|
`dankclaw/compose.yaml`"; the compose stack is gone and the unit is a quadlet.
|
|
- The side-by-side with `gitea-postgres` (network, published ports, secret
|
|
source, boot persistence) is owned by [[Postgres]].
|
|
|
|
## authentik-server
|
|
|
|
The Authentik server — the core, the admin API, and the embedded Caddy outpost.
|
|
It also serves the login page at `https://auth.franksdank.cloud`.
|
|
|
|
- **Unit:** `dankclaw/authentik/quadlet/authentik-server.container`
|
|
(`authentik-server.service`)
|
|
- **Image:** `ghcr.io/goauthentik/server:2026.8.3` (`command: server`)
|
|
- **Port:** `9000` (published) — the outpost, the admin API and the login UI all
|
|
live here
|
|
- **Data:** `/home/dank/Containers/authentik/data` (bind mount, shared with the
|
|
worker)
|
|
- **Health:** recorded by the retired stub as
|
|
`http://localhost:9000/-/health/`; superseded — [[Authentik]] → Operations
|
|
owns the live probe.
|
|
- **Retired wording:** the stub described "the Caddy `forward_auth` vhosts"
|
|
proxying here; the chain Caddy actually runs is [[Authentik]] → Caddy
|
|
integration.
|
|
|
|
## authentik-worker
|
|
|
|
The Authentik worker — background tasks: event processing, provider
|
|
synchronization, scheduled flows, and certificate renewal.
|
|
|
|
- **Unit:** `dankclaw/authentik/quadlet/authentik-worker.container`
|
|
(`authentik-worker.service`)
|
|
- **Image:** `ghcr.io/goauthentik/server:2026.8.3` (`command: worker`)
|
|
- **Runs as:** `0:0` (rootless: container root maps to the host user that owns
|
|
the data dir)
|
|
- **Data:** `/home/dank/Containers/authentik/data` (bind mount, shared with the
|
|
server)
|
|
- **No port** — the worker has no HTTP endpoint.
|
|
|
|
## Cross-references
|
|
|
|
- [[Authentik]] — what the service is, its deployment, wiring, operations and
|
|
failure modes
|
|
- [[Authentik Outpost Reference]] — provider, flow and token configuration
|
|
- [[Postgres]] — both PostgreSQL clusters on Dankclaw, side by side
|