Frank
032229c1e2
The two knobs that keep the box alive: TTS_BATCH_SIZE=1 and
OPEN_NOTEBOOK_WORKER_MAX_TASKS=1. Upstream ships 5 x 5; frank-tts spawns one
~8 GiB, 8-thread engine process per synthesis request on a machine that also
serves two LLMs, so a five-way fan-out is a self-inflicted shutdown. The worker
knob is real, not decorative: the image's supervisord expands
${OPEN_NOTEBOOK_WORKER_MAX_TASKS:-5} into the worker command
(supervisord.conf:25).
Both ESPERANTO_* timeouts go above upstream's 300 s defaults, sized for CPU
synthesis (SHIM_TIMEOUT=600, LLAMA_TTS_THREADS=8) — one episode is dozens of
per-line /audio/speech calls and a timeout kills the episode, not the line.
API_URL is forced for the 5055 -> 5056 remap; SURREAL_URL addresses the database
by container name; CORS_ORIGINS is origin-form (scheme://host:port), the form
the app compares against. OPEN_NOTEBOOK_PASSWORD stays absent here on purpose:
the app treats a set-but-empty value as auth-on.
Secrets stay placeholders in the tracked file and in dankclaw/.env.example, which
lists SURREAL_PASSWORD rather than SURREAL_PASS — the deployer derives the
surreal CLI's spelling from it when it seeds, so the app and the database cannot
be handed different values.
102 lines
4.7 KiB
Bash
102 lines
4.7 KiB
Bash
# Dankclaw stack secrets and configuration.
|
|
# Copy to .env and fill real values. Never commit real secrets.
|
|
|
|
# SearXNG
|
|
SEARXNG_SECRET=changeme
|
|
SEARXNG_BASE_URL=http://search.franksdank.cloud/
|
|
# Kagi search API key (https://help.kagi.com/kagi/api/). Powers the paid
|
|
# `kagi` engine in shared/searxng/settings.yml; deploy-remote.sh bakes it into
|
|
# the live settings.yml via scripts/searxng-render-settings.py. The quadlet
|
|
# does NOT pass it into the container environment.
|
|
KAGI_API_KEY=changeme
|
|
|
|
# Gluetun VPN (see https://github.com/qdm12/gluetun-wiki)
|
|
# Single-peer WireGuard model. Fill from your provider's WireGuard config.
|
|
VPN_SERVICE_PROVIDER=protonvpn
|
|
VPN_TYPE=wireguard
|
|
WIREGUARD_PRIVATE_KEY=changeme
|
|
WIREGUARD_ADDRESSES=0.0.0.0/32
|
|
WIREGUARD_PUBLIC_KEY=changeme
|
|
WIREGUARD_ENDPOINT_IP=0.0.0.0
|
|
WIREGUARD_ENDPOINT_PORT=51820
|
|
WIREGUARD_ALLOWED_IPS=0.0.0.0/0,::/0
|
|
WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=25s
|
|
|
|
# Gitea database
|
|
GITEA_DB_PASSWORD=changeme
|
|
|
|
# Grafana OAuth2 client secret (authentik OAuth2Provider "grafana", pk 9).
|
|
# Created via ak shell on authentik-server; the live .env must hold the
|
|
# provider's generated client_secret verbatim. Rotation = rotate the provider
|
|
# secret in authentik, restart grafana after updating the live .env value.
|
|
GRAFANA_OAUTH_CLIENT_SECRET=changeme
|
|
|
|
# Caddy (the homelab's single reverse proxy, on this host)
|
|
# bcrypt hash (caddy hash-password). deploy.sh renders it into
|
|
# /home/dank/Containers/caddy/Caddyfile, which the container mounts.
|
|
# CADDY_BASICAUTH_HASH: the shared family password, now used only by the
|
|
# pihole vhost (grafana moved behind the Authentik guard chain 2026-09-01).
|
|
# Username: dankuser.
|
|
CADDY_BASICAUTH_HASH=changeme
|
|
# (The homepage's per-user hashes were retired: the homepage and its /admin/
|
|
# page are now behind Authentik forward_auth, not basicauth.)
|
|
|
|
# Hermes -> Signal (signal-cli daemon on the host, port 8080)
|
|
# E.164 number of the linked Signal account (your primary number, for Note-to-Self).
|
|
SIGNAL_ACCOUNT=+15551234567
|
|
# Comma-separated E.164 numbers allowed to message the agent.
|
|
SIGNAL_ALLOWED_USERS=+15551234567
|
|
|
|
# Hermes web UI (Hermex server) login password. Required: the webui binds to
|
|
# loopback and is reached only through the SSH tunnel, but Hermex still signs
|
|
# in with this password. Set a strong value in the live .env.
|
|
HERMES_WEBUI_PASSWORD=changeme
|
|
|
|
# Porkbun API (franksdank.cloud + franksdank.casa zones). Caddy uses these
|
|
# for DNS-01 Let's Encrypt wildcard cert issuance. Porkbun API keys are
|
|
# account-wide; rotate them here rather than in the dashboard.
|
|
# PORKBUN_API_SECRET_KEY is the name the caddy-dns/porkbun module expects.
|
|
PORKBUN_API_KEY=changeme
|
|
PORKBUN_API_SECRET_KEY=changeme
|
|
|
|
# Authentik (SSO / OIDC provider)
|
|
# AUTHENTIK_PG_PASS: the PostgreSQL password for authentik-postgres.
|
|
# Generate: openssl rand -base64 32
|
|
AUTHENTIK_PG_PASS=changeme
|
|
# AUTHENTIK_SECRET_KEY: the server's secret key (64+ chars).
|
|
# Generate: openssl rand -base64 48
|
|
AUTHENTIK_SECRET_KEY=changeme
|
|
|
|
# Marreta (content-cleaning proxy, behind the Authentik guard chain).
|
|
# deploy-remote.sh seeds /home/dank/Containers/marreta/env from these three
|
|
# values (only if that file does not already exist) and the marreta quadlet
|
|
# maps them to the app's APP_KEY / ADMIN_EMAIL / ADMIN_PASSWORD.
|
|
# MARRETA_APP_KEY: Laravel encryption key. Generate:
|
|
# openssl rand -base64 32
|
|
# Changing it after first boot invalidates encrypted session/cookie data.
|
|
MARRETA_APP_KEY=changeme
|
|
# Admin panel login (marreta.franksdank.cloud/admin). The app creates this
|
|
# account on first boot from these values.
|
|
MARRETA_ADMIN_EMAIL=admin@franksdank.cloud
|
|
MARRETA_ADMIN_PASSWORD=changeme
|
|
|
|
# open-notebook (podcast generator; internal-only, no vhost).
|
|
# deploy-remote.sh seeds /home/dank/Containers/open-notebook/env from these
|
|
# values (only if that file does not already exist) and refuses to start the
|
|
# units while any of them is blank: a blank OPEN_NOTEBOOK_PASSWORD means
|
|
# authentication OFF, and a blank encryption key means no provider credential
|
|
# can be saved. The seed writes SURREAL_PASS too — the spelling the `surreal`
|
|
# CLI reads — from SURREAL_PASSWORD, so the app and the database cannot be
|
|
# given different values.
|
|
# OPEN_NOTEBOOK_ENCRYPTION_KEY: encrypts the stored AI provider keys at rest.
|
|
# Generate: openssl rand -hex 32
|
|
# Changing it after credentials are saved makes them undecryptable.
|
|
OPEN_NOTEBOOK_ENCRYPTION_KEY=changeme
|
|
# UI/API password. Every API route — including the episode-audio download the
|
|
# app serves without a session — is open to the LAN while this is unset.
|
|
OPEN_NOTEBOOK_PASSWORD=changeme
|
|
# SurrealDB root password (the root user NAME comes from
|
|
# scripts/open-notebook.env, so this file holds only the secret).
|
|
# Generate: openssl rand -base64 32
|
|
SURREAL_PASSWORD=changeme
|