Files

T

Frank a5fe045b58 docs(vault): one fact, one owner — repair the doubled pages, single-source the facts

Structural repair:
- 13 pages were the same document twice (each exactly 2x its HEAD size),
  a second frontmatter block whose closing fence had been glued onto a body
  line by a frontmatter rewrite that re-read its own output. Un-doubled by
  cutting at the second frontmatter and keeping the copy whose body is a
  superset; the orphan census reports 0 lost tokens against HEAD.
- log.md: one entry per date, bare `## YYYY-MM-DD` headings, newest first —
  66 dated headings merged into 34, titles demoted to bold leads, every
  content line verified present. The file had been descending at the head
  and ascending at the tail.

Ownership moves:
- New `LLM/frank-medium.md` is the locator for the retired Dankserver
  endpoint: era windows quoted from each era page's own banner, no numbers
  restated, and the two unresolved date conflicts recorded instead of
  silently resolved. `frank-archon.md` links to it instead of restating the
  pre-rename window.
- The four Pipeline-Parallelism stubs (frontmatter only, no body) are gone;
  `Multi-Node Runtimes.md` owns runtime construction, launch, mixed-vendor
  verdicts and cross-split spec decode, and the four links that pointed at
  the stubs were repointed at it or at the drafter page.
- Authentik's three stub pages fold into `Authentik.md`, with the process
  detail and the outpost reference split out so the parent stays under the
  length hint.

Verified corrections (host census + live probe, 2026-10-19):
- The MXFP4 checkpoint two pages called the "on-disk rollback" is gone:
  /home/dank/models/ holds StillDeadcode, rad and tpl.jinja. Stated once, on
  the era page that owns that payload; the swap page now links to it.
- frank-medium-radiance-mxfp4: the 4.24/7 accept rate belongs to the DFlash2
  arm measured on the FP8 target, not to the MXFP4 era; the 3-family soak run
  census is kept once (155 requests) instead of twice (~120 and 155).
- Fleet shapes re-confirmed against the live endpoints before touching any
  page: 3x200000 fp8 KV, 2x200704, 2x262144.

Index rows are regenerated, not hand-carved. Net -1,849 vault lines.

2026-10-19 05:00:43 -07:00

3.2 KiB

Raw Permalink Blame History

type, description, tags, timestamp

type

description

Authentik Processes

The three core containers of the Authentik stack on Dankclaw. The two outpost units are not covered here — they live on Authentik and Authentik Outpost Reference. Server and worker run the same image; the command selects the role (server / worker). Data persists under /home/dank/Containers/authentik/ as bind mounts (repo policy — no named volumes), moved from /home/dank/authentik/ in the 2026-09-01 quadlet standardization; the retired stubs this page replaces recorded the pre-move paths /home/dank/authentik/data (server and worker) and /home/dank/authentik/postgres (database).

authentik-postgres

The PostgreSQL 16 database for Authentik — the only stateful store in the stack (users, flows, sessions, events). Sessions, caching, and WebSockets moved to PostgreSQL in 2025.10 (Redis removed).

Image: docker.io/library/postgres:16-alpine
Data: /home/dank/Containers/authentik/postgres (bind mount; no named volumes)
Health: pg_isready -d authentik -U authentik
Retired wording: the stub called this a "Compose service … in dankclaw/compose.yaml"; the compose stack is gone and the unit is a quadlet.
The side-by-side with gitea-postgres (network, published ports, secret source, boot persistence) is owned by Postgres.

authentik-server

The Authentik server — the core, the admin API, and the embedded Caddy outpost. It also serves the login page at https://auth.franksdank.cloud.

Unit: dankclaw/authentik/quadlet/authentik-server.container (authentik-server.service)
Image: ghcr.io/goauthentik/server:2026.8.3 (command: server)
Port: 9000 (published) — the outpost, the admin API and the login UI all live here
Data: /home/dank/Containers/authentik/data (bind mount, shared with the worker)
Health: recorded by the retired stub as http://localhost:9000/-/health/; superseded — Authentik → Operations owns the live probe.
Retired wording: the stub described "the Caddy forward_auth vhosts" proxying here; the chain Caddy actually runs is Authentik → Caddy integration.

authentik-worker

The Authentik worker — background tasks: event processing, provider synchronization, scheduled flows, and certificate renewal.

Unit: dankclaw/authentik/quadlet/authentik-worker.container (authentik-worker.service)
Image: ghcr.io/goauthentik/server:2026.8.3 (command: worker)
Runs as: 0:0 (rootless: container root maps to the host user that owns the data dir)
Data: /home/dank/Containers/authentik/data (bind mount, shared with the server)
No port — the worker has no HTTP endpoint.

Cross-references

Authentik — what the service is, its deployment, wiring, operations and failure modes
Authentik Outpost Reference — provider, flow and token configuration
Postgres — both PostgreSQL clusters on Dankclaw, side by side

3.2 KiB Raw Permalink Blame History