Frank
73e46a1d85
Deploy manualdousuario/marreta (Laravel / serversideup php:8.4-fpm-nginx) as a rootless Quadlet pair (marreta + marreta-browser/Lightpanda), both joining gluetun's netns so all fetch egress exits the same ProtonVPN tunnel as SearXNG. - marreta relocated to NGINX_HTTP_PORT=8085 (netns already has searxng on 8080); gluetun publishes 8082:8085; Caddy dials 192.168.0.143:8082. - Guard chain: marreta.franksdank.cloud -> Anubis :8923 -> Authentik -> post-auth :8017 @marreta -> 8082. Access = any authenticated user. - Secrets seeded to /home/dank/Containers/marreta/env (0600) from MARRETA_APP_KEY / MARRETA_ADMIN_EMAIL / MARRETA_ADMIN_PASSWORD. - deploy-plan.py: marreta joins the gluetun netns family. - New seam tests/marreta_quadlet.bats (17 contracts); scoping test updated for the widened netns family. Doc: Dankclaw/Marreta.md + index + log.
67 lines
2.7 KiB
INI
67 lines
2.7 KiB
INI
# Quadlet unit: Marreta content-cleaning proxy (rootless, boot-persistent).
|
|
#
|
|
# Install path on dankclaw: ~/.config/containers/systemd/marreta.container
|
|
# Unit name: marreta.service (container name: marreta)
|
|
#
|
|
# Marreta is a Laravel app (serversideup/php:8.4-fpm-nginx) that strips
|
|
# paywalls/tracking from a fetched page. It reuses gluetun's network
|
|
# namespace (Network=gluetun.container) so ALL of its outbound fetches exit
|
|
# the same WireGuard tunnel as SearXNG — the curl strategy AND, because the
|
|
# browser companion shares the same netns, the Lightpanda fetches too
|
|
# (marreta's PROXY_URL does NOT cover the browser: the CDP connection passes
|
|
# no proxy, so netns sharing is the only way to keep the browser's egress on
|
|
# the tunnel).
|
|
#
|
|
# Port: the shared netns already has SearXNG on 8080, so marreta must NOT
|
|
# bind 8080. NGINX_HTTP_PORT=8085 relocates it (the fpm-nginx image does
|
|
# not bake conf.d/*.conf; the site config is envsubst'd from
|
|
# ${NGINX_HTTP_PORT} at container start). Gluetun publishes host 8082 ->
|
|
# 8085 so Caddy can reach it; see dankclaw/searxng/quadlet/gluetun.container.
|
|
# The app reaches its browser companion over loopback (same netns):
|
|
# ws://127.0.0.1:9222.
|
|
#
|
|
# Secrets (APP_KEY, admin creds) live in /home/dank/Containers/marreta/env
|
|
# (mode 0600, dank-owned so the rootless unit can read it); this file holds
|
|
# none. See serverAppConfigs-docs/Dankclaw/Marreta.md.
|
|
|
|
[Unit]
|
|
Description=Marreta content-cleaning proxy container
|
|
Wants=gluetun.service marreta-browser.service
|
|
After=gluetun.service marreta-browser.service network.target
|
|
|
|
[Container]
|
|
ContainerName=marreta
|
|
Network=gluetun.container
|
|
Image=ghcr.io/manualdousuario/marreta:latest
|
|
# Relocate off SearXNG's 8080 inside the shared netns.
|
|
Environment=NGINX_HTTP_PORT=8085
|
|
Environment=APP_NAME=Marreta
|
|
Environment=APP_ENV=production
|
|
Environment=APP_DEBUG=false
|
|
Environment=APP_URL=https://marreta.franksdank.cloud
|
|
Environment=APP_LOCALE=en
|
|
Environment="APP_DESCRIPTION=Paywall-free reading"
|
|
Environment=BROWSER_WS_ENDPOINT=ws://127.0.0.1:9222
|
|
Environment=DISABLE_CACHE=false
|
|
# Secrets expanded from the EnvironmentFile below.
|
|
Environment=APP_KEY=${MARRETA_APP_KEY}
|
|
Environment=ADMIN_EMAIL=${MARRETA_ADMIN_EMAIL}
|
|
Environment=ADMIN_PASSWORD=${MARRETA_ADMIN_PASSWORD}
|
|
# Named volume: podman auto-creates it and copyups the image's storage/app
|
|
# ownership (www-data), so the app can write its SQLite DB + cache.
|
|
Volume=marreta_storage:/var/www/html/storage/app
|
|
HealthCmd=["curl","-fsS","-o","/dev/null","http://127.0.0.1:8085/up"]
|
|
HealthInterval=30s
|
|
HealthTimeout=10s
|
|
HealthRetries=5
|
|
HealthStartPeriod=120s
|
|
|
|
[Service]
|
|
EnvironmentFile=/home/dank/Containers/marreta/env
|
|
TimeoutStartSec=900
|
|
Restart=always
|
|
RestartSec=10
|
|
|
|
[Install]
|
|
WantedBy=default.target
|