Frank
54239294b7
The loki/grafana/seerr proxy providers were script-provisioned with no flows and no Application: null flows made the embedded outpost's Rust deserializer reject the whole config (all guarded vhosts down after any outpost reload), and the missing apps bounced post-login to authentik's user UI instead of the app. Backfilled both live; documented the two provisioning rules and updated the provider inventory. SSO e2e now asserts the app landing (pathname leaves /if/, no IdP markers in body) instead of only the hostname.
52 lines
3.8 KiB
Markdown
52 lines
3.8 KiB
Markdown
# Seerr
|
|
|
|
Seerr is the unified request manager for the *arr stack (the maintained `seerr-team/seerr` successor to the archived Overseerr/Jellyseerr line). Frank's household uses it to request movies/TV/music; Seerr routes approvals to Sonarr/Radarr/Lidarr/Readarr on FrankBook-Pro and pushes downloads to qBittorrent.
|
|
|
|
**Host:** Dankclaw — **Hostname:** `seerr.franksdank.cloud` (Caddy, guarded) — **Docs:** https://github.com/seerr-team/seerr
|
|
|
|
## Facts (verified live, 2026-09-01)
|
|
|
|
| Item | Value |
|
|
|------|-------|
|
|
| Image | `ghcr.io/seerr-team/seerr:v3.4.1` (runs as in-image `node`, uid 1000) |
|
|
| Port | 5055 (container), published `127.0.0.1:5055` on the host (loopback-only) |
|
|
| Data | `/home/dank/Containers/seerr/data` → `/app/config` (SQLite settings store) |
|
|
| Unit | `dankclaw/seerr/quadlet/seerr.container` → `seerr.service` |
|
|
| Network | `dankclaw_default` (post-auth listener reachability) |
|
|
| Guard | Caddy TLS edge → Anubis :8923 → Authentik outpost provider `seerr-proxy` → Caddy :8017 `@seerr` handler → `seerr:5055` |
|
|
| DNS | Pi-hole addn-hosts + Porkbun public A `seerr.franksdank.cloud → 192.168.0.143` |
|
|
|
|
## Why loopback-only publishing
|
|
|
|
Seerr is browser-facing; the only sanctioned user path is the guard chain (Caddy → Anubis → Authentik SSO). `PublishPort=127.0.0.1:5055:5055` keeps the app off the LAN entirely while still letting the homepage probe agent and host-local checks reach it — the same loopback convention as other guarded hosts (see [[Homepage Design Grilling]]).
|
|
|
|
## Guard chain fix (2026-09-02)
|
|
|
|
The `seerr-proxy` provider was provisioned by script with **no flows and no
|
|
Application** — silently broken in two ways: the null flows wedged the
|
|
embedded outpost's config deserializer (taking every guarded vhost down at
|
|
the next outpost reload), and the missing app bounced post-login to
|
|
authentik's own user UI instead of Seerr. Both backfilled live: the three
|
|
standard flows copied from a known-good provider, plus an application
|
|
(`seerr-guard`) linked to the provider. Verified by the hardened SSO sweep
|
|
(`tests/e2e/specs/13-sso.spec.ts`) — see [[Authentik]] for the two
|
|
provisioning rules this incident established.
|
|
|
|
## *arr wiring
|
|
|
|
Seerr reaches the *arr services on FrankBook-Pro (192.168.0.112, gluetun-NetNS stack inside the Mac's podman machine VM) by IP-based base URLs (`http://192.168.0.112:<port>`), configured inside Seerr's own web settings — not in env or quadlet. The `.lan` hostname variant was deliberately dropped: addn-hosts records are for fleet public-domain hosts, and IP bases match the Mac stack's verified LAN reachability. API keys live in each arr's config.xml on the Mac and are entered through Seerr's settings store.
|
|
|
|
OIDC single-sign-on for Seerr (Authentik OIDC provider + Seerr OIDC config) remains an open option; the guard chain already authenticates the front door, so this is an in-app setting deferred to Frank's first-run session.
|
|
|
|
## UID mapping gotcha
|
|
|
|
The container runs as `node` (uid 1000 in-image). Rootless podman's continuous mapping is container uid N → host uid `100000 + N - 1`, so uid 1000 → **100999**. The first deploy chowned the data dir to 100999 + 1 (= 101000) and crash-looped with `EACCES mkdir /app/config/logs`. Rule: read the real mapping from any container's `/proc/self/uid_map` before chowning bind roots for non-root images.
|
|
|
|
## Deployment
|
|
|
|
`./scripts/deploy.sh dankclaw --service seerr`. The deployer pre-creates the bind-source dir, installs the unit, and restarts. First visit after deploy: complete the Seerr local-admin setup wizard (the guard chain bounces through Authentik first). TLS issuance for a new vhost fires at Caddy reload (dns-01) — allow ~15 s before the first HTTPS probe.
|
|
|
|
## Citations
|
|
|
|
- Seerr image and volume contract: https://github.com/seerr-team/seerr (official docs recommend `/app/config` persistence)
|