Frank
bdead570e2
rank 3. shared/services.yml is the single source of truth for every deployable service (hosts, unit dirs, units, path claims, tests, scrape/ dns/probe facts, aliases, stacks); scripts/service-map.py is its only reader (hosts/services/allows/plan/seams/owner/units/stack/get/render/ check). deploy-plan.py becomes a thin CLI wrapper; both --service allow-lists (deploy.sh, deploy-remote.sh) and the changed-test mapper are the inventory. Selection semantics: host scoping (a host's tree selects only its own services), the quadlet netns/network coupling graph resolved across directories (gluetun's riders live in their own dirs), stacks, and canonical restart order. Against the pinned old-planner fixture: 921 raw deltas reduced to 17, all intentional (anubis now maps; cross-host paths select nothing; the retired qwen-sharp template plans nothing and the live froggeric template plans frank-archon; dankserver/romm/romm.container, missed by the old filename rule, plans the romm trio). The fixture is regenerated as the new pin. Integrity gates: schema, unit claims, quadlet-file ownership, path-glob liveness, Pi-hole hosts / Prometheus jobs / DNS / homepage probes drift. tests/service_inventory.bats pins all of it plus the plan fixture and the deploy-plan CLI. Allow-list grep seams in hermes_webui/observability_quadlet become behavioral allows calls.
23 lines
478 B
Bash
23 lines
478 B
Bash
# Dankserver stack secrets and configuration.
|
|
# Copy to .env and fill real values. Never commit real secrets.
|
|
|
|
# RomM admin credentials (first boot)
|
|
ROMM_USERNAME=changeme
|
|
ROMM_PASSWORD=changeme
|
|
ROMM_AUTH_SECRET_KEY=changeme
|
|
|
|
# RomM database (MariaDB)
|
|
ROMM_DB_USER=romm
|
|
ROMM_DB_PASSWD=changeme
|
|
MARIADB_ROOT_PASSWORD=changeme
|
|
|
|
# RomM Redis
|
|
# (no password needed for local Redis)
|
|
|
|
# Copyparty
|
|
COPAY_PASS=changeme
|
|
|
|
# Jellyfin
|
|
JELLYFIN_PUBLISH_SERVER_URL=http://192.168.0.235:8096
|
|
|