Files

T

Frank a5fe045b58 docs(vault): one fact, one owner — repair the doubled pages, single-source the facts

Structural repair:
- 13 pages were the same document twice (each exactly 2x its HEAD size),
  a second frontmatter block whose closing fence had been glued onto a body
  line by a frontmatter rewrite that re-read its own output. Un-doubled by
  cutting at the second frontmatter and keeping the copy whose body is a
  superset; the orphan census reports 0 lost tokens against HEAD.
- log.md: one entry per date, bare `## YYYY-MM-DD` headings, newest first —
  66 dated headings merged into 34, titles demoted to bold leads, every
  content line verified present. The file had been descending at the head
  and ascending at the tail.

Ownership moves:
- New `LLM/frank-medium.md` is the locator for the retired Dankserver
  endpoint: era windows quoted from each era page's own banner, no numbers
  restated, and the two unresolved date conflicts recorded instead of
  silently resolved. `frank-archon.md` links to it instead of restating the
  pre-rename window.
- The four Pipeline-Parallelism stubs (frontmatter only, no body) are gone;
  `Multi-Node Runtimes.md` owns runtime construction, launch, mixed-vendor
  verdicts and cross-split spec decode, and the four links that pointed at
  the stubs were repointed at it or at the drafter page.
- Authentik's three stub pages fold into `Authentik.md`, with the process
  detail and the outpost reference split out so the parent stays under the
  length hint.

Verified corrections (host census + live probe, 2026-10-19):
- The MXFP4 checkpoint two pages called the "on-disk rollback" is gone:
  /home/dank/models/ holds StillDeadcode, rad and tpl.jinja. Stated once, on
  the era page that owns that payload; the swap page now links to it.
- frank-medium-radiance-mxfp4: the 4.24/7 accept rate belongs to the DFlash2
  arm measured on the FP8 target, not to the MXFP4 era; the 3-family soak run
  census is kept once (155 requests) instead of twice (~120 and 155).
- Fleet shapes re-confirmed against the live endpoints before touching any
  page: 3x200000 fp8 KV, 2x200704, 2x262144.

Index rows are regenerated, not hand-carved. Net -1,849 vault lines.

2026-10-19 05:00:43 -07:00

3.2 KiB

Raw Blame History

type, description, tags, timestamp

type

description

Authentik Processes

The three core containers of the Authentik stack on Dankclaw. The two outpost units are not covered here — they live on Authentik and Authentik Outpost Reference. Server and worker run the same image; the command selects the role (server / worker). Data persists under /home/dank/Containers/authentik/ as bind mounts (repo policy — no named volumes), moved from /home/dank/authentik/ in the 2026-09-01 quadlet standardization; the retired stubs this page replaces recorded the pre-move paths /home/dank/authentik/data (server and worker) and /home/dank/authentik/postgres (database).

authentik-postgres

The PostgreSQL 16 database for Authentik — the only stateful store in the stack (users, flows, sessions, events). Sessions, caching, and WebSockets moved to PostgreSQL in 2025.10 (Redis removed).

Image: docker.io/library/postgres:16-alpine
Data: /home/dank/Containers/authentik/postgres (bind mount; no named volumes)
Health: pg_isready -d authentik -U authentik
Retired wording: the stub called this a "Compose service … in dankclaw/compose.yaml"; the compose stack is gone and the unit is a quadlet.
The side-by-side with gitea-postgres (network, published ports, secret source, boot persistence) is owned by Postgres.

authentik-server

The Authentik server — the core, the admin API, and the embedded Caddy outpost. It also serves the login page at https://auth.franksdank.cloud.

Unit: dankclaw/authentik/quadlet/authentik-server.container (authentik-server.service)
Image: ghcr.io/goauthentik/server:2026.8.3 (command: server)
Port: 9000 (published) — the outpost, the admin API and the login UI all live here
Data: /home/dank/Containers/authentik/data (bind mount, shared with the worker)
Health: recorded by the retired stub as http://localhost:9000/-/health/; superseded — Authentik → Operations owns the live probe.
Retired wording: the stub described "the Caddy forward_auth vhosts" proxying here; the chain Caddy actually runs is Authentik → Caddy integration.

authentik-worker

The Authentik worker — background tasks: event processing, provider synchronization, scheduled flows, and certificate renewal.

Unit: dankclaw/authentik/quadlet/authentik-worker.container (authentik-worker.service)
Image: ghcr.io/goauthentik/server:2026.8.3 (command: worker)
Runs as: 0:0 (rootless: container root maps to the host user that owns the data dir)
Data: /home/dank/Containers/authentik/data (bind mount, shared with the server)
No port — the worker has no HTTP endpoint.

Cross-references

Authentik — what the service is, its deployment, wiring, operations and failure modes
Authentik Outpost Reference — provider, flow and token configuration
Postgres — both PostgreSQL clusters on Dankclaw, side by side

3.2 KiB Raw Blame History