Files

T

Frank 1e491fa69f docs(hermes,dns): document the new internal-only exposure surface

Post-change doc reconciliation for the hermes vhosts + DNS deletion batch:

- Hermes-Dashboard.md: access is now the hermesadmin.franksdank.cloud vhost
  (direct Caddy proxy to 192.168.0.143:9119, no guard chain — exempt because the
  dashboard enforces its own basic-auth login), plus the raw LAN port. The old
  text claimed an Authentik-guarded public vhost, which was decommissioned.
- Hermes-WebUI.md: description updated — the webui is now also reachable via the
  unguarded hermes.franksdank.cloud vhost (its own password auth is the gate).
- LAN-DNS.md: "add a name in two places" corrected to a two-or-three-step
  decision; internal-only names (prometheus/loki/grafana/seerr) deliberately get
  no public A record and resolve on the LAN only, and DNS-01 issuance is
  unaffected because the challenge is a TXT record in the same zone.
- Seerr.md: DNS row corrected — addn-hosts only since 2026-09-02; NXDOMAIN on WAN.
- hermes-dashboard.container: unit comment no longer claims Authentik termination.

No behavior change in this commit; tests 233/233 green (docs-completeness seam included).

2026-09-02 18:57:38 -07:00

3.9 KiB

Raw Blame History

Seerr

Seerr is the unified request manager for the *arr stack (the maintained seerr-team/seerr successor to the archived Overseerr/Jellyseerr line). Frank's household uses it to request movies/TV/music; Seerr routes approvals to Sonarr/Radarr/Lidarr/Readarr on FrankBook-Pro and pushes downloads to qBittorrent.

Host: Dankclaw — Hostname: seerr.franksdank.cloud (Caddy, guarded) — Docs: https://github.com/seerr-team/seerr

Facts (verified live, 2026-09-01)

Item	Value
Image	`ghcr.io/seerr-team/seerr:v3.4.1` (runs as in-image `node`, uid 1000)
Port	5055 (container), published `127.0.0.1:5055` on the host (loopback-only)
Data	`/home/dank/Containers/seerr/data` → `/app/config` (SQLite settings store)
Unit	`dankclaw/seerr/quadlet/seerr.container` → `seerr.service`
Network	`dankclaw_default` (post-auth listener reachability)
Guard	Caddy TLS edge → Anubis :8923 → Authentik outpost provider `seerr-proxy` → Caddy :8017 `@seerr` handler → `seerr:5055`
DNS	Pi-hole addn-hosts only. The public Porkbun A record was deleted on 2026-09-02, so the name resolves on the LAN (→ 192.168.0.143) and returns NXDOMAIN on the WAN: Seerr is internal-only by construction

Why loopback-only publishing

Seerr is browser-facing; the only sanctioned user path is the guard chain (Caddy → Anubis → Authentik SSO). PublishPort=127.0.0.1:5055:5055 keeps the app off the LAN entirely while still letting the homepage probe agent and host-local checks reach it — the same loopback convention as other guarded hosts (see Homepage Design Grilling).

Guard chain fix (2026-09-02)

The seerr-proxy provider was provisioned by script with no flows and no Application — silently broken in two ways: the null flows wedged the embedded outpost's config deserializer (taking every guarded vhost down at the next outpost reload), and the missing app bounced post-login to authentik's own user UI instead of Seerr. Both backfilled live: the three standard flows copied from a known-good provider, plus an application (seerr-guard) linked to the provider. Verified by the hardened SSO sweep (tests/e2e/specs/13-sso.spec.ts) — see Authentik for the two provisioning rules this incident established.

*arr wiring

Seerr reaches the *arr services on FrankBook-Pro (192.168.0.112, gluetun-NetNS stack inside the Mac's podman machine VM) by IP-based base URLs (http://192.168.0.112:<port>), configured inside Seerr's own web settings — not in env or quadlet. The .lan hostname variant was deliberately dropped: addn-hosts records are for fleet public-domain hosts, and IP bases match the Mac stack's verified LAN reachability. API keys live in each arr's config.xml on the Mac and are entered through Seerr's settings store.

OIDC single-sign-on for Seerr (Authentik OIDC provider + Seerr OIDC config) remains an open option; the guard chain already authenticates the front door, so this is an in-app setting deferred to Frank's first-run session.

UID mapping gotcha

The container runs as node (uid 1000 in-image). Rootless podman's continuous mapping is container uid N → host uid 100000 + N - 1, so uid 1000 → 100999. The first deploy chowned the data dir to 100999 + 1 (= 101000) and crash-looped with EACCES mkdir /app/config/logs. Rule: read the real mapping from any container's /proc/self/uid_map before chowning bind roots for non-root images.

Deployment

./scripts/deploy.sh dankclaw --service seerr. The deployer pre-creates the bind-source dir, installs the unit, and restarts. First visit after deploy: complete the Seerr local-admin setup wizard (the guard chain bounces through Authentik first). TLS issuance for a new vhost fires at Caddy reload (dns-01) — allow ~15 s before the first HTTPS probe.

Citations

Seerr image and volume contract: https://github.com/seerr-team/seerr (official docs recommend /app/config persistence)

3.9 KiB Raw Blame History