Files

T

Frank e3eb5334cb feat: initialize serverAppConfigs with podman stacks for Dankserver and Dankclaw

- Dankserver stack: RomM, Copyparty, Calibre-Web, node-exporter
- Dankclaw stack: Gluetun VPN (SearXNG tunnel), SearXNG+Valkey, ComfyUI
  (CPU backend), OpenWebUI, Hermes, Gitea+Postgres (migrated), Caddy
  reverse proxy, Grafana+Prometheus+Loki+Alloy observability
- Caddyfiles with .local hostname convention and basicauth homepage
- bind-mount storage policy, no named volumes
- deploy.sh mirroring vllmScripts git workflow (push -> pull -> restart -> health)
- docs/ Obsidian vault: per-service docs from frank-default-small research
  subagents (promtail EOL -> Alloy; gitea SECRET_KEY preservation; ComfyUI --cpu)
- bats test suite at 6 seams — 22 tests green

2026-08-13 20:19:41 -07:00

2.3 KiB

Raw Blame History

Caddy

Caddy is the reverse proxy for both hosts. It terminates TLS, routes hostnames to containers, and protects the homepage with HTTP basic auth.

Hosts: Dankserver + Dankclaw — Docs: https://caddyserver.com/docs

Facts (from live inventory + knowledge base)

Item	Value
Image	`docker.io/library/caddy:latest`
Config	`/etc/caddy/Caddyfile` (bind mount)
Data	`/root/.local/share/caddy` (certs, ACME state)
Ports	80, 443
Existing on Dankserver	systemd `caddy` service (native), config at `/etc/caddy/Caddyfile` — being migrated into this repo

Existing Dankserver Caddyfile (live, to migrate)

The live Caddyfile proxies:

plex.franksdank.casa / plex.franksdank.cloud / plex.dankserver.local → localhost:32400 (Plex)
books.franksdank.cloud → localhost:8083 (Calibre-Web)
llms.franksdank.cloud / llms.dankserver.local → localhost:3000 (OpenWebUI — being moved to Dankclaw)
search.dankserver.local → localhost:8081 (SearXNG — being moved to Dankclaw)

Hostname Convention

Every service gets a .dankserver.local or .dankclaw.local hostname so no one has to remember port numbers:

romm.dankserver.local
books.dankserver.local
files.dankserver.local
search.dankclaw.local
chat.dankclaw.local
gitea.dankclaw.local
comfyui.dankclaw.local
grafana.dankclaw.local
prometheus.dankclaw.local

Basic Auth

Generate a bcrypt hash with caddy hash-password, then:

chat.dankclaw.local {
    basicauth {
        dank $2a$14$xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    }
    reverse_proxy localhost:3000
}

The homepage uses basic auth too; see Homepage.

Homepage

A static page lists all services with live status (up/down) and a short description plus a link to each service's documentation. Served by Caddy with file_server and protected by basic auth.

Gotchas

Caddy auto-provisions Let's Encrypt certs for public domains; .local names stay internal (no external DNS).
Validate before reload: caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile.
Certificates live in the caddy data volume; back it up with the stack.

2.3 KiB Raw Blame History