0 Fork 0

Files

T

Frank 90c4ac69a7 Doc audit: fix all broken links + correct stale facts across the KB

Fanned out 5 read-only doc-auditor subagents (one per service group) that
fact-checked the knowledge base against the live system + repo config,
researched official setup docs online, and verified progress. Applied:
- All 34 broken links fixed (real pages / external URLs / correct relative
  paths); 0 broken links remain. No .AGENTTRASH links (the 4 mentions are
  accurate descriptive text, not links).
- Fact-check fixes: Readarr retired (May 2026), Radarr v4->v6, Calibre
  9.2.1 live, Calibre-Web 0.6.25 live, Copyparty v1.20.21, LLM index
  ncmoe 38 + 786432 ctx, frank-default-small active (not frank-pp-worker),
  Hermes/SearXNG/Grafana hostnames, Loki/Alloy local images, Observability
  diagram (Promtail->Alloy), VLLM retired note, DFlash status, benchmark
  live-drift notes, Homepage test count 116.

2026-08-24 01:10:44 -07:00

2.6 KiB

Raw Blame History

Network Architecture

One Caddy fronts both hosts. It runs as a container on Dankclaw (192.168.0.143) and terminates TLS for every service on the LAN. dnsmasq on Dankclaw answers the service names for LAN clients; Porkbun answers them for the WAN. The G36 router firewall governs external access. SearXNG outbound traffic exits through the Gluetun VPN container.

Topology

graph TB
    subgraph WAN["G36 router 192.168.0.1"]
        EXT[Internet]
    end
    EXT -->|port forwards| C
    subgraph Dankclaw[192.168.0.143]
        C[Caddy :80 :443]
        D[dnsmasq :53]
        C -->|comfyui:8188| F[ComfyUI]
        C -->|192.168.0.143:3000| G[Gitea quadlet]
        C -->|192.168.0.143:8081| SE[SearXNG quadlet]
        C -->|192.168.0.143:3005| O[OpenWebUI quadlet]
        SE -->|network_mode service| GL[Gluetun VPN]
        GL -->|tunnel| EXT
    end
    subgraph Dankserver[192.168.0.235]
        C -->|192.168.0.235:8085| R[RomM]
        C -->|192.168.0.235:3923| P[Copyparty]
        C -->|192.168.0.235:8083| W[Calibre-Web]
        C -->|192.168.0.235:32400| PL[Plex host service]
    end
    CLIENT[LAN clients] -->|DHCP DNS| D

Dankserver runs no proxy of its own. Its services expose published LAN ports, and the Dankclaw Caddy routes the names to those ports.

Hostnames

Scope	Convention	Resolved by
LAN	`romm.franksdank.cloud` → 192.168.0.143	dnsmasq (`addn-hosts`)
WAN	`romm.franksdank.cloud` → 71.227.227.172	Porkbun A record

Users type a name and nothing else. Caddy maps the name to the upstream. The split between the two resolvers removes the need for router NAT loopback. See LAN-DNS for the flow and the router hand-off.

TLS

Caddy holds one Let's Encrypt certificate per vhost, issued and renewed through the DNS-01 challenge via the Porkbun module. No inbound port 80/443 is required. Details in Caddy.

Gluetun Path (SearXNG only)

SearXNG attaches to the Gluetun network namespace (network_mode: service:gluetun). Only SearXNG shares the tunnel. Everything else on Dankclaw uses the normal LAN route. This matches KB Pattern 2 in Gluetun.

Access Policy

The G36 router firewall governs what the WAN can reach. Port forwards are manual router steps; the repo tracks no router state.
Caddy adds HTTP basic auth on the homepage and on sensitive services.
LAN subnet: 192.168.0.0/24.

2.6 KiB Raw Blame History