Frank
93d1181fee
- Migrate all 127 non-reserved docs to OKF v0.1 frontmatter (type/description/tags/timestamp); fix 13 YAML issues, 2 duplicate-FM blocks, strip reserved-page FM - Restructure log.md to OKF (## YYYY-MM-DD, newest-first) - Fact-check against scripts/AGENTS.md ground truth: fix 6 false 'Active' banners on retired runbooks, 96->114 GiB GTT, deployment.md vs deploy-plan.py/deploy-remote.sh, Deployment Flow frank-medium=Quadlet, Calibre 9.9.0->9.15.0 + CVE-2025-7404 conflation, Copyparty v1.20.24, RomM 5.3.0 breaking change - Move *arr docs to new FrankBook-Pro/ section (git mv, link-safe) - Write active runbook bodies from ground truth (frank-large, frank-small) - Add 3 research briefs + HTML report: Local TTS and Voice Cloning, AI Job Search and Resume Tools, Most Popular Self-Hosted AI Apps (Jun-Sep 2026) - Add upstream-version rows to ComfyUI/OpenWebUI/Hermes app docs - All 336 tests pass; 136 pages, 0 unresolved wikilinks
61 lines
4.1 KiB
Markdown
61 lines
4.1 KiB
Markdown
---
|
|
type: reference
|
|
description: "Seerr is the unified request manager for the *arr stack (the maintained `seerr-team/seerr` successor to the archived Overseerr/Jellyseerr line)."
|
|
tags:
|
|
- dankclaw
|
|
- seerr
|
|
timestamp: 2026-09-02
|
|
---
|
|
|
|
# Seerr
|
|
|
|
Seerr is the unified request manager for the *arr stack (the maintained `seerr-team/seerr` successor to the archived Overseerr/Jellyseerr line). Frank's household uses it to request movies/TV/music; Seerr routes approvals to Sonarr/Radarr/Lidarr/Readarr on FrankBook-Pro and pushes downloads to qBittorrent.
|
|
|
|
**Host:** Dankclaw — **Hostname:** `seerr.franksdank.cloud` (Caddy, guarded) — **Docs:** https://github.com/seerr-team/seerr
|
|
|
|
## Facts (verified live, 2026-09-01)
|
|
|
|
| Item | Value |
|
|
|------|-------|
|
|
| Image | `ghcr.io/seerr-team/seerr:v3.4.1` (runs as in-image `node`, uid 1000) |
|
|
| Port | 5055 (container), published `127.0.0.1:5055` on the host (loopback-only) |
|
|
| Data | `/home/dank/Containers/seerr/data` → `/app/config` (SQLite settings store) |
|
|
| Unit | `dankclaw/seerr/quadlet/seerr.container` → `seerr.service` |
|
|
| Network | `dankclaw_default` (post-auth listener reachability) |
|
|
| Guard | Caddy TLS edge → Anubis :8923 → Authentik outpost provider `seerr-proxy` → Caddy :8017 `@seerr` handler → `seerr:5055` |
|
|
| DNS | Pi-hole addn-hosts only. The public Porkbun A record was deleted on 2026-09-02, so the name resolves on the LAN (→ 192.168.0.143) and returns NXDOMAIN on the WAN: Seerr is internal-only by construction |
|
|
|
|
## Why loopback-only publishing
|
|
|
|
Seerr is browser-facing; the only sanctioned user path is the guard chain (Caddy → Anubis → Authentik SSO). `PublishPort=127.0.0.1:5055:5055` keeps the app off the LAN entirely while still letting the homepage probe agent and host-local checks reach it — the same loopback convention as other guarded hosts (see [[Homepage Design Grilling]]).
|
|
|
|
## Guard chain fix (2026-09-02)
|
|
|
|
The `seerr-proxy` provider was provisioned by script with **no flows and no
|
|
Application** — silently broken in two ways: the null flows wedged the
|
|
embedded outpost's config deserializer (taking every guarded vhost down at
|
|
the next outpost reload), and the missing app bounced post-login to
|
|
authentik's own user UI instead of Seerr. Both backfilled live: the three
|
|
standard flows copied from a known-good provider, plus an application
|
|
(`seerr-guard`) linked to the provider. Verified by the hardened SSO sweep
|
|
(`tests/e2e/specs/13-sso.spec.ts`) — see [[Authentik]] for the two
|
|
provisioning rules this incident established.
|
|
|
|
## *arr wiring
|
|
|
|
Seerr reaches the *arr services on FrankBook-Pro (192.168.0.112, gluetun-NetNS stack inside the Mac's podman machine VM) by IP-based base URLs (`http://192.168.0.112:<port>`), configured inside Seerr's own web settings — not in env or quadlet. The `.lan` hostname variant was deliberately dropped: addn-hosts records are for fleet public-domain hosts, and IP bases match the Mac stack's verified LAN reachability. API keys live in each arr's config.xml on the Mac and are entered through Seerr's settings store.
|
|
|
|
OIDC single-sign-on for Seerr (Authentik OIDC provider + Seerr OIDC config) remains an open option; the guard chain already authenticates the front door, so this is an in-app setting deferred to Frank's first-run session.
|
|
|
|
## UID mapping gotcha
|
|
|
|
The container runs as `node` (uid 1000 in-image). Rootless podman's continuous mapping is container uid N → host uid `100000 + N - 1`, so uid 1000 → **100999**. The first deploy chowned the data dir to 100999 + 1 (= 101000) and crash-looped with `EACCES mkdir /app/config/logs`. Rule: read the real mapping from any container's `/proc/self/uid_map` before chowning bind roots for non-root images.
|
|
|
|
## Deployment
|
|
|
|
`./scripts/deploy.sh dankclaw --service seerr`. The deployer pre-creates the bind-source dir, installs the unit, and restarts. First visit after deploy: complete the Seerr local-admin setup wizard (the guard chain bounces through Authentik first). TLS issuance for a new vhost fires at Caddy reload (dns-01) — allow ~15 s before the first HTTPS probe.
|
|
|
|
## Citations
|
|
|
|
- Seerr image and volume contract: https://github.com/seerr-team/seerr (official docs recommend `/app/config` persistence)
|