Frank
e5580abb6f
The service came up internal-only: UI on the LAN at 8502, API at 5056, both published on every interface, with only its own shared password in front. That put the episode library outside the fleet's auth chain and one port scan away from anything on the network. - Caddy: guarded vhost notebook.franksdank.cloud (Anubis -> Authentik; provider notebook-proxy, internal_host caddy:8017) plus the post-auth route to the published UI port. One upstream is enough, because the image's own Next.js layer rewrites /api/* to the FastAPI beside it — so the API needs no outward face at all, and 5056 moves to loopback, where only the deployer's health gate dials it. - scripts/open-notebook.env: API_URL and CORS_ORIGINS become the single guarded origin. Left to itself the app auto-detects <host>:5055, the port seerr holds on this host; a LAN-origin API_URL would also take the browser around the guard chain, where its authenticated session does not ride. - addn-hosts: the LAN A record. The homepage card goes live and links the vhost. - Seam: the API origin is derived from whatever the Caddyfile routes to 8502, so renaming the vhost moves the test instead of leaving it blessing a stale name, and a new test proves the vhost hands the WHOLE request to Anubis.
49 lines
1.9 KiB
Plaintext
49 lines
1.9 KiB
Plaintext
# A records for the flat franksdank.name scheme (dnsmasq addn-hosts format:
|
|
# <IP> <name> [<name> ...]). Served by the Pi-hole quadlet (FTL is a
|
|
# dnsmasq fork): the quadlet mounts this file into /etc/pihole/hosts/ read-only.
|
|
#
|
|
# Caddy is consolidated on dankclaw (192.168.0.143): it fronts every service
|
|
# on both hosts, so every name resolves to that one IP. Keep in sync with the
|
|
# Caddyfile (tests/pihole.bats cross-checks this).
|
|
#
|
|
# 192.168.0.143 = dankclaw (runs the Caddy container + the AI/dev stack)
|
|
# 192.168.0.235 = dankserver (media stack; reached by Caddy via published
|
|
# LAN ports — no DNS records point here)
|
|
|
|
# --- Homepage (naked domain + www) + legacy names ---
|
|
192.168.0.143 franksdank.cloud
|
|
192.168.0.143 www.franksdank.cloud
|
|
192.168.0.143 dankclaw.franksdank.cloud
|
|
192.168.0.143 dankserver.franksdank.cloud
|
|
|
|
# --- Authentik (SSO / OIDC provider) ---
|
|
192.168.0.143 auth.franksdank.cloud
|
|
|
|
# --- Media services (dankserver, proxied) ---
|
|
192.168.0.143 plex.franksdank.cloud
|
|
192.168.0.143 plex.franksdank.casa
|
|
192.168.0.143 books.franksdank.cloud
|
|
192.168.0.143 romm.franksdank.cloud
|
|
192.168.0.143 files.franksdank.cloud
|
|
192.168.0.143 jelly.franksdank.cloud
|
|
192.168.0.143 radarr.franksdank.cloud
|
|
192.168.0.143 lidarr.franksdank.cloud
|
|
192.168.0.143 readarr.franksdank.cloud
|
|
192.168.0.143 prowlarr.franksdank.cloud
|
|
192.168.0.143 qbittorrent.franksdank.cloud
|
|
|
|
# --- AI / search / dev services (dankclaw, local) ---
|
|
192.168.0.143 search.franksdank.cloud
|
|
192.168.0.143 comfyui.franksdank.cloud
|
|
192.168.0.143 ai.franksdank.cloud
|
|
192.168.0.143 hermes.franksdank.cloud
|
|
192.168.0.143 hermesadmin.franksdank.cloud
|
|
192.168.0.143 gitea.franksdank.cloud
|
|
192.168.0.143 grafana.franksdank.cloud
|
|
192.168.0.143 prometheus.franksdank.cloud
|
|
192.168.0.143 loki.franksdank.cloud
|
|
192.168.0.143 pihole.franksdank.cloud
|
|
192.168.0.143 seerr.franksdank.cloud
|
|
192.168.0.143 marreta.franksdank.cloud
|
|
192.168.0.143 notebook.franksdank.cloud
|