Files

T

Frank e3eb5334cb feat: initialize serverAppConfigs with podman stacks for Dankserver and Dankclaw

- Dankserver stack: RomM, Copyparty, Calibre-Web, node-exporter
- Dankclaw stack: Gluetun VPN (SearXNG tunnel), SearXNG+Valkey, ComfyUI
  (CPU backend), OpenWebUI, Hermes, Gitea+Postgres (migrated), Caddy
  reverse proxy, Grafana+Prometheus+Loki+Alloy observability
- Caddyfiles with .local hostname convention and basicauth homepage
- bind-mount storage policy, no named volumes
- deploy.sh mirroring vllmScripts git workflow (push -> pull -> restart -> health)
- docs/ Obsidian vault: per-service docs from frank-default-small research
  subagents (promtail EOL -> Alloy; gitea SECRET_KEY preservation; ComfyUI --cpu)
- bats test suite at 6 seams — 22 tests green

2026-08-13 20:19:41 -07:00

1.7 KiB

Raw Blame History

Network Architecture

Both hosts run Caddy as the single entry point. Every service is reachable by hostname; the router firewall governs external access. On Dankclaw, SearXNG's outbound traffic exits through the Gluetun VPN container.

Topology

graph TB
    subgraph WAN[Router 192.168.0.1 firewall]
        EXT[Internet]
    end
    EXT -->|port forward| DS[Caddy Dankserver]
    EXT -->|port forward| DC[Caddy Dankclaw]
    subgraph Dankserver[192.168.0.235]
        DS --> R[RomM :8085]
        DS --> P[Copyparty :3923]
        DS --> W[Calibre-Web :8083]
    end
    subgraph Dankclaw[192.168.0.143]
        DC --> O[OpenWebUI :3000]
        DC --> G[Gitea :3001]
        DC --> F[ComfyUI :8188]
        DC --> GR[Grafana :3002]
        DC --> PR[Prometheus :9090]
        DC --> SE[SearXNG :8081]
        SE -->|network_mode service| GL[Gluetun VPN]
        GL -->|tunnel| EXT
    end

Hostnames

Host	Convention
Dankserver	`*.dankserver.local` → Caddy → service
Dankclaw	`*.dankclaw.local` → Caddy → service

Users never type ports; Caddy maps names to upstreams.

Gluetun Path (SearXNG only)

SearXNG attaches to the Gluetun network namespace (network_mode: service:gluetun). Only SearXNG shares the tunnel. Everything else on Dankclaw uses the normal LAN route. This matches KB Pattern 2 in VPN Routing for SearXNG.

Access Policy

All services assume external access is possible; the router firewall governs what the WAN can reach.
Caddy adds HTTP basic auth on the homepage and on sensitive services.
LAN subnet: 192.168.0.0/24.

1.7 KiB Raw Blame History