Files

T

Frank 93d1181fee docs: OKF v0.1 compliance pass + fact-check + 3 research briefs

- Migrate all 127 non-reserved docs to OKF v0.1 frontmatter (type/description/tags/timestamp); fix 13 YAML issues, 2 duplicate-FM blocks, strip reserved-page FM
- Restructure log.md to OKF (## YYYY-MM-DD, newest-first)
- Fact-check against scripts/AGENTS.md ground truth: fix 6 false 'Active' banners on retired runbooks, 96->114 GiB GTT, deployment.md vs deploy-plan.py/deploy-remote.sh, Deployment Flow frank-medium=Quadlet, Calibre 9.9.0->9.15.0 + CVE-2025-7404 conflation, Copyparty v1.20.24, RomM 5.3.0 breaking change
- Move *arr docs to new FrankBook-Pro/ section (git mv, link-safe)
- Write active runbook bodies from ground truth (frank-large, frank-small)
- Add 3 research briefs + HTML report: Local TTS and Voice Cloning, AI Job Search and Resume Tools, Most Popular Self-Hosted AI Apps (Jun-Sep 2026)
- Add upstream-version rows to ComfyUI/OpenWebUI/Hermes app docs
- All 336 tests pass; 136 pages, 0 unresolved wikilinks

2026-09-22 02:09:41 -07:00

4.1 KiB

Raw Blame History

type, description, tags, timestamp

type

description

Seerr

Seerr is the unified request manager for the *arr stack (the maintained seerr-team/seerr successor to the archived Overseerr/Jellyseerr line). Frank's household uses it to request movies/TV/music; Seerr routes approvals to Sonarr/Radarr/Lidarr/Readarr on FrankBook-Pro and pushes downloads to qBittorrent.

Host: Dankclaw — Hostname: seerr.franksdank.cloud (Caddy, guarded) — Docs: https://github.com/seerr-team/seerr

Facts (verified live, 2026-09-01)

Item	Value
Image	`ghcr.io/seerr-team/seerr:v3.4.1` (runs as in-image `node`, uid 1000)
Port	5055 (container), published `127.0.0.1:5055` on the host (loopback-only)
Data	`/home/dank/Containers/seerr/data` → `/app/config` (SQLite settings store)
Unit	`dankclaw/seerr/quadlet/seerr.container` → `seerr.service`
Network	`dankclaw_default` (post-auth listener reachability)
Guard	Caddy TLS edge → Anubis :8923 → Authentik outpost provider `seerr-proxy` → Caddy :8017 `@seerr` handler → `seerr:5055`
DNS	Pi-hole addn-hosts only. The public Porkbun A record was deleted on 2026-09-02, so the name resolves on the LAN (→ 192.168.0.143) and returns NXDOMAIN on the WAN: Seerr is internal-only by construction

Why loopback-only publishing

Seerr is browser-facing; the only sanctioned user path is the guard chain (Caddy → Anubis → Authentik SSO). PublishPort=127.0.0.1:5055:5055 keeps the app off the LAN entirely while still letting the homepage probe agent and host-local checks reach it — the same loopback convention as other guarded hosts (see Homepage Design Grilling).

Guard chain fix (2026-09-02)

The seerr-proxy provider was provisioned by script with no flows and no Application — silently broken in two ways: the null flows wedged the embedded outpost's config deserializer (taking every guarded vhost down at the next outpost reload), and the missing app bounced post-login to authentik's own user UI instead of Seerr. Both backfilled live: the three standard flows copied from a known-good provider, plus an application (seerr-guard) linked to the provider. Verified by the hardened SSO sweep (tests/e2e/specs/13-sso.spec.ts) — see Authentik for the two provisioning rules this incident established.

*arr wiring

Seerr reaches the *arr services on FrankBook-Pro (192.168.0.112, gluetun-NetNS stack inside the Mac's podman machine VM) by IP-based base URLs (http://192.168.0.112:<port>), configured inside Seerr's own web settings — not in env or quadlet. The .lan hostname variant was deliberately dropped: addn-hosts records are for fleet public-domain hosts, and IP bases match the Mac stack's verified LAN reachability. API keys live in each arr's config.xml on the Mac and are entered through Seerr's settings store.

OIDC single-sign-on for Seerr (Authentik OIDC provider + Seerr OIDC config) remains an open option; the guard chain already authenticates the front door, so this is an in-app setting deferred to Frank's first-run session.

UID mapping gotcha

The container runs as node (uid 1000 in-image). Rootless podman's continuous mapping is container uid N → host uid 100000 + N - 1, so uid 1000 → 100999. The first deploy chowned the data dir to 100999 + 1 (= 101000) and crash-looped with EACCES mkdir /app/config/logs. Rule: read the real mapping from any container's /proc/self/uid_map before chowning bind roots for non-root images.

Deployment

./scripts/deploy.sh dankclaw --service seerr. The deployer pre-creates the bind-source dir, installs the unit, and restarts. First visit after deploy: complete the Seerr local-admin setup wizard (the guard chain bounces through Authentik first). TLS issuance for a new vhost fires at Caddy reload (dns-01) — allow ~15 s before the first HTTPS probe.

Citations

Seerr image and volume contract: https://github.com/seerr-team/seerr (official docs recommend /app/config persistence)

4.1 KiB Raw Blame History