MetaFeederUsenet: glue only (feeder 1.1.0 + enrichment), talks to the NNTmux app over its Newznab API; nntmux moved to worph/AppStore

Apps/MetaFeederUsenet/rationale.md

@@ -3,62 +3,33 @@
 ## What deviation / exception is being requested
 
 1. `metafeederusenet-feeder` runs `user: 0:0`.
-2. The **NNTmux web UI is published on its own hostname**
-   (`metafeederusenetnntmux-<user>.<domain>`) with no AppShield sidecar in front of it — it
-   is protected by NNTmux's own login only.
-3. The seeded `nntmux.env` contains TMDB and TVDB API keys as literals.
+
+(The NNTmux indexer this feeder used to bundle — and its own exceptions: a web UI on its own
+login, seeded TMDB/TVDB keys — is now the separate **NNTmux** app in worph/AppStore, with its
+own `rationale.md`.)
 
 ## Why it is necessary
 
 1. The feeder publishes resolved records to the shared MetaCore and writes plugin artwork
    through its WebDAV endpoint; those targets are created and owned by MetaCore's
    root-running container.
-2. NNTmux is a Laravel application with its own user table, session handling and admin
-   role. Its admin account is created at install from `$APP_DEFAULT_PASSWORD`, so
-   authentication is **enabled by default** — the "app's own built-in auth" alternative the
-   security checklist accepts. Fronting it with AppShield as well would double-prompt on
-   every page and breaks its own OTP and password-reset flows.
-3. Those two keys are NNTmux's upstream project defaults, shipped in its own
-   `.env.example`. They are shared read-only application keys for public metadata catalogs,
-   not user credentials, and they are what makes the app work immediately after
-   installation with no manual configuration. An operator can replace them from the NNTmux
-   admin UI.
 
 ## Security mitigations in place
 
-- The NNTmux admin password is `$APP_DEFAULT_PASSWORD` — the platform-generated secret —
-  and the database password comes from the same variable. Neither is a hardcoded literal,
-  and both are surfaced to the user in `tips.before_install`.
-- The feeder's own configuration UI *is* behind AppShield + Authelia SSO
-  (`ghcr.io/yundera/appshield:2.0.9`).
-- `metafeederusenet-db`, `-redis` and `-manticore` are on the app-private
-  `metafeederusenet` bridge network, carry no Caddy labels and publish no host port, so no
-  sibling app on the shared `pcs` network can resolve or dial them.
-- NNTP provider credentials are deliberately left **blank** in the seed; the user fills
-  them in per `tips.before_install`. Nothing ships with a working news account.
-- The `nntmux.env` seed is guarded by `[ ! -f … ]`, so a reinstall or version upgrade never
-  overwrites the operator's provider settings. `scanner.sh` is intentionally rewritten on
-  every run — it is shipped code, not operator config, so a store update must be able to
-  replace a stale copy; the write is idempotent.
-- No user directories are mounted. All binds are under `/DATA/AppData/metafeederusenet/`,
-  declared in `x-compose-app.folders`.
-- `cpu_shares` on all nine services; every image pinned (the NNTmux and Manticore images by
-  digest).
+- No web UI and no Caddy route: the feeder's configuration page is reached only through the
+  MetaGateway dashboard's proxy, behind the gateway's login.
+- It talks to NNTmux only over NNTmux's Newznab API, with the key of a dedicated
+  `metamesh` user — it holds no database credential and mounts no NNTmux storage.
+- The API key and the indexer keys are secrets on the feeder's config page (write-only,
+  never echoed back); none has an env seed or a default.
+- `cpu_shares` and memory caps on all three services; every image pinned.
 
 ## Alternatives considered and rejected
 
-- **AppShield in front of NNTmux.** Two independent login gates on one UI; its OTP,
-  password-reset and API endpoints break behind the OIDC redirect.
-- **Blank the TMDB/TVDB keys.** The app then installs into a state where covers and
-  metadata silently fail until the user finds two upstream registration flows — a direct
-  violation of "works immediately after installation, no manual configuration required for
-  basic functionality".
 - **Run the feeder as `$PUID:$PGID`.** Writes into MetaCore's root-owned tree fail.
 
 ## Data protection
 
-All state — MariaDB, the NZB store, the feeder cursor, the TMDB cache — is under
-`/DATA/AppData/metafeederusenet/`, the unit Maison archives on uninstall and restores from
-backup, so an uninstall/reinstall with "keep user data" comes back with the release
-catalogue intact rather than re-scanning Usenet from scratch. No user media directory is
-mounted into any service.
+All state — the feeder config, its redb cache, the per-release `.nzb` cache, the TMDB
+cache — is under `/DATA/AppData/metafeederusenet/`. The `.nzb` cache is re-derivable from
+NNTmux. No user media directory is mounted.