Add Trusted-LAN LocalSend receiver on NOMAD

localsend-nomad/README.md

@@ -0,0 +1,71 @@
+# LocalSend trusted-lane receiver on N.O.M.A.D.
+
+Repo-tracked Docker stack that runs a headless LocalSend receiver on N.O.M.A.D. with its own Trusted-LAN IP.
+
+- Repo stack path: `/home/fizzlepoof/repos/truenas-stacks/localsend-nomad`
+- Live stack path: `/opt/localsend-nomad`
+- Trusted bind IP: `10.5.1.16`
+- Trusted VLAN: `51`
+- LocalSend ports: `53317/tcp`, `53317/udp`
+- Inbox path on host: `/home/fizzlepoof/private/inbox-secrets`
+- Advertised device name: `Doris Trusted Inbox`
+
+## Why this exists
+
+N.O.M.A.D. lives on the `Servers` VLAN (`10.5.30.7`), but some operator handoff flows need a LocalSend receiver directly reachable from the `Trusted` LAN (`10.5.1.0/24`). This stack gives LocalSend its own Trusted-LAN address without moving the host itself off the Servers network.
+
+## Network model
+
+- Docker uses a `macvlan` network with parent `enp5s0.51`.
+- `enp5s0.51` is the Trusted VLAN subinterface on N.O.M.A.D.'s primary NIC.
+- Docker will create the VLAN subinterface automatically when the macvlan network is created.
+- Same-host testing from N.O.M.A.D. to `10.5.1.16` is unreliable because macvlan isolates the host from the container's address on the same parent interface.
+- Verify reachability from another Trusted-LAN peer instead, such as PD on `10.5.1.6`.
+
+## LocalSend build provenance
+
+The image is built locally from upstream `0w0mewo/localsend-cli` at:
+
+- commit: `54702513990eeb763e1615f274d5365442e3e393`
+
+Then it applies `patches/localsend-cli-doris.patch`, which keeps the receiver compatible with the LocalSend endpoint behavior already working in the existing Doris receiver flow.
+
+## Files
+
+- `docker-compose.yaml` — live stack definition
+- `Dockerfile` — reproducible CLI build from upstream + patch
+- `.env.example` — deployment variables
+- `bin/prepare_nomad.sh` — creates runtime dirs, validates config, optional `--up`
+- `patches/localsend-cli-doris.patch` — repo-tracked patch applied during image build
+
+## Deploy / refresh on NOMAD
+
+```bash
+cd /opt/localsend-nomad
+cp .env.example .env
+./bin/prepare_nomad.sh --up
+```
+
+## Verification
+
+From N.O.M.A.D.:
+
+```bash
+docker compose --env-file .env ps
+sudo docker logs --tail 50 localsend-trusted
+```
+
+From another Trusted-LAN host:
+
+```bash
+ping 10.5.1.16
+nc -vz 10.5.1.16 53317
+```
+
+Then confirm `Doris Trusted Inbox` appears as a LocalSend target from a Trusted-LAN device.
+
+## Notes
+
+- The container writes directly into `/home/fizzlepoof/private/inbox-secrets` on the host so the existing autosort / intake flow can keep using the same inbox path.
+- This stack does not publish host ports; the dedicated Trusted-LAN IP is the service endpoint.
+- If the upstream CLI behavior changes later, rebuild from a reviewed newer commit and update the patch or drop it if upstream no longer needs the workaround.