fizzlepoof/truenas-stacks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: capture PD future-state architecture
Some checks failed
secret-guardrails / artifact-secret-scan (push) Has been cancelled
Details
secret-guardrails / gitleaks (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Fizzlepoof
2026-05-25 18:02:25 +00:00
parent dac033e263
commit a7b00e6742
9 changed files with 556 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/README.md
View File

@@ -18,6 +18,7 @@ Central index for all homelab infrastructure documentation.
| [Architecture Overview](architecture/ARCHITECTURE_OVERVIEW.md) | Full stack diagram and service map | | [Architecture Overview](architecture/ARCHITECTURE_OVERVIEW.md) | Full stack diagram and service map |
| [Services Directory](architecture/SERVICES_DIRECTORY.md) | All services with hosts, ports, and status | | [Services Directory](architecture/SERVICES_DIRECTORY.md) | All services with hosts, ports, and status |
| [Networking Model](architecture/NETWORKING_MODEL.md) | VLANs, firewall policy, DHCP DNS, and remote access | | [Networking Model](architecture/NETWORKING_MODEL.md) | VLANs, firewall policy, DHCP DNS, and remote access |
| [PD Future-State Topology](architecture/pd-future-state-topology.html) | Visual target-state diagram for the PD rebuild, cyber VM lane, and Serenity retirement |
| [AI Services Network](architecture/AI_SERVICES_NETWORK.md) | Cross-stack Docker networking for AI services | | [AI Services Network](architecture/AI_SERVICES_NETWORK.md) | Cross-stack Docker networking for AI services |
## Stacks ## Stacks
@@ -34,6 +35,7 @@ Central index for all homelab infrastructure documentation.
| File | Description | | File | Description |
|------|-------------| |------|-------------|
| [Expansion Plan](planning/HOMELAB_EXPANSION_PLAN.md) | 6-phase buildout — all phases complete as of 2026-05-06 | | [Expansion Plan](planning/HOMELAB_EXPANSION_PLAN.md) | 6-phase buildout — all phases complete as of 2026-05-06 |
| [PD Future-State Architecture](planning/PD_FUTURE_STATE_ARCHITECTURE.md) | Target-state host layout, storage model, cyber VM policy, and Serenity retirement path |
| [TODO](planning/TODO.md) | Active and backlog tasks | | [TODO](planning/TODO.md) | Active and backlog tasks |
## Operations ## Operations

11
docs/architecture/ARCHITECTURE_OVERVIEW.md
View File

@@ -1,6 +1,6 @@
# Architecture Overview # Architecture Overview
Full homelab stack as of 2026-05-09. All 6 expansion phases are complete and deployed. Current live homelab stack plus the planned direction for the upgraded PD platform.
## Servers ## Servers
@@ -74,3 +74,12 @@ Full homelab stack as of 2026-05-09. All 6 expansion phases are complete and dep
4. **NFS for Immich** — photo library lives on Serenity's large array; PD mounts on demand (not at boot) 4. **NFS for Immich** — photo library lives on Serenity's large array; PD mounts on demand (not at boot)
5. **TrueNAS manages Docker** — never use `systemctl restart docker` on PD; use `docker compose` or `docker restart` for individual containers 5. **TrueNAS manages Docker** — never use `systemctl restart docker` on PD; use `docker compose` or `docker restart` for individual containers
6. **Credential hygiene** — Gitea pushes from PD/NOMAD use internal SSH (`ssh://git@10.5.30.6:2222/<owner>/<repo>.git`); GitHub remote uses SSH key (`/root/.ssh/id_gitea`) 6. **Credential hygiene** — Gitea pushes from PD/NOMAD use internal SSH (`ssh://git@10.5.30.6:2222/<owner>/<repo>.git`); GitHub remote uses SSH key (`/root/.ssh/id_gitea`)
## Planned Direction — upgraded PD + Serenity retirement
- **PD stays on bare-metal TrueNAS Scale** and becomes the long-term production center of gravity for storage, Docker, shared databases, media, identity, monitoring, and the primary DNS source node.
- **PD may also host cybersecurity VMs**, but only inside a dedicated lab VLAN / policy lane with default-deny access into production.
- **N.O.M.A.D. remains the trusted secondary lane** for offline knowledge, game hosting, and the backup Technitium resolver.
- **Rocinante becomes optional** if PD receives the 4090; otherwise it stays the heavy inference specialist.
- **Serenity is transitional**: as long as it owns the storage, qBittorrent/ARR locality can remain there; once PD directly owns the storage, that path-locality argument flips and the remaining torrent/media-ingest stack should move to PD before Serenity is retired.
- See [../planning/PD_FUTURE_STATE_ARCHITECTURE.md](../planning/PD_FUTURE_STATE_ARCHITECTURE.md) for the full target-state plan and [pd-future-state-topology.html](pd-future-state-topology.html) for the visual operator map.

12
docs/architecture/HARDWARE_INVENTORY.md
View File

@@ -47,6 +47,18 @@
### NFS Mounts ### NFS Mounts
- Serenity data array → `/mnt/unraid/data` - Serenity data array → `/mnt/unraid/data`
### Planned PD upgrade target
- **Platform:** HL15 Beast ASRock build (`ASRock ROMED8-2T`)
- **Recommended CPU floor:** EPYC 7282
- **Preferred long-term CPU:** EPYC 7452 if budget allows
- **RAM floor:** 64GB
- **Preferred RAM if hosting production plus multiple cyber VMs:** 128GB
- **PSU guidance:** keep the RM1000x unless a 4090-class GPU is likely; move to HX1500i when the 4090 plan becomes real
- **Planned storage growth:**
- adopt Serenity's storage role into PD
- add a second HDD-backed ZFS pool using 5-6 new 20TB+ drives
- add SSD/NVMe tiers for apps, databases, VM disks, scratch, and model cache
--- ---
## N.O.M.A.D. (Offline Knowledge + Game Servers) ## N.O.M.A.D. (Offline Knowledge + Game Servers)

210
docs/architecture/pd-future-state-topology.html Normal file
View File

@@ -0,0 +1,210 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>PD Future-State Topology</title>
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;600;700&display=swap" rel="stylesheet">
<style>
:root {
--bg: #020617;
--panel: #0f172a;
--panel-2: #111827;
--text: #e2e8f0;
--muted: #94a3b8;
--cyan: #22d3ee;
--emerald: #34d399;
--violet: #a78bfa;
--amber: #fbbf24;
--rose: #fb7185;
--slate: #94a3b8;
--line: #1e293b;
}
* { box-sizing: border-box; }
body {
margin: 0;
font-family: 'JetBrains Mono', monospace;
color: var(--text);
background:
linear-gradient(var(--line) 1px, transparent 1px),
linear-gradient(90deg, var(--line) 1px, transparent 1px),
var(--bg);
background-size: 40px 40px;
}
.wrap { max-width: 1600px; margin: 0 auto; padding: 24px; }
.header, .card, .diagram-shell {
background: rgba(15, 23, 42, 0.88);
border: 1px solid #1f2937;
border-radius: 16px;
box-shadow: 0 10px 30px rgba(0, 0, 0, 0.35);
}
.header { padding: 20px 24px; margin-bottom: 20px; }
h1 { margin: 0 0 8px; font-size: 28px; }
.subtitle { color: var(--muted); line-height: 1.6; }
.diagram-shell { padding: 16px; overflow-x: auto; }
svg { width: 100%; min-width: 1450px; height: auto; display: block; }
.grid {
display: grid;
grid-template-columns: repeat(3, 1fr);
gap: 16px;
margin-top: 20px;
}
.card { padding: 16px 18px; }
.card h3 { margin: 0 0 12px; font-size: 16px; }
.card ul { margin: 0; padding-left: 18px; color: var(--muted); line-height: 1.7; }
.footer { margin-top: 16px; color: var(--muted); font-size: 12px; }
@media (max-width: 1100px) { .grid { grid-template-columns: 1fr; } }
</style>
</head>
<body>
<div class="wrap">
<div class="header">
<h1>PD Future-State Topology</h1>
<div class="subtitle">
Target-state operator map for the post-upgrade homelab: PD becomes the primary production platform, NOMAD remains the trusted secondary lane, Rocinante is optional AI specialization, and Serenity is drained then retired after storage adoption.
</div>
</div>
<div class="diagram-shell">
<svg viewBox="0 0 1500 940" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="PD future-state topology diagram">
<defs>
<marker id="arrow-cyan" markerWidth="10" markerHeight="10" refX="8" refY="3" orient="auto" markerUnits="strokeWidth">
<path d="M0,0 L0,6 L9,3 z" fill="#22d3ee" />
</marker>
<marker id="arrow-emerald" markerWidth="10" markerHeight="10" refX="8" refY="3" orient="auto" markerUnits="strokeWidth">
<path d="M0,0 L0,6 L9,3 z" fill="#34d399" />
</marker>
<marker id="arrow-rose" markerWidth="10" markerHeight="10" refX="8" refY="3" orient="auto" markerUnits="strokeWidth">
<path d="M0,0 L0,6 L9,3 z" fill="#fb7185" />
</marker>
<marker id="arrow-amber" markerWidth="10" markerHeight="10" refX="8" refY="3" orient="auto" markerUnits="strokeWidth">
<path d="M0,0 L0,6 L9,3 z" fill="#fbbf24" />
</marker>
</defs>
<rect x="20" y="20" width="1460" height="900" rx="18" fill="none" stroke="#334155" stroke-width="1.5" />
<path d="M745 115 L745 170" stroke="#22d3ee" stroke-width="3" fill="none" marker-end="url(#arrow-cyan)"/>
<path d="M540 405 L400 405" stroke="#34d399" stroke-width="3" fill="none" marker-end="url(#arrow-emerald)"/>
<path d="M960 405 L1110 405" stroke="#a78bfa" stroke-width="3" fill="none" marker-end="url(#arrow-cyan)"/>
<path d="M745 640 L745 760" stroke="#fbbf24" stroke-width="3" fill="none" marker-end="url(#arrow-amber)"/>
<path d="M1240 535 C1320 560, 1360 620, 1360 710" stroke="#fb7185" stroke-width="3" fill="none" stroke-dasharray="8 6" marker-end="url(#arrow-rose)"/>
<path d="M250 520 C180 570, 160 640, 180 725" stroke="#34d399" stroke-width="3" fill="none" marker-end="url(#arrow-emerald)"/>
<path d="M1180 220 C1290 240, 1360 300, 1380 390" stroke="#fbbf24" stroke-width="2.5" fill="none" stroke-dasharray="7 5" marker-end="url(#arrow-amber)"/>
<rect x="600" y="50" width="290" height="65" rx="10" fill="#0f172a" />
<rect x="600" y="50" width="290" height="65" rx="10" fill="rgba(30,41,59,0.55)" stroke="#94a3b8" stroke-width="1.5" />
<text x="745" y="77" fill="#e2e8f0" text-anchor="middle" font-size="15" font-weight="700">Internet / Remote Edge</text>
<text x="745" y="97" fill="#94a3b8" text-anchor="middle" font-size="11">Pangolin VPS, public DNS, external access</text>
<rect x="510" y="170" width="470" height="470" rx="18" fill="none" stroke="#fbbf24" stroke-width="1.5" stroke-dasharray="10 6" />
<text x="530" y="195" fill="#fbbf24" font-size="12">Production / Servers lane</text>
<rect x="60" y="300" width="340" height="270" rx="14" fill="#0f172a" />
<rect x="60" y="300" width="340" height="270" rx="14" fill="rgba(6,78,59,0.35)" stroke="#34d399" stroke-width="1.6" />
<text x="85" y="330" fill="#e2e8f0" font-size="18" font-weight="700">N.O.M.A.D.</text>
<text x="85" y="352" fill="#34d399" font-size="12">Trusted secondary / resilience lane</text>
<text x="85" y="385" fill="#cbd5e1" font-size="12">• Project NOMAD offline stack</text>
<text x="85" y="408" fill="#cbd5e1" font-size="12">• Pelican / Wings / game servers</text>
<text x="85" y="431" fill="#cbd5e1" font-size="12">• Backup Technitium resolver</text>
<text x="85" y="454" fill="#cbd5e1" font-size="12">• Small bounded utility workloads</text>
<text x="85" y="500" fill="#94a3b8" font-size="11">Second failure domain. Do not turn into a second PD.</text>
<rect x="540" y="220" width="420" height="360" rx="16" fill="#0f172a" />
<rect x="540" y="220" width="420" height="360" rx="16" fill="rgba(6,78,59,0.42)" stroke="#34d399" stroke-width="1.8" />
<text x="570" y="253" fill="#e2e8f0" font-size="24" font-weight="700">PD (upgraded HL15 Beast)</text>
<text x="570" y="277" fill="#34d399" font-size="13">Primary production core on bare-metal TrueNAS Scale</text>
<rect x="570" y="305" width="180" height="110" rx="10" fill="rgba(76,29,149,0.36)" stroke="#a78bfa" stroke-width="1.4" />
<text x="590" y="330" fill="#e2e8f0" font-size="14" font-weight="700">Storage</text>
<text x="590" y="354" fill="#cbd5e1" font-size="11">• imported Serenity capacity</text>
<text x="590" y="374" fill="#cbd5e1" font-size="11">• new 20TB+ HDD pool</text>
<text x="590" y="394" fill="#cbd5e1" font-size="11">• SSD/NVMe app + VM tier</text>
<rect x="770" y="305" width="160" height="110" rx="10" fill="rgba(8,51,68,0.36)" stroke="#22d3ee" stroke-width="1.4" />
<text x="790" y="330" fill="#e2e8f0" font-size="14" font-weight="700">Apps + DBs</text>
<text x="790" y="354" fill="#cbd5e1" font-size="11">• Docker / compose</text>
<text x="790" y="374" fill="#cbd5e1" font-size="11">• shared Postgres/MariaDB/Redis</text>
<text x="790" y="394" fill="#cbd5e1" font-size="11">• identity / monitoring / media</text>
<rect x="570" y="440" width="180" height="110" rx="10" fill="rgba(120,53,15,0.32)" stroke="#fbbf24" stroke-width="1.4" />
<text x="590" y="465" fill="#e2e8f0" font-size="14" font-weight="700">Media + ARR</text>
<text x="590" y="489" fill="#cbd5e1" font-size="11">• qbit/ARR move here after cutover</text>
<text x="590" y="509" fill="#cbd5e1" font-size="11">• path locality follows the disks</text>
<text x="590" y="529" fill="#cbd5e1" font-size="11">• removes Serenity dependency</text>
<rect x="770" y="440" width="160" height="110" rx="10" fill="rgba(136,19,55,0.30)" stroke="#fb7185" stroke-width="1.4" />
<text x="790" y="465" fill="#e2e8f0" font-size="14" font-weight="700">Cyber VM lane</text>
<text x="790" y="489" fill="#cbd5e1" font-size="11">• AD / Windows / Linux labs</text>
<text x="790" y="509" fill="#cbd5e1" font-size="11">• segmented VLAN</text>
<text x="790" y="529" fill="#cbd5e1" font-size="11">• default-deny to production</text>
<rect x="1110" y="300" width="310" height="250" rx="14" fill="#0f172a" />
<rect x="1110" y="300" width="310" height="250" rx="14" fill="rgba(76,29,149,0.36)" stroke="#a78bfa" stroke-width="1.6" />
<text x="1135" y="330" fill="#e2e8f0" font-size="18" font-weight="700">Rocinante</text>
<text x="1135" y="352" fill="#a78bfa" font-size="12">Optional AI specialist</text>
<text x="1135" y="385" fill="#cbd5e1" font-size="12">• Keep if PD does not get the 4090</text>
<text x="1135" y="408" fill="#cbd5e1" font-size="12">• Otherwise overflow / experimental AI</text>
<text x="1135" y="431" fill="#cbd5e1" font-size="12">• Must justify its ongoing power + sprawl</text>
<text x="1135" y="477" fill="#94a3b8" font-size="11">Heavy inference can stay separate if desired, but production does not depend on that.</text>
<rect x="545" y="690" width="400" height="180" rx="16" fill="#0f172a" />
<rect x="545" y="690" width="400" height="180" rx="16" fill="rgba(120,53,15,0.30)" stroke="#fbbf24" stroke-width="1.6" stroke-dasharray="10 6" />
<text x="570" y="720" fill="#e2e8f0" font-size="18" font-weight="700">Serenity</text>
<text x="570" y="742" fill="#fbbf24" font-size="12">Transition-only platform</text>
<text x="570" y="775" fill="#cbd5e1" font-size="12">Now: storage owner, torrent locality, reranker, backup DNS node</text>
<text x="570" y="798" fill="#cbd5e1" font-size="12">Then: drain services, adopt storage into PD, remove dependency</text>
<text x="570" y="821" fill="#fb7185" font-size="12">End-state: retire to reduce power draw and operational sprawl</text>
<rect x="1140" y="650" width="280" height="200" rx="14" fill="#0f172a" />
<rect x="1140" y="650" width="280" height="200" rx="14" fill="rgba(136,19,55,0.28)" stroke="#fb7185" stroke-width="1.6" />
<text x="1165" y="680" fill="#e2e8f0" font-size="18" font-weight="700">Lab VLAN policy</text>
<text x="1165" y="712" fill="#cbd5e1" font-size="12">• Lab -> production: deny by default</text>
<text x="1165" y="735" fill="#cbd5e1" font-size="12">• Trusted admin -> lab: explicit allow</text>
<text x="1165" y="758" fill="#cbd5e1" font-size="12">• Lab -> DNS/NTP/internet: allow</text>
<text x="1165" y="781" fill="#cbd5e1" font-size="12">• Resource-cap VMs to protect production</text>
<text x="1165" y="804" fill="#cbd5e1" font-size="12">• Malware / truly sketchy work should still move elsewhere</text>
<rect x="80" y="660" width="300" height="170" rx="14" fill="#0f172a" />
<rect x="80" y="660" width="300" height="170" rx="14" fill="rgba(30,41,59,0.52)" stroke="#94a3b8" stroke-width="1.4" />
<text x="105" y="690" fill="#e2e8f0" font-size="18" font-weight="700">Operating principles</text>
<text x="105" y="722" fill="#cbd5e1" font-size="12">1. PD is the production center of gravity</text>
<text x="105" y="745" fill="#cbd5e1" font-size="12">2. NOMAD stays the trusted secondary lane</text>
<text x="105" y="768" fill="#cbd5e1" font-size="12">3. Cyber labs can share hardware, not trust</text>
<text x="105" y="791" fill="#cbd5e1" font-size="12">4. Design around Serenity retirement</text>
</svg>
</div>
<div class="grid">
<div class="card">
<h3>What belongs on PD</h3>
<ul>
<li>Primary ZFS storage, production Docker, databases, media, identity, monitoring, and DNS source-of-truth</li>
<li>qBittorrent + ARR stack after the storage move, because path locality should follow the disks</li>
<li>AI primary too if the 4090 lands there</li>
</ul>
</div>
<div class="card">
<h3>What remains off PD</h3>
<ul>
<li>NOMAD keeps offline knowledge, game hosting, and backup DNS</li>
<li>Rocinante stays only if heavy inference separation is still useful</li>
<li>High-risk or sketchy cyber work should eventually move to a dedicated lab node</li>
</ul>
</div>
<div class="card">
<h3>What this means for Serenity</h3>
<ul>
<li>Remove obvious service sprawl early</li>
<li>Preserve storage/torrent locality only until PD owns the storage directly</li>
<li>Retire Serenity once its storage and remaining roles are drained</li>
</ul>
</div>
</div>
<div class="footer">Generated as a repo-owned planning artifact for the PD rebuild, segmentation plan, and Serenity retirement path.</div>
</div>
</body>
</html>

297
docs/planning/PD_FUTURE_STATE_ARCHITECTURE.md Normal file
View File

@@ -0,0 +1,297 @@
# PD Future-State Architecture Plan
Status: proposed target state for the next major PD rebuild and Serenity retirement.
## Goal
Turn PD into the long-term primary homelab platform while keeping enough separation for resilience and cybersecurity lab work.
This plan assumes:
- PD is rebuilt on the HL15 Beast ASRock platform
- Serenity is temporary and will be retired after its storage is adopted into PD
- John will add a second HDD ZFS pool using 5-6 new 20TB+ drives
- A few SSDs may be added for appdata, databases, scratch, and cache tiers
- Cybersecurity VMs may live on PD, but only inside a tightly segmented lab lane
## Recommended platform model
### Keep PD on bare-metal TrueNAS Scale
Recommended role:
- primary NAS
- primary production Docker/app host
- primary shared database host
- primary media host
- primary identity/control-plane host
- primary DNS source node
- primary AI host if the 4090 lands here
- limited, disciplined VM host for cybersecurity lab work
Do not treat PD as an unrestricted cyber range.
Production remains the first-class role.
## Hardware direction
### Minimum build worth doing
- HL15 Beast ASRock build
- EPYC 7282
- 64GB RAM
- RM1000x if no 4090 is going in immediately
### Preferred long-term build
- HL15 Beast ASRock build
- EPYC 7452
- 128GB RAM preferred if PD will carry production plus multiple security VMs
- HX1500i if PD is likely to receive the 4090
### Why the base model is not recommended
The 7252 + 16GB base build is too small for the intended role once PD becomes:
- primary ZFS host
- primary app host
- primary DB host
- future ARR/qbit host after pool migration
- possible AI host
- bounded cybersecurity VM host
## Storage model
### HDD pools
PD should end up with at least two major HDD-backed data classes:
1. Imported Serenity capacity
- absorb the current Serenity storage role
- preserve large media/archive capacity
2. New HDD ZFS pool
- 5-6 x 20TB+ drives
- use for future bulk media, archives, backup targets, and growth
Exact vdev shape should be chosen when the final drive count is locked, but the high-level operating model should be:
- one bulk pool for high-capacity household data
- one or more fast SSD-backed tiers for apps, DBs, and VM-heavy workloads
### SSD / NVMe role split
Use SSD/NVMe for:
- Docker root
- shared PostgreSQL / MariaDB / Redis data
- write-heavy appdata
- VM disks for cyber lab systems
- AI model cache
- transcode/temp/scratch
Use HDD pools for:
- media libraries
- document archives
- backups
- long-term storage
- lower-IO datasets
## Host role layout
### PD = production core
PD should eventually own:
- ZFS/NAS duties
- production Docker stack
- shared databases
- media stack
- household/productivity stack
- Authentik / identity stack
- monitoring/control plane
- primary Technitium node
- ARR/qbit stack after storage cutover
- AI primary if the 4090 lands here
- controlled cyber lab VMs
### N.O.M.A.D. = secondary trusted platform
Keep NOMAD for:
- offline knowledge / Project NOMAD
- game servers
- backup Technitium resolver
- small bounded utility workloads
NOMAD should not become a second general-purpose production host.
### Rocinante = optional AI specialist
If PD gets the 4090:
- Rocinante becomes optional
- can remain an overflow / experimental inference box
- can later be repurposed or retired
If PD does not get the 4090:
- Rocinante stays the heavy inference box
- PD remains the production/NAS core
### Serenity = transition-only
Near-term:
- current storage owner
- current torrent locality host
- current reranker host
- backup Technitium node
End-state:
- storage role moved into PD
- remaining services drained or moved
- host retired
## Service placement target
### Keep on PD long-term
Infrastructure / control plane:
- Gitea
- Homepage
- Uptime Kuma
- Gotify
- RackPeek
- Traefik / Pangolin-side internal ingress
- Authentik
- shared PostgreSQL / MariaDB / Redis
- monitoring stack
Household / productivity:
- Paperless
- Immich
- Karakeep
- n8n
- KitchenOwl
- DoneTick
- Qui
Media / library:
- Plex
- Tautulli
- Audiobookshelf
- Calibre-Web
- Seerr
- RomM
- GameVault
- Wizarr
- Shelfmark
- Notifiarr
AI / search:
- LiteLLM
- OpenWebUI
- Qdrant
- SearXNG
- Ollama light tier
- primary heavy inference too if the 4090 lands on PD
- reranker after Serenity is retired
Torrent/media ingestion after storage cutover:
- qBittorrent
- qbit_manage
- Gluetun
- unpackerr
- Sonarr / Sonarr-anime
- Radarr
- Lidarr
- Readarr / Readarr-epub
- Prowlarr
- Bazarr
- autobrr
### Keep off PD long-term
NOMAD:
- Project NOMAD stack
- Pelican / Wings / game servers
- backup Technitium resolver
Optional elsewhere:
- heavy inference on Rocinante if PD does not get the 4090
- high-risk security experiments on a future dedicated lab node if the school/lab workload outgrows PD-hosted segmented VMs
## Cybersecurity VM model on PD
### This is acceptable on PD
- Windows Server / AD lab VMs
- Windows client VMs
- Linux practice VMs
- Wazuh / SIEM learning stack
- Kali or similar coursework boxes
- isolated vulnerable targets for coursework
- patch/test environments
### This should remain tightly bounded
- scanning labs
- IDS/packet-capture experiments
- exploit practice
- intentionally vulnerable targets
These may run on PD only when:
- placed on a dedicated lab VLAN
- firewalled from production by default
- resource-limited
- treated as disposable
### This should ideally not live on PD
- malware detonation
- unknown or sketchy offensive tooling
- random public PoCs with unclear trust
- anything that could meaningfully threaten production storage or family services
## Network / VLAN recommendation for the lab lane
Create or preserve a dedicated lab/security lane with these rules:
- separate VLAN / subnet from production lanes
- default-deny from lab to production
- allow only explicit admin paths from trusted management devices
- allow outbound internet as needed for updates/labs
- allow tightly scoped DNS/NTP/logging paths
- keep identity trust boundaries explicit rather than automatic
Suggested policy posture:
- Lab -> PD production apps: deny by default
- Lab -> shared DNS: allow
- Lab -> internet: allow with logging
- Trusted admin devices -> lab: explicit allow
- Lab -> management interfaces: explicit deny unless specifically required
## Phased roadmap
### Phase 1: document and reduce Serenity sprawl now
- document current host roles and future-state design
- classify Serenity services into keep / move / retire
- move low-risk non-storage-tied apps off Serenity first
### Phase 2: build upgraded PD
- install TrueNAS Scale on the new PD hardware
- stand up SSD tiers for apps/DBs/VMs
- add the new HDD pool
- validate networking, Docker, GPU, and backup posture
### Phase 3: move production services into the new PD layout
- migrate any remaining general-purpose apps off Serenity
- relocate databases/appdata onto the intended SSD tier
- validate ingress, monitoring, and DNS roles
### Phase 4: move the storage-dependent torrent/media automation stack
- after the storage move design is finalized, move qbit + ARR locality to PD
- keep path locality on the box that owns the disks
- then remove the old Serenity-locality requirement
### Phase 5: move or redesign the remaining special cases
- move reranker onto PD if AI core lands there
- redesign backup DNS so Serenity is no longer required
- preserve at least one off-PD Technitium node on NOMAD
### Phase 6: retire Serenity
- verify pool adoption is complete
- verify services are drained
- confirm backups and DNS redundancy still work
- power down and retire Serenity
## Architecture principles
1. PD becomes the production center of gravity.
2. NOMAD stays a separate trusted failure domain.
3. Rocinante is optional and should justify its existence.
4. Serenity should be designed out of the future state.
5. The cybersecurity lab lane can share PD hardware, but not PD trust boundaries.
6. Production stability beats hypervisor sprawl.
## Immediate implications for current cleanup work
For the current Serenity Docker review, the guiding rule is:
- remove obvious sprawl from Serenity now
- do not over-optimize the final placement around Serenity permanence
- remember that once PD directly owns the storage, the qbit/ARR locality argument flips to PD

5
docs/servers/NOMAD.md
View File

@@ -12,6 +12,11 @@ Offline survival/knowledge server and game server host.
- **Motherboard:** ASRock H97M Pro4 - **Motherboard:** ASRock H97M Pro4
- **UPS:** None - **UPS:** None
## Planned long-term role
- Keep NOMAD intentionally separate from PD's production stack.
- Continue to host Project NOMAD, game services, and the backup Technitium resolver.
- Accept only small bounded helper workloads; do not let it drift into being a second general-purpose production host.
## Storage ## Storage
| Device | Size | Mount | Purpose | | Device | Size | Mount | Purpose |
|--------|------|-------|---------| |--------|------|-------|---------|

11
docs/servers/PLAUSIBLEDENABILITY.md
View File

@@ -2,6 +2,8 @@
Primary Docker host running all production workloads. Primary Docker host running all production workloads.
> Planned direction: this host remains bare-metal TrueNAS Scale and becomes the long-term primary production platform after the HL15 Beast rebuild. See `docs/planning/PD_FUTURE_STATE_ARCHITECTURE.md`.
## Specs ## Specs
- **OS:** TrueNAS Scale 25.10.2.1 - **OS:** TrueNAS Scale 25.10.2.1
- **CPU:** Ryzen 9 3950X - **CPU:** Ryzen 9 3950X
@@ -76,3 +78,12 @@ Current light-tier notes:
## Pending ## Pending
- Add Pangolin resource + DNS for `ai.paccoco.com` - Add Pangolin resource + DNS for `ai.paccoco.com`
- Install fresh editor - Install fresh editor
## Planned future role
- Primary NAS after Serenity retirement
- Primary production Docker/app host
- Primary shared database host
- Primary media / automation / identity / monitoring host
- Primary Technitium source node
- Future home of qBittorrent + ARR after storage ownership moves local to PD
- Acceptable host for tightly segmented cybersecurity VMs, but not an unrestricted lab/free-for-all hypervisor

2
docs/servers/ROCINANTE.md
View File

@@ -2,6 +2,8 @@
Heavy AI inference server. Heavy AI inference server.
> Planned direction: Rocinante becomes optional if the upgraded PD build receives the 4090. If PD does not get the 4090, Rocinante remains the heavy-inference specialist.
## Hardware ## Hardware
| Component | Details | | Component | Details |

8
docs/servers/SERENITY.md
View File

@@ -1,6 +1,6 @@
# Serenity # Serenity
NAS, media ingestion, and CPU-based AI inference. Current NAS, media-ingestion, and CPU-based AI helper host. Planned to retire after the upgraded PD build absorbs its storage role.
## Hardware ## Hardware
@@ -68,3 +68,9 @@ Serenity hosts the secondary backup Technitium node on `10.5.30.10`.
- No GPU; reranker uses CPU-only TEI image - No GPU; reranker uses CPU-only TEI image
- Tailscale active — reachable at `100.94.87.79` from any Tailscale node - Tailscale active — reachable at `100.94.87.79` from any Tailscale node
## Planned future role
- Transitional only; do not design new long-term dependencies around Serenity.
- Near-term it continues to host storage locality, reranker, and the backup Technitium node.
- Once PD directly owns the storage, qBittorrent/ARR locality should move to PD and Serenity should be drained and retired.