# Serenity Docker Audit Status: live-audited baseline for cleanup and migration planning, refreshed after the GameVault/RomM cutover cleanup and the broader keep/move/retire placement review. Last live verification: 2026-05-26 ## Access path used Live audit now succeeds directly from NOMAD using the configured host alias: - `ssh serenity` Older discovery in this document used the PD pivot path before direct local SSH was wired up. ## What is currently running on Serenity ### Keep for now until PD storage ownership changes These are the containers whose current placement still makes operational sense because Serenity owns the active media/torrent locality today. - `qbit` - `GluetunVPN` - `qbit_manage` - `prowlarr` - `sonarr` - `sonarr-anime` - `radarr` - `lidarr` - `readarr` - `readarr-epub` - `bazarr` - `autobrr` - `unpackerr` - `shelfmark` Common pattern observed from live mounts: - these stacks are bound heavily to `/mnt/user/data` - torrent state and backup artifacts live under Serenity-owned paths like `/mnt/user/data/torrents`, `/mnt/user/data/BT_backup`, and appdata under `/mnt/user/appdata/*` - current path locality still argues for keeping them on Serenity until PD directly owns the disks and final media paths - `shelfmark` is not a generic "random app" here; its live mounts also tie it to Serenity-owned `/mnt/user/data`, audiobook ingest paths, and torrent/library paths ### Keep temporarily, but plan to move or collapse later These are live today, but they are not good long-term reasons to keep Serenity alive after PD is rebuilt. - `reranker` - currently on Serenity because CPU-only TEI was moved off PD - planned long-term home: PD if PD remains the AI control-plane/core host - live runtime uses `/mnt/user/appdate/reranker`, not `/mnt/user/appdata/reranker`; treat that as a migration hazard that must be handled deliberately - `technitium-dns-pilot` - current backup Technitium node on Serenity (`10.5.30.10`) - long-term: keep at least one off-PD backup resolver, but that does not have to remain on Serenity forever - `Newt` - live on Serenity now - operator confirmed it is still needed, so it should be preserved during cleanup and only rehomed deliberately later - `Hawser` - operator confirmed Dockhand depends on it for remote management of Serenity's remaining Docker stacks - keep on Serenity with `dockersocket` until that management pattern is intentionally replaced - `dockersocket` - Hawser helper sidecar required by the current Dockhand remote-management path - `netdata` - useful while Serenity remains live, not a reason to keep Serenity permanently - `Notifiarr` - low-risk utility app that can move later if PD has spare headroom - not urgent while PD remains RAM-constrained - `Wizarr` - operator confirmed it is unused and should be retired rather than migrated ### Placement verdict by service group #### Keep on Serenity until the storage-locality cutover is designed - torrent / download lane: - `qbit` - `GluetunVPN` - `qbit_manage` - `autobrr` - `unpackerr` - media automation lane: - `prowlarr` - `sonarr` - `sonarr-anime` - `radarr` - `lidarr` - `readarr` - `readarr-epub` - `bazarr` - locality-adjacent helpers: - `Notifiarr` - `shelfmark` Reason: - all of these either mount Serenity-owned `/mnt/user/data` directly or depend on the downloader/media-path locality that still lives on Serenity today - moving them before PD owns the storage locally would just trade one cleanup project for a fragile NFS-path rewrite project #### Optional early cleanup / peel-off work - retire `Wizarr` - move `Notifiarr` only if PD headroom clearly allows it - review whether `netdata` still adds enough local-monitoring value to keep Reason: - these are the few remaining low-risk app-level changes that do not depend on the qbit/ARR storage cutover - PD is constrained right now, so only very small wins should happen before the larger storage redesign #### Keep as explicit temporary exceptions, then redesign last - `reranker` - `technitium-dns-pilot` - `Newt` Reason: - these are the remaining special cases that still justify Serenity for non-media reasons - each one has a real redesign question attached: - reranker: whether PD should re-absorb AI helper services later - Technitium backup node: which off-PD host should own the durable backup resolver role - Newt: when Serenity-hosted Pangolin resources are deliberately rehomed so the local tunnel is no longer required ### Retire candidates These should be treated as cleanup targets unless a specific live dependency is rediscovered. - `Unraid-Cloudflared-Tunnel` - live audit on 2026-05-25 showed a remote-managed Cloudflare Tunnel with stale legacy `192.168.1.x` origins and zero observed proxied requests on the current run - stopped and removed on 2026-05-25 after post-stop checks showed sampled public hostnames remained healthy without it - `binhex-official-pihole` - `pihole-serenity` - `unbound-pihole-serenity` - `keepalived-pihole-serenity` - these were legacy DNS/HA remnants once Technitium became the intended resolver strategy - mixed-host DNS verification passed during retirement on 2026-05-25, and the Serenity Pi-hole HA stack was then stopped and removed without immediate DNS regression - the old local DB pair (`postgresql15` and `MariaDB-Official`) was retired on 2026-05-25 after PD validation and rollback bundle creation - the stale stopped source app containers (`romm` and `GameVault`) were removed on 2026-05-26 - retained rollback paths still exist on Serenity: - `/mnt/user/backups/doris/serenity-d7-db-retire-20260525-213531` - `/mnt/user/appdata/romm` - `/mnt/user/appdata/gamevault` - `/mnt/user/appdata/mariadb-official` - `/mnt/cache/appdata/postgresql15` ## Not-running / stale containers seen in `docker ps -a` These did not appear live and should be reviewed for deletion after confirming their data is not needed. Created only (retired on 2026-05-25 after metadata verification): - `calibre-web` - `SuggestArr` - `Cleanuparr` - `calibre` - `agregarr` Exited: - none remaining from the previously audited stale set; `Huntarr`, `omegabrr`, `romm`, and `GameVault` have now been removed Current result: - no stale created/exited containers remain in `docker ps -a` ## Live project roots observed Compose Manager project roots found on Serenity: - `/boot/config/plugins/compose.manager/projects/pihole-ha` - `/boot/config/plugins/compose.manager/projects/re-ranker` Direct compose file under appdata: - `/mnt/user/appdata/technitium-serenity/docker-compose.yaml` Operational implication: - much of Serenity appears to be managed through Unraid Docker templates or ad-hoc container definitions, not a clean compose-per-stack layout - cleanup work should expect drift between repo planning docs, backup stack snapshots, and the actual Unraid runtime inventory ## Important live mount observations Examples from the live container inspection: - `qbit` binds `/mnt/user/data -> /data` - `qbit_manage` binds `/mnt/user/data`, `/mnt/user/data/BT_backup`, and `/mnt/user/appdata/qbit_manage` - `shelfmark` binds `/mnt/user/data`, `/mnt/user/data/media/books/Audiobooks`, `/mnt/user/data/media/books/ingest`, and `/mnt/user/data/torrents` - most ARR-family services bind `/mnt/user/data` - `reranker` binds `/mnt/user/appdate/reranker -> /data` - `Wizarr` only binds its own appdata/database paths and has no meaningful storage-locality reason to stay on Serenity - `Hawser` + `dockersocket` are local helper tooling, not media-path owners Notable typo/risk: - `reranker` is mounted from `/mnt/user/appdate/reranker` (note `appdate`, not `appdata`) - `/mnt/user/appdate/reranker` exists live; `/mnt/user/appdata/reranker` does not currently exist - treat that as an intentional-on-disk reality for now, but fix the naming deliberately during a future migration rather than by surprise during unrelated cleanup ## Recommended next work order ### Phase 1: completed cleanup baseline - dead Cloudflared / Pi-hole / stale-container cleanup is done - the old local DB pair and source GameVault/RomM containers are already retired - current live work should start from the narrower remaining set, not re-open that cleanup unless new evidence appears ### Phase 2: peel off the low-risk non-locality apps - retire `Wizarr` - optionally move `Notifiarr` if PD headroom clearly permits it - decide whether `netdata` still provides unique value once the broader monitoring stack is considered ### Phase 3: preserve the only things that currently justify Serenity Until PD owns the storage locally, keep the torrent/media-ingest locality group together: - qBittorrent/VPN path - ARR family - qbit_manage - autobrr - unpackerr - related helpers like Notifiarr and Shelfmark ### Phase 4: cut over after PD storage migration Once PD directly owns the relevant media/torrent datasets: - move qbit + ARR locality to PD - keep path locality on the box that owns the disks - move or retire the locality-adjacent helpers that were intentionally left with that lane ### Phase 5: redesign the special cases last - move reranker to PD if desired, while normalizing the `appdate`/`appdata` path naming intentionally - keep at least one off-PD Technitium node somewhere, preferably NOMAD if Serenity is retiring - re-home or retire Serenity-local `Newt` only after Pangolin dependencies are deliberately redesigned ## Kanban-ready workstreams ### Epic A — Serenity live inventory normalization - capture `docker ps`, mounts, ports, and remaining host-role assumptions - keep the repo docs aligned with the actual Unraid runtime inventory - treat ad-hoc Unraid container definitions as a drift risk until they are intentionally replaced ### Epic B — low-risk miscellaneous app peel-off - retire `Wizarr` - decide whether `Notifiarr` is worth an early move given PD RAM pressure - decide whether `netdata` still earns its keep alongside the broader monitoring stack ### Epic C — torrent/media-locality preservation until PD cutover - keep qbit/ARR stack stable on Serenity for now - document exact media/torrent paths that must exist on PD before migration - prevent premature moves that would recreate NFS-path weirdness ### Epic D — special-case redesign - normalize the reranker path oddity during a planned move rather than an incidental cleanup - decide where the off-PD backup Technitium role should live after Serenity - re-home Pangolin/Newt dependencies last, not during the media cutover ### Epic E — final Serenity retirement - move remaining wanted apps to PD or NOMAD - preserve only the intended backup-DNS failure-domain role off PD - decommission Serenity once no production path depends on it ## Resolved operator decisions Resolved on 2026-05-25: 1. No app should deliberately remain on Serenity once PD owns the disks locally. 2. Technitium covers the desired DNS role; the legacy Serenity Pi-hole stack should be treated as removable. 3. `Newt` on Serenity is still needed and should not be treated as cleanup. 4. `GameVault` and `RomM` should migrate rather than be pruned. 5. End-state remains: - move qbit + ARR family to PD after storage cutover - leave no intentional production app role on Serenity - retire Serenity entirely 6. `Wizarr` is explicit retire-now dead weight; `Notifiarr` is the main optional tiny move candidate; `Hawser`/`dockersocket` remain intentional keepers because Dockhand depends on them. ## Remaining verification questions - No additional live dependency beyond the retired `GameVault`/`RomM` pair was surfaced during the quick DB audit; if that changes later, treat it as a rediscovery against rollback artifacts rather than a live-stack blocker. - Decide when the retained DB/appdata rollback artifacts are old enough to archive more aggressively or finally delete. - Normalize the `reranker` path naming during the eventual move: preserve the live `/mnt/user/appdate/reranker` data now, but decide whether the destination should standardize back to `appdata`. - Serenity's Pangolin/Newt health-check drift is fixed now; any future Newt rehome is an architecture task, not a stale-health-check incident response. ## Pangolin / Newt live remediation status Live verification on 2026-05-25 showed Serenity Newt still probing stale pre-renumbering health-check URLs like `http://10.5.1.5:8787/` even though the Pangolin target objects already showed `ip=localhost` or `10.5.30.5` for those resources. Affected target IDs observed live: - `15` (`autobrr`) - `20` (`notifiarr`) - `25` (`readarr`) - `29` (`wizarr`) - `56` (`readarr-epub`) - `57` (`sonarr-anime`) - `58` (`romm`) - `69` (`gamevault`) Diagnostic probe performed live on Serenity: - temporarily added `10.5.1.5/32` to `br0` - this immediately restored health for several targets, proving the stale `hcHostname` diagnosis However, the old `10.5.1.5` address is no longer allowed on that VLAN, so the alias was removed again. Verification after removal: - `ip addr del 10.5.1.5/32 dev br0` - Newt immediately resumed failures such as: - target `56` -> `http://10.5.1.5:8788/` - target `57` -> `http://10.5.1.5:8990/` - target `15` -> `http://10.5.1.5:7474/` - target `25` -> `http://10.5.1.5:8787/` Interpretation: - the alias was useful as a proof-of-cause test only - it is not an acceptable steady-state fix here - the real remaining task is to authoritatively rewrite the stale Pangolin `hcHostname` values away from `10.5.1.5` ## Pangolin / Newt authoritative fix completed Follow-up live mutation on 2026-05-25 rewrote the remaining Serenity site targets that were still drifting on stale `10.5.1.5` health checks: - target `25` (`readarr`) -> `ip=10.5.30.5`, `hcHostname=10.5.30.5`, `hcHealth=healthy` - target `56` (`readarr-epub`) -> `ip=10.5.30.5`, `hcHostname=10.5.30.5`, `hcHealth=healthy` - target `57` (`sonarr-anime`) -> `ip=10.5.30.5`, `hcHostname=10.5.30.5`, `hcHealth=healthy` Post-fix verification: - `docker exec Newt wget http://10.5.30.5:8787/`, `:8788/`, and `:8990/` all succeeded from inside Serenity's `Newt` container - public probes for `readarr.paccoco.com`, `readarr-epub.paccoco.com`, and `sonarr-anime.paccoco.com` all returned the expected Pangolin-auth redirect flow - live Pangolin API inventory for site `serenity` no longer contains any target with `ip=10.5.1.5` or `hcHostname=10.5.1.5` Current steady state for the audited Serenity-hosted Pangolin targets (`15`, `20`, `25`, `29`, `56`, `57`, `58`, `69`): - all now show `ip=10.5.30.5` - all now show `hcHostname=10.5.30.5` - all now report `hcHealth=healthy` Rollback / evidence artifacts: - pre-change backup for targets `56` and `57`: `/home/fizzlepoof/pangolin-target-backup-serenity-hc-authoritative-20260525T204548Z.json` - post-fix snapshot for audited targets: `/home/fizzlepoof/pangolin-target-snapshot-serenity-post-hc-fix-20260525T204741Z.json` ## Database dependency findings Live inspection before the GameVault/RomM retirement pointed to: - `GameVault` -> local `postgresql15` - `DB_HOST=10.5.30.5` - `DB_PORT=5432` - `RomM` -> local `MariaDB-Official` - `DB_HOST=10.5.30.5` - `DB_PORT=3306` No immediate database dependency was surfaced from the quick live environment check for: - `Wizarr` - `Shelfmark` - `Notifiarr` Operational implication: - `postgresql15` should currently be treated as a `GameVault` dependency until proven otherwise. - `MariaDB-Official` should currently be treated as a `RomM` dependency until proven otherwise. - those databases can likely retire once their dependent apps are migrated to PD and verified there. - the legacy Pi-hole containers can be scheduled for removal at the next cleanup window.