PD Future-State Topology

Target-state operator map for the post-upgrade homelab: PD becomes the primary production platform, NOMAD remains the trusted secondary lane, Rocinante is optional AI specialization, and Serenity is drained then retired after storage adoption.
Internet / Remote Edge Pangolin VPS, public DNS, external access Production / Servers lane N.O.M.A.D. Trusted secondary / resilience lane • Project NOMAD offline stack • Pelican / Wings / game servers • Backup Technitium resolver • Small bounded utility workloads Second failure domain. Do not turn into a second PD. PD (upgraded HL15 Beast) Primary production core on bare-metal TrueNAS Scale Storage • imported Serenity capacity • new 20TB+ HDD pool • SSD/NVMe app + VM tier Apps + DBs • Docker / compose • shared Postgres/MariaDB/Redis • identity / monitoring / media Media + ARR • qbit/ARR move here after cutover • path locality follows the disks • removes Serenity dependency Cyber VM lane • AD / Windows / Linux labs • segmented VLAN • default-deny to production Rocinante Optional AI specialist • Keep if PD does not get the 4090 • Otherwise overflow / experimental AI • Must justify its ongoing power + sprawl Heavy inference can stay separate if desired, but production does not depend on that. Serenity Transition-only platform Now: storage owner, torrent locality, reranker, backup DNS node Then: drain services, adopt storage into PD, remove dependency End-state: retire to reduce power draw and operational sprawl Lab VLAN policy • Lab -> production: deny by default • Trusted admin -> lab: explicit allow • Lab -> DNS/NTP/internet: allow • Resource-cap VMs to protect production • Malware / truly sketchy work should still move elsewhere Operating principles 1. PD is the production center of gravity 2. NOMAD stays the trusted secondary lane 3. Cyber labs can share hardware, not trust 4. Design around Serenity retirement

What belongs on PD

  • Primary ZFS storage, production Docker, databases, media, identity, monitoring, and DNS source-of-truth
  • qBittorrent + ARR stack after the storage move, because path locality should follow the disks
  • AI primary too if the 4090 lands there

What remains off PD

  • NOMAD keeps offline knowledge, game hosting, and backup DNS
  • Rocinante stays only if heavy inference separation is still useful
  • High-risk or sketchy cyber work should eventually move to a dedicated lab node

What this means for Serenity

  • Remove obvious service sprawl early
  • Preserve storage/torrent locality only until PD owns the storage directly
  • Retire Serenity once its storage and remaining roles are drained
Generated as a repo-owned planning artifact for the PD rebuild, segmentation plan, and Serenity retirement path.