version: 3
resources:
  - kind: Server
    name: plausibledeniability
    cpus:
      - model: AMD Ryzen 9 3950X
        cores: 16
        threads: 32
    ram:
      size: 32
    drives:
      - type: ssd
        size: 500
      - type: hdd
        size: 4000
      - type: hdd
        size: 4000
    gpus:
      - model: NVIDIA RTX 2080 Ti
        vram: 11
    ports:
      - type: rj45
        speed: 1
        count: 1
    tags:
      - prod
      - docker-host
      - ai-light-tier
    labels:
      lan-ip: 10.5.30.6
      os: TrueNAS Scale 25.10.2.1
      docker-root: /mnt/docker-ssd/docker/docker-data
      compose-root: /mnt/docker-ssd/docker/compose
    notes: |-
      Primary Docker host.
      Storage tiers:
      - /mnt/docker-ssd = Docker root, databases, write-heavy appdata, model caches
      - /mnt/tank = general appdata, configs, backups, downloads
      - /mnt/unraid = Serenity NFS mounts for data and Immich

  - kind: Server
    name: serenity
    cpus:
      - model: Intel Xeon X5690
        cores: 6
        threads: 12
      - model: Intel Xeon X5690
        cores: 6
        threads: 12
    ram:
      size: 102
    ports:
      - type: rj45
        speed: 1
        count: 1
    tags:
      - prod
      - storage
      - reranker
    labels:
      lan-ip: 10.5.30.5
      tailscale-ip: 100.94.87.79
      os: Unraid 7.2.4
    notes: |-
      NAS, media ingestion, and CPU-based AI inference.
      NFS exports to PD:
      - /mnt/user/data -> /mnt/unraid/data
      - /mnt/user/immich -> /mnt/unraid/immich

  - kind: Server
    name: nomad
    cpus:
      - model: Intel Core i7-4770K
        cores: 4
        threads: 8
    ram:
      size: 32
    drives:
      - type: ssd
        size: 233
      - type: hdd
        size: 3600
      - type: hdd
        size: 3600
      - type: ssd
        size: 224
    gpus:
      - model: NVIDIA GeForce GTX 1080
        vram: 8
    ports:
      - type: rj45
        speed: 1
        count: 1
      - type: rj45
        speed: 10
        count: 1
    tags:
      - prod
      - offline-knowledge
      - game-server
    labels:
      lan-ip: 10.5.30.7
      os: Ubuntu 25.10
    notes: |-
      Offline knowledge, game server, and local services host.
      Docker data-root: /mnt/hdd-2/docker
      Project N.O.M.A.D. runtime: /opt/project-nomad

  - kind: Server
    name: rocinante
    gpus:
      - model: NVIDIA RTX 4090
        vram: 24
    ports:
      - type: rj45
        speed: 1
        count: 1
    tags:
      - prod
      - ai-heavy-tier
      - degraded
    labels:
      lan-ip: 10.5.30.112
    notes: |-
      Heavy AI inference server.
      Current operational note from 2026-05-21:
      - Unreachable from N.O.M.A.D. on ports 11434 and 8787 during Doris validation.

  - kind: Server
    name: unifi-udm-pro
    ports:
      - type: rj45
        speed: 10
        count: 8
      - type: sfp+
        speed: 10
        count: 2
    tags:
      - prod
      - network
      - unifi
      - gateway
    labels:
      ip: 10.5.0.1
      management-ip: 10.5.0.1
      wan-ip: 69.166.182.157
      os: UniFi OS 5.1.11.33023
      mac: d0:21:f9:75:8a:ff
      serial: D021F9758AFF
    notes: |-
      UniFi gateway and controller.
      UniFi device name: UDM Pro - Old.
      WAN uplink currently active on eth9.
      UniFi policy zones as of 2026-05-23:
      - Internal = Management + Trusted + Servers
      - Untrusted = IoT + Camera + Old IoT
      - Hotspot = Guest
      Custom hardening on top of UniFi defaults:
      - Allow Internal to Untrusted
      - Block Untrusted to Gateway Admin Surfaces

  - kind: Server
    name: unifi-usw-24-poe
    ports:
      - type: rj45
        speed: 1
        count: 24
    tags:
      - prod
      - network
      - unifi
      - switch
      - poe
    labels:
      ip: 10.5.0.10
      management-ip: 10.5.0.10
      os: UniFi Switch 7.4.1.16850
      mac: ac:8b:a9:ad:ab:86
      serial: AC8BA9ADAB86
    notes: |-
      UniFi device name: USW-24-PoE.
      Active in UniFi; management uplink reported on eth0.

  - kind: Server
    name: unifi-usw-pro-hd-24
    ports:
      - type: rj45
        speed: 1
        count: 24
    tags:
      - prod
      - network
      - unifi
      - switch
    labels:
      ip: 10.5.0.135
      management-ip: 10.5.0.135
      os: UniFi Switch 7.4.1.16850
      mac: 8c:30:66:d0:9f:48
      serial: 8C3066D09F48
    notes: |-
      UniFi device name: USW Pro HD 24.
      Active in UniFi; management uplink reported on eth0.

  - kind: Server
    name: unifi-u7-pro
    ports:
      - type: rj45
        speed: 1
        count: 1
    tags:
      - prod
      - network
      - unifi
      - ap
    labels:
      ip: 10.5.0.21
      management-ip: 10.5.0.21
      os: UniFi AP 8.5.21.18681
      mac: 8c:ed:e1:8a:58:54
      serial: 8CEDE18A5854
    notes: |-
      UniFi device name: U7 Pro.
      Active in UniFi; management uplink reported on eth0.

  - kind: Server
    name: unifi-u6-lr
    ports:
      - type: rj45
        speed: 1
        count: 1
    tags:
      - prod
      - network
      - unifi
      - ap
      - disconnected
    labels:
      ip: 10.5.0.20
      management-ip: 10.5.0.20
      os: UniFi AP 6.7.41.15623
      mac: d0:21:f9:69:a5:f1
      serial: D021F969A5F1
    notes: |-
      UniFi device name: U6 LR.
      Currently disconnected in UniFi as of 2026-05-21.

  - kind: System
    type: Baremetal
    name: pd-truenas
    os: truenas-scale-25.10.2.1
    cores: 16
    ram: 32
    ip: 10.5.30.6
    runsOn:
      - plausibledeniability

  - kind: System
    type: Baremetal
    name: serenity-unraid
    os: unraid-7.2.4
    cores: 12
    ram: 102
    ip: 10.5.30.5
    runsOn:
      - serenity

  - kind: System
    type: Baremetal
    name: nomad-ubuntu
    os: ubuntu-25.10
    cores: 4
    ram: 32
    ip: 10.5.30.7
    runsOn:
      - nomad

  - kind: System
    type: Baremetal
    name: rocinante-inference
    os: baremetal
    ip: 10.5.30.112
    runsOn:
      - rocinante

  - kind: System
    type: Embedded
    name: unifi-gateway
    os: unifi-os-5.1.11.33023
    ip: 10.5.0.1
    runsOn:
      - unifi-udm-pro

  - kind: System
    type: Embedded
    name: unifi-usw-24-poe-firmware
    os: unifi-switch-7.4.1.16850
    ip: 10.5.0.10
    runsOn:
      - unifi-usw-24-poe

  - kind: System
    type: Embedded
    name: unifi-usw-pro-hd-24-firmware
    os: unifi-switch-7.4.1.16850
    ip: 10.5.0.135
    runsOn:
      - unifi-usw-pro-hd-24

  - kind: System
    type: Embedded
    name: unifi-u7-pro-firmware
    os: unifi-ap-8.5.21.18681
    ip: 10.5.0.21
    runsOn:
      - unifi-u7-pro

  - kind: System
    type: Embedded
    name: unifi-u6-lr-firmware
    os: unifi-ap-6.7.41.15623
    ip: 10.5.0.20
    runsOn:
      - unifi-u6-lr

  - kind: Service
    name: homepage
    network:
      ip: 10.5.30.6
      port: 3300
      protocol: TCP
      url: http://10.5.30.6:3300
    runsOn:
      - pd-truenas

  - kind: Service
    name: dockhand
    network:
      ip: 10.5.30.6
      port: 3230
      protocol: TCP
      url: http://10.5.30.6:3230
    runsOn:
      - pd-truenas

  - kind: Service
    name: uptime-kuma
    network:
      ip: 10.5.30.6
      port: 3001
      protocol: TCP
      url: http://10.5.30.6:3001
    runsOn:
      - pd-truenas

  - kind: Service
    name: gotify
    network:
      ip: 10.5.30.6
      port: 8443
      protocol: TCP
      url: https://gotify.paccoco.com
    runsOn:
      - pd-truenas

  - kind: Service
    name: gitea
    network:
      ip: 10.5.30.6
      port: 3002
      protocol: TCP
      url: http://10.5.30.6:3002
    runsOn:
      - pd-truenas

  - kind: Service
    name: gitea-ssh
    network:
      ip: 10.5.30.6
      port: 2222
      protocol: TCP
      url: ssh://git@10.5.30.6:2222/
    runsOn:
      - pd-truenas

  - kind: Service
    name: shlink
    network:
      ip: 10.5.30.6
      port: 8087
      protocol: TCP
      url: http://10.5.30.6:8087
    runsOn:
      - pd-truenas

  - kind: Service
    name: shlink-web-client
    network:
      ip: 10.5.30.6
      port: 8088
      protocol: TCP
      url: http://10.5.30.6:8088
    runsOn:
      - pd-truenas

  - kind: Service
    name: rackpeek
    network:
      ip: 10.5.30.6
      port: 8283
      protocol: TCP
      url: http://10.5.30.6:8283
    tags:
      - source-of-truth-target
    runsOn:
      - pd-truenas

  - kind: Service
    name: unifi-network-controller
    network:
      ip: 10.5.0.1
      port: 443
      protocol: TCP
      url: https://10.5.0.1
    tags:
      - internal
      - network
      - unifi
    runsOn:
      - unifi-gateway

  - kind: Service
    name: authelia
    network:
      ip: 10.5.30.6
      port: 9091
      protocol: TCP
      url: https://auth.paccoco.com
    runsOn:
      - pd-truenas

  - kind: Service
    name: litellm
    network:
      ip: 10.5.30.6
      port: 4000
      protocol: TCP
      url: http://10.5.30.6:4000
    runsOn:
      - pd-truenas

  - kind: Service
    name: openwebui
    network:
      ip: 10.5.30.6
      port: 8282
      protocol: TCP
      url: http://10.5.30.6:8282
    runsOn:
      - pd-truenas

  - kind: Service
    name: qdrant
    network:
      ip: 10.5.30.6
      port: 6333
      protocol: TCP
      url: http://10.5.30.6:6333
    runsOn:
      - pd-truenas

  - kind: Service
    name: searxng
    network:
      ip: 10.5.30.6
      port: 8888
      protocol: TCP
      url: http://10.5.30.6:8888
    runsOn:
      - pd-truenas

  - kind: Service
    name: ollama-light-tier
    network:
      ip: 10.5.30.6
      port: 11434
      protocol: TCP
      url: http://10.5.30.6:11434
    runsOn:
      - pd-truenas

  - kind: Service
    name: whisper-cpu
    network:
      ip: 10.5.30.7
      port: 8786
      protocol: TCP
      url: http://10.5.30.7:8786
    runsOn:
      - nomad-ubuntu

  - kind: Service
    name: ollama-heavy-tier
    network:
      ip: 10.5.30.112
      port: 11434
      protocol: TCP
      url: http://10.5.30.112:11434
    tags:
      - degraded
    runsOn:
      - rocinante-inference

  - kind: Service
    name: whisper-cuda
    network:
      ip: 10.5.30.112
      port: 8787
      protocol: TCP
      url: http://10.5.30.112:8787
    tags:
      - degraded
    runsOn:
      - rocinante-inference

  - kind: Service
    name: reranker
    network:
      ip: 10.5.30.5
      port: 9787
      protocol: TCP
      url: http://10.5.30.5:9787
    runsOn:
      - serenity-unraid

  - kind: Service
    name: plex
    network:
      ip: 10.5.30.6
      port: 32400
      protocol: TCP
      url: http://10.5.30.6:32400
    runsOn:
      - pd-truenas

  - kind: Service
    name: tautulli
    network:
      ip: 10.5.30.6
      port: 8181
      protocol: TCP
      url: http://10.5.30.6:8181
    runsOn:
      - pd-truenas

  - kind: Service
    name: audiobookshelf
    network:
      ip: 10.5.30.6
      port: 13358
      protocol: TCP
      url: http://10.5.30.6:13358
    runsOn:
      - pd-truenas

  - kind: Service
    name: calibre-web
    network:
      ip: 10.5.30.6
      port: 8183
      protocol: TCP
      url: http://10.5.30.6:8183
    runsOn:
      - pd-truenas

  - kind: Service
    name: seerr
    network:
      ip: 10.5.30.6
      port: 5055
      protocol: TCP
      url: http://10.5.30.6:5055
    runsOn:
      - pd-truenas

  - kind: Service
    name: immich
    network:
      ip: 10.5.30.6
      port: 2283
      protocol: TCP
      url: http://10.5.30.6:2283
    runsOn:
      - pd-truenas

  - kind: Service
    name: paperless-ngx
    network:
      ip: 10.5.30.6
      port: 8083
      protocol: TCP
      url: http://10.5.30.6:8083
    runsOn:
      - pd-truenas

  - kind: Service
    name: karakeep
    network:
      ip: 10.5.30.6
      port: 3100
      protocol: TCP
      url: http://10.5.30.6:3100
    runsOn:
      - pd-truenas

  - kind: Service
    name: n8n
    network:
      ip: 10.5.30.6
      port: 5678
      protocol: TCP
      url: http://10.5.30.6:5678
    runsOn:
      - pd-truenas

  - kind: Service
    name: kitchenowl
    network:
      ip: 10.5.30.6
      port: 8086
      protocol: TCP
      url: http://10.5.30.6:8086
    runsOn:
      - pd-truenas

  - kind: Service
    name: donetick
    network:
      ip: 10.5.30.6
      port: 2021
      protocol: TCP
      url: http://10.5.30.6:2021
    runsOn:
      - pd-truenas

  - kind: Service
    name: dakboard-bridge
    network:
      ip: 10.5.30.6
      port: 5087
      protocol: TCP
      url: http://10.5.30.6:5087
    runsOn:
      - pd-truenas

  - kind: Service
    name: qui
    network:
      ip: 10.5.30.6
      port: 7476
      protocol: TCP
      url: http://10.5.30.6:7476
    runsOn:
      - pd-truenas

  - kind: Service
    name: home-assistant
    network:
      ip: 10.5.30.6
      port: 8123
      protocol: TCP
      url: http://10.5.30.6:8123
    runsOn:
      - pd-truenas

  - kind: Service
    name: kima-hub
    network:
      ip: 10.5.30.6
      port: 3333
      protocol: TCP
      url: http://10.5.30.6:3333
    runsOn:
      - pd-truenas

  - kind: Service
    name: grafana
    network:
      ip: 10.5.30.6
      port: 3000
      protocol: TCP
      url: http://10.5.30.6:3000
    runsOn:
      - pd-truenas

  - kind: Service
    name: prometheus
    network:
      ip: 10.5.30.6
      port: 9090
      protocol: TCP
      url: http://10.5.30.6:9090
    runsOn:
      - pd-truenas

  - kind: Service
    name: meshmonitor
    network:
      ip: 10.5.30.6
      port: 8081
      protocol: TCP
      url: http://10.5.30.6:8081
    runsOn:
      - pd-truenas

  - kind: Service
    name: tileserver-gl
    network:
      ip: 10.5.30.6
      port: 8082
      protocol: TCP
      url: http://10.5.30.6:8082
    runsOn:
      - pd-truenas

  - kind: Service
    name: pelican-panel
    network:
      ip: 10.5.30.7
      port: 80
      protocol: TCP
      url: https://panel.paccoco.com
    runsOn:
      - nomad-ubuntu

  - kind: Service
    name: wings-node-api
    network:
      ip: 10.5.30.7
      port: 8443
      protocol: TCP
      url: https://node1.paccoco.com
    runsOn:
      - nomad-ubuntu