# PlausibleDeniability

Primary Docker host running all production workloads.

> Planned direction: this host remains bare-metal TrueNAS Scale and becomes the long-term primary production platform after the HL15 Beast rebuild. See `docs/planning/PD_FUTURE_STATE_ARCHITECTURE.md`.

## Specs
- **OS:** TrueNAS Scale 25.10.2.1
- **CPU:** Ryzen 9 3950X
- **RAM:** 32GB
- **GPU:** Nvidia RTX 2080 Ti (11GB VRAM)
- **UPS:** None

## Storage Tiers

| Tier | Mount | Use for |
|------|-------|---------|
| Local SSD (Crucial MX500 500GB) | `/mnt/docker-ssd` | Docker root, databases, write-heavy appdata, GPU/model caches |
| TrueNAS pool (tank, 2-drive ZFS mirror ~3.5TB) | `/mnt/tank` | General appdata, configs, backups, downloads |
| Unraid NFS | `/mnt/unraid` | Media libraries, Immich media |

## Docker Root
`/mnt/docker-ssd/docker/docker-data`

## Compose Repo
`/mnt/docker-ssd/docker/compose`

## Key Docker Networks
- `ix-databases_shared-databases` — shared DB access network (created by databases stack)
- `pangolin` — reverse proxy exposure network (created by newt)

## GPU Usage
RTX 2080 Ti used by:
- Plex (hardware transcoding)
- immich-ml (CUDA face recognition)
- Ollama light-tier inference for the main AI stack and local Honcho backend

> **Note:** Whisper moved to N.O.M.A.D. (10.5.30.7:8786) as CPU inference — avoids VRAM conflict with Ollama. See [NOMAD.md](NOMAD.md).

Recommended models for 11GB VRAM:
| Model | VRAM | Best for |
|-------|------|---------|
| `qwen2.5:7b` | ~5GB | Cheap/default reasoning, summaries, derivation |
| `qwen2.5:14b` | ~8GB | Heavier reasoning / high-max paths |
| `qwen2.5-coder:7b` | ~5GB | Code tasks |
| `deepseek-r1:8b` | ~5GB | Math, logic |
| `phi4` | ~8GB | Analytical tasks |

Current light-tier notes:
- PD Ollama is the active light-tier endpoint for LiteLLM on `http://10.5.30.6:11434`
- Local Honcho currently points at PD Ollama over LAN (`http://10.5.30.6:11434/v1`) instead of using a separate local model host
- Current Honcho routing split keeps embeddings on `nomic-embed-text:latest`, cheap/default paths on `qwen2.5:7b`, and deeper high/max paths on `qwen2.5:14b`

## Remote Access
- Pangolin VPS + Newt for external services
- SSH from Windows 11

## DNS Role
- Primary Technitium source-of-truth node binds `10.5.30.8` via the `technitium-pilot` stack
- Root cron runs `/mnt/docker-ssd/docker/compose/technitium-pilot/bin/sync_backup_nodes.sh` every 15 minutes to push the live Technitium config to the backup nodes on N.O.M.A.D. (`10.5.30.9`) and Serenity (`10.5.30.10`)
- Sync logs live at `/mnt/tank/docker/appdata/technitium-pilot/logs/sync-backup-nodes.log`
- External fallback `9.9.9.9` protects public DNS continuity, but authoritative `home.paccoco.com` answers still depend on at least one Technitium node being up

## NFS Mounts (from Serenity)
- Serenity `/mnt/user/data` → `/mnt/unraid/data` (media libraries)
- Serenity `/mnt/user/immich` → `/mnt/unraid/immich` (Immich photo library)

> **Note:** NFS mounts are not automatic at boot. Run after every TrueNAS restart:
> ```bash
> sudo bash /mnt/tank/docker/scripts/mount-unraid-nfs.sh
> ```
>
> **Important:** if `/mnt/unraid/data` or `/mnt/unraid/immich` gets remounted after dependent containers are already running, restart the bind-mounted consumers so they pick up the live NFS mount instead of the pre-remount underlay. Current restart set: Plex, Audiobookshelf, Calibre-Web, and Immich Server.

## Known Issues
- immich-ml intermittently unhealthy — investigate GPU/CUDA health
- docker-ssd has no redundancy — single point of failure for all appdata
- No off-site backup

## Pending
- Add Pangolin resource + DNS for `ai.paccoco.com`
- Install fresh editor

## Planned future role
- Primary NAS after Serenity retirement
- Primary production Docker/app host
- Primary shared database host
- Primary media / automation / identity / monitoring host
- Primary Technitium source node
- Future home of qBittorrent + ARR after storage ownership moves local to PD
- Acceptable host for tightly segmented cybersecurity VMs, but not an unrestricted lab/free-for-all hypervisor