# Serenity

Current NAS, media-ingestion, and CPU-based AI helper host. Planned to retire after the upgraded PD build absorbs its storage role.

## Hardware

| Component | Details |
|-----------|---------|
| **IP (LAN)** | 10.5.30.5 |
| **IP (Tailscale)** | 100.94.87.79 |
| **OS** | Unraid 7.2.4 |
| **CPU** | Dual Intel Xeon X5690 (6c/12t each — 24 threads total) |
| **RAM** | 102 GB |
| **GPU** | None (Matrox G200 IPMI only) |

## Roles

- **NAS** — primary storage for Docker volumes, media, and backups via NFS
- **Media ingestion** — full ARR stack (Sonarr, Radarr, Prowlarr, qBittorrent, etc.)
- **Reranker host** — CPU-based TEI reranker for the AI RAG pipeline
- **Pangolin site host** — Serenity's local Newt is intentionally kept because Pangolin tunnels Serenity resources through that Newt instead of targeting Serenity resources from PD or NOMAD over Serenity LAN IPs

## Services

### NFS Exports

| Export | Mount on PD | Purpose |
|--------|-------------|---------|
| `/mnt/user/data` | `/mnt/unraid/data` | General Docker volumes |
| `/mnt/user/immich` | `/mnt/unraid/immich` | Immich photo library |

> **Note:** NFS mounts on PD are **not** automatic at boot. Run after every TrueNAS restart:
> ```bash
> sudo bash /mnt/tank/docker/scripts/mount-unraid-nfs.sh
> ```
>
> **Important:** if PD remounts `/mnt/unraid/data` or `/mnt/unraid/immich` after media containers are already running, restart the bind-mounted consumers so they repoint at the live NFS mount instead of the pre-remount underlay. Current restart set: Plex, Audiobookshelf, Calibre-Web, and Immich Server.

### Reranker (TEI)

Text Embeddings Inference reranker for OpenWebUI RAG pipeline.

| Setting | Value |
|---------|-------|
| **Model** | `BAAI/bge-reranker-v2-m3` |
| **Image** | `ghcr.io/huggingface/text-embeddings-inference:cpu-latest` |
| **Port** | `9787` |
| **Volume** | `/mnt/user/appdata/reranker` |
| **LiteLLM model name** | `reranker` |
| **API base** | `http://10.5.30.5:9787` |

> Moved from PlausibleDeniability (port 8787) to Serenity (port 9787) on 2026-05-09.
> CPU-only inference is acceptable for RAG reranking workloads.

### ARR Stack

Managed via Unraid Community Apps. See Unraid dashboard for individual service ports and status.

### Technitium Backup Resolver

Serenity hosts the secondary backup Technitium node on `10.5.30.10`.

- Live stack path: `/mnt/user/appdata/technitium-serenity`
- Live secrets file: `/mnt/user/appdata/technitium-serenity/.env`
- Resolver bind IP: `10.5.30.10`
- Config is refreshed from PD's live Technitium directory by the PD-side sync runner every 15 minutes
- The live `.env` is also backed up into the encrypted PD secrets repo as `env/technitium-serenity.env`
- Same-host checks from Serenity to `10.5.30.10` are unreliable because the resolver sits behind macvlan networking; verify from another LAN peer instead

## Notes

- No GPU; reranker uses CPU-only TEI image
- Tailscale active — reachable at `100.94.87.79` from any Tailscale node
- Local Serenity DB containers for the old GameVault and RomM stacks (`postgresql15` and `MariaDB-Official`) were retired on 2026-05-25 after both apps validated healthy on PD.
- The stale stopped source app containers for those old stacks were cleaned out afterward; rollback now lives in the retained appdata plus `/mnt/user/backups/doris/serenity-d7-db-retire-20260525-213531` rather than in lingering `docker ps -a` entries.
- Cooldown/rollback artifacts for that retirement were retained on Serenity under `/mnt/user/backups/doris/serenity-d7-db-retire-20260525-213531`, and the original DB appdata paths were left in place rather than deleted immediately.

## Planned future role

- Transitional only; do not design new long-term dependencies around Serenity.
- Near-term it continues to host storage locality, reranker, the backup Technitium node, and the Serenity-local Newt needed for Pangolin access to Serenity resources.
- Once PD directly owns the storage, qBittorrent/ARR locality should move to PD and Serenity should be drained and retired.
- Before any Pangolin cleanup, re-home Serenity resources away from stale literal-IP targets; live Newt logs show repeated health checks to old `10.5.1.5` addresses.