truenas-stacks/docs/servers/PLAUSIBLEDENABILITY.md

PlausibleDeniability

Primary Docker host running all production workloads.

Planned direction: this host remains bare-metal TrueNAS Scale and becomes the long-term primary production platform after the HL15 Beast rebuild. See docs/planning/PD_FUTURE_STATE_ARCHITECTURE.md.

Specs

• OS: TrueNAS Scale 25.10.2.1
• CPU: Ryzen 9 3950X
• RAM: 32GB
• GPU: Nvidia RTX 2080 Ti (11GB VRAM)
• UPS: None

Storage Tiers

Tier	Mount	Use for
Local SSD (Crucial MX500 500GB)	/mnt/docker-ssd	Docker root, databases, write-heavy appdata, GPU/model caches
TrueNAS pool (tank, 2-drive ZFS mirror ~3.5TB)	/mnt/tank	General appdata, configs, backups, downloads
Unraid NFS	/mnt/unraid	Media libraries, Immich media

Docker Root

/mnt/docker-ssd/docker/docker-data

Compose Repo

/mnt/docker-ssd/docker/compose

Key Docker Networks

• ix-databases_shared-databases — shared DB access network (created by databases stack)
• pangolin — reverse proxy exposure network (created by newt)

GPU Usage

RTX 2080 Ti used by:

• Plex (hardware transcoding)
• immich-ml (CUDA face recognition)
• Ollama light-tier inference for the main AI stack and local Honcho backend

Note: Whisper moved to N.O.M.A.D. (10.5.30.7:8786) as CPU inference — avoids VRAM conflict with Ollama. See NOMAD.md.

Recommended models for 11GB VRAM:

Model	VRAM	Best for
qwen2.5:7b	~5GB	Cheap/default reasoning, summaries, derivation
qwen2.5:14b	~8GB	Heavier reasoning / high-max paths
qwen2.5-coder:7b	~5GB	Code tasks
deepseek-r1:8b	~5GB	Math, logic
phi4	~8GB	Analytical tasks

Current light-tier notes:

• PD Ollama remains the shared light-tier endpoint for the broader AI stack on http://10.5.30.6:11434, but it should be protected from routine Honcho background load.
• Local Honcho now uses N.O.M.A.D.'s own Ollama on http://127.0.0.1:11434/v1 so PD pressure does not take down MeshMonitor or shared Postgres.
• Current Honcho routing keeps embeddings on nomic-embed-text:v1.5, cheap/default paths on qwen2.5:3b, and high/max paths on llama3.1:latest.
• Rocinante is John's PC and should be treated as an opportunistic/manual heavy tier, not a dependable always-on backend.

Remote Access

• Pangolin VPS + Newt for external services
• SSH from Windows 11

DNS Role

• Primary Technitium source-of-truth node binds 10.5.30.8 via the technitium-pilot stack
• Root cron runs /mnt/docker-ssd/docker/compose/technitium-pilot/bin/sync_backup_nodes.sh every 15 minutes to push the live Technitium config to the backup nodes on N.O.M.A.D. (10.5.30.9) and Serenity (10.5.30.10)
• Sync logs live at /mnt/tank/docker/appdata/technitium-pilot/logs/sync-backup-nodes.log
• External fallback 9.9.9.9 protects public DNS continuity, but authoritative home.paccoco.com answers still depend on at least one Technitium node being up

NFS Mounts (from Serenity)

• Serenity /mnt/user/data → /mnt/unraid/data (media libraries)
• Serenity /mnt/user/immich → /mnt/unraid/immich (Immich photo library)

Note: NFS mounts are not automatic at boot. Run after every TrueNAS restart:

sudo bash /mnt/tank/docker/scripts/mount-unraid-nfs.sh

Important: if /mnt/unraid/data or /mnt/unraid/immich gets remounted after dependent containers are already running, restart the bind-mounted consumers so they pick up the live NFS mount instead of the pre-remount underlay. Current restart set: Plex, Audiobookshelf, Calibre-Web, and Immich Server.

Known Issues

• immich-ml intermittently unhealthy — investigate GPU/CUDA health
• docker-ssd has no redundancy — single point of failure for all appdata
• No off-site backup

Pending

• Add Pangolin resource + DNS for ai.paccoco.com
• Install fresh editor

Planned future role

• Primary NAS after Serenity retirement
• Primary production Docker/app host
• Primary shared database host
• Primary media / automation / identity / monitoring host
• Primary Technitium source node
• Future home of qBittorrent + ARR after storage ownership moves local to PD
• Acceptable host for tightly segmented cybersecurity VMs, but not an unrestricted lab/free-for-all hypervisor