myron/jarvis
1
0
Fork 0
mirror of https://github.com/myronblair/jarvis synced 2026-07-28 08:43:00 -05:00
Code Issues Packages Projects Releases Wiki Activity

Update infra doc: MediaStack/Jellyfin verified detail, NordVPN LAN Discovery + wg0 lockout fix, VMID corrections

Browse Source
This commit is contained in:
root
2026-07-06 13:01:54 -05:00
parent 80b0dfc583
commit 7020d445b3
1 changed files with 31 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public_html/admin/downloads/INFRASTRUCTURE-REFERENCE.md
+31 -20
View File
@@ -1,5 +1,5 @@
ssh: connect to host 10.48.200.90 port 22: Connection timed out # INFRASTRUCTURE REFERENCE — COMPLETE SYSTEM MAP
:** 2026-07-06 **Last Updated:** 2026-07-06
**Owner:** Myron Blair — myronblair@outlook.com **Owner:** Myron Blair — myronblair@outlook.com
--- ---
@@ -40,11 +40,11 @@ HOME NETWORK (FortiGate router at 10.48.200.1)
├─► PVE1 Proxmox 10.48.200.90 (primary hypervisor) ├─► PVE1 Proxmox 10.48.200.90 (primary hypervisor)
│ ├── VM 101 10.48.200.97 Home Assistant │ ├── VM 101 10.48.200.97 Home Assistant
│ ├── VM 112 10.48.200.33 Jellyfin │ ├── VM 112 10.48.200.33 Jellyfin
│ ├── VM 113 10.48.200.35 MediaStack (Sonarr/Radarr/qBT/Prowlarr) │ ├── VM 103 10.48.200.35 MediaStack (Sonarr/Radarr/qBT/Prowlarr)
│ ├── VM 118 10.48.200.18 Homebridge │ ├── VM 118 10.48.200.18 Homebridge
│ ├── VM 120 10.48.200.110 NovaCPX hosting panel │ ├── VM 120 10.48.200.110 NovaCPX hosting panel
│ ├── VM 210 10.48.200.210 Ollama (local LLM + vision) — llama3.1:8b, llava:7b │ ├── VM 106 10.48.200.210 Ollama (local LLM + vision) — llama3.1:8b, llava:7b
│ └── CT110 10.48.200.19 WireGuard exit container │ └── CT110 10.48.200.19/.67 WireGuard exit container (disabled at boot 2026-07-06, legacy/unused)
│ │
├─► PVE2 Proxmox 10.48.200.91 (secondary hypervisor) ├─► PVE2 Proxmox 10.48.200.91 (secondary hypervisor)
│ └── VM 302 10.48.200.99 NetworkBackup │ └── VM 302 10.48.200.99 NetworkBackup
@@ -189,11 +189,12 @@ qm guest exec <VMID> -- bash -c "cmd" # run command inside VM (requires QEMU ag
| Field | Value | | Field | Value |
|-------|-------| |-------|-------|
| **IP** | 10.48.200.33 | | **IP** | 10.48.200.33 |
| **OS** | Ubuntu 22.04 LTS | | **OS** | Ubuntu 24.04.4 LTS (verified 2026-07-06; previously logged as 22.04 — reinstalled/upgraded at some point) |
| **SSH** | `ssh root@10.48.200.33` — password: `Joker1974!!!` (enabled 2026-06-14) | | **SSH** | `ssh root@10.48.200.33` — password: `Joker1974!!!` (enabled 2026-06-14) |
| **Web UI** | `http://10.48.200.33:8096` | | **Web UI** | `http://10.48.200.33:8096` (Jellyfin 10.11.11) |
| **Purpose** | Media streaming server — Movies and TV shows | | **Purpose** | Media streaming server — Movies and TV shows |
| **JARVIS Agent** | Not yet installed | | **JARVIS Agent** | `jarvis-agent.service` running (verified 2026-07-06) |
| **Remote access** | Tailscale installed, node `jellyfin-112` at `100.81.145.48` — used for off-LAN streaming access |
**Media Libraries:** **Media Libraries:**
- Movies: `/mnt/mediastack/movies` — NFS from MediaStack (10.48.200.35:/media/movies) - Movies: `/mnt/mediastack/movies` — NFS from MediaStack (10.48.200.35:/media/movies)
@@ -217,14 +218,15 @@ mount /mnt/mediastack/movies && mount /mnt/mediastack/tv
--- ---
### VM 113 — MediaStack (PVE1) ### VM 103 — MediaStack (PVE1)
| Field | Value | | Field | Value |
|-------|-------| |-------|-------|
| **IP** | 10.48.200.35 | | **IP** | 10.48.200.35 |
| **OS** | Ubuntu 24.04 LTS | | **OS** | Ubuntu 24.04.4 LTS |
| **SSH** | Via PVE1: `ssh -i /root/.ssh/id_rsa root@10.48.200.35` (no direct access from DO) | | **SSH** | Via PVE1: `ssh -i /root/.ssh/id_rsa root@10.48.200.35` (no direct access from DO) |
| **Purpose** | Automated media download pipeline + NFS server to Jellyfin | | **Purpose** | Automated media download pipeline + NFS server to Jellyfin |
| **JARVIS Agent** | ID: `MediaStack_2c00b1b8` | | **JARVIS Agent** | ID: `MediaStack_2c00b1b8` |
| **Not Docker** | Despite the name, all services below run bare-metal via systemd, not docker-compose |
**Services:** **Services:**
| Service | Port | Login | API Key | | Service | Port | Login | API Key |
@@ -236,8 +238,7 @@ mount /mnt/mediastack/movies && mount /mnt/mediastack/tv
**All services run as root** — required by Synology NFS ACL (only root can write). **All services run as root** — required by Synology NFS ACL (only root can write).
**VPN:** NordVPN — `nordlynx` WireGuard interface — exit IP 181.214.226.188 (US Dallas) **VPN:** NordVPN — `nordlynx` WireGuard interface — exit IP rotates (US Dallas servers), not a fixed IP (previous "181.214.226.188" was just a snapshot, not stable). All download/general traffic exits via NordVPN with LAN traffic exempted (Kill Switch + Firewall + LAN Discovery all `enabled` as of 2026-07-06 — see Section 9 for the full incident/fix history). If downloads stall, check `nordvpn status` first, then `ip rule show` for rules 32764/32765/table 205.
All download traffic exits via NordVPN. If downloads stall, check: `ip rule show` for rules 32764/32765.
**Media Flow:** **Media Flow:**
``` ```
@@ -306,12 +307,12 @@ sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no root@10.48.200.90 \
--- ---
### VM 210 — Ollama Local LLM + Vision (PVE1) ### VM 106 — Ollama Local LLM + Vision (PVE1)
| Field | Value | | Field | Value |
|-------|-------| |-------|-------|
| **IP** | 10.48.200.210 | | **IP** | 10.48.200.210 |
| **OS** | Ubuntu (cloud image) | | **OS** | Ubuntu (cloud image) |
| **SSH** | `ssh root@10.48.200.210` via PVE1 hop — password: `Joker1974!!!` | | **SSH** | `ssh root@10.48.200.210` via PVE1 hop — password: `Joker1974!!!` (also reachable as `ssh myron@10.48.200.210` — password `Joker1974!`, then `sudo`). VM's name is `Ollama-95` but its real IP is `.210`, not `.95` — a prior version of this doc had a stray SSH line pointed at `.95` (nothing listens there); confirmed 2026-07-06 that `.210` is correct. |
| **Purpose** | Local AI inference — chat (llama3.1:8b) + vision (llava:7b) | | **Purpose** | Local AI inference — chat (llama3.1:8b) + vision (llava:7b) |
| **API** | `http://10.48.200.210:11434` (Ollama REST API) | | **API** | `http://10.48.200.210:11434` (Ollama REST API) |
| **JARVIS Agent** | ID: `ollama-ai_ubuntu` | | **JARVIS Agent** | ID: `ollama-ai_ubuntu` |
@@ -340,6 +341,7 @@ Vision is enabled via: `/etc/systemd/system/jarvis-arc.service.d/vision.conf`
| **IP** | 10.48.200.19 / 10.48.200.67 | | **IP** | 10.48.200.19 / 10.48.200.67 |
| **Purpose** | Legacy WireGuard exit tunnel to DO (10.200.0.4 via wg-exit) — currently NOT used by MediaStack/Jellyfin | | **Purpose** | Legacy WireGuard exit tunnel to DO (10.200.0.4 via wg-exit) — currently NOT used by MediaStack/Jellyfin |
| **Note** | MediaStack uses NordVPN directly; Jellyfin uses wg1 peer on MediaStack for NFS only | | **Note** | MediaStack uses NordVPN directly; Jellyfin uses wg1 peer on MediaStack for NFS only |
| **2026-07-06 incident** | MediaStack's `wg0` client for this tunnel (`/etc/wireguard/wg0.conf`) had a `PostUp` hook installing its own iptables kill-switch (`REJECT` all output not via `wg0` or marked `51820`), and `wg-quick@wg0.service` was still **enabled at boot** on MediaStack despite this tunnel being unused — this caused a full LAN/SSH lockout to MediaStack the moment that service came up. **Disabled `wg-quick@wg0` at boot on MediaStack** to prevent recurrence; the tunnel itself and CT110 are untouched. See NordVPN section below for the related (separate) LAN Discovery bug found in the same incident. |
--- ---
@@ -353,7 +355,7 @@ Vision is enabled via: `/etc/systemd/system/jarvis-arc.service.d/vision.conf`
| **DSM Web UI** | `http://10.48.200.249:5000` | | **DSM Web UI** | `http://10.48.200.249:5000` |
| **Purpose** | Primary media and download storage | | **Purpose** | Primary media and download storage |
**NFS Share:** `/volume1/video` (exported to MediaStack only) **NFS Share:** `/volume1/video` and its subpaths `/volume1/video/movies`, `/volume1/video/tv` — all exported to MediaStack (10.48.200.35) only, per `/etc/exports` on the NAS (verified 2026-07-06)
**Directory structure:** **Directory structure:**
``` ```
@@ -686,10 +688,18 @@ fs_cli -x "reloadacl" # reload ACL (safe)
### NordVPN — MediaStack Internet Traffic ### NordVPN — MediaStack Internet Traffic
- Interface: `nordlynx` on MediaStack - Interface: `nordlynx` on MediaStack
- Exit IP: 181.214.226.188 (US Dallas) - Exit: rotating US (Dallas) NordVPN servers, not a fixed IP
- Policy routing: table 205 (all traffic via nordlynx), managed by `nordvpn-routing.service` - Policy routing: table 205 (non-LAN traffic via nordlynx), managed partly by NordVPN itself and partly by a custom `nordvpn-routing.service` unit (`/etc/systemd/system/nordvpn-routing.service`) that adds the `ip rule` for fwmark `0xe1f1` → table 205
- Required for IPTorrents access (blocks non-VPN IPs) - Required for IPTorrents access (blocks non-VPN IPs)
**2026-07-06 incident (fixed):** `nordvpnd` had been crash-looping since ~2026-06-07 (`/var/lib/nordvpn/data/settings.dat` was corrupted/empty) — meaning NordVPN was **not actually protecting MediaStack's traffic for about a month**; downloads were exiting on the plain home IP. Fixed by clearing the corrupt file, restarting the daemon, and re-logging in.
While fixing this, found NordVPN's own **"LAN Discovery" setting was `disabled`**. With `Routing: enabled` and LAN Discovery off, connecting NordVPN's full-tunnel routing suppresses the main routing table's resolution for anything that would exit via `eth0` — **including same-subnet LAN traffic** — so the entire VM became unreachable (SSH/ping) from the rest of the LAN the moment NordVPN connected. Fixed with `nordvpn set lan-discovery on`, which adds explicit priority rules for private ranges (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`) ahead of the tunnel catch-all. Verified LAN reachability holds with Kill Switch + Firewall both re-enabled after this fix.
**If MediaStack becomes unreachable after a NordVPN reconnect again:** check `nordvpn settings` for `LAN Discovery: enabled` first. If SSH is already dead, the network path itself is unusable — recover via the Proxmox host instead: `qm guest exec 103 -- /bin/bash -c 'export HOME=/root; nordvpn ...'` (guest-exec needs `HOME` set manually or the `nordvpn` CLI fails).
Current confirmed-good settings (2026-07-06): Firewall `enabled`, Kill Switch `enabled`, Auto-connect `enabled`, LAN Discovery `enabled`, Routing `enabled`.
--- ---
## 10. BACKUP SYSTEMS ## 10. BACKUP SYSTEMS
@@ -768,13 +778,14 @@ sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no root@10.48.200.33
sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no root@10.48.200.110 sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no root@10.48.200.110
# Ollama / Homebridge / NetworkBackup (myron user, then sudo) # Ollama / Homebridge / NetworkBackup (myron user, then sudo)
sshpass -p 'Joker1974!' ssh myron@10.48.200.95 # Ollama sshpass -p 'Joker1974!' ssh myron@10.48.200.210 # Ollama (NOT .95 - that's a naming leftover, nothing listens there)
sshpass -p 'Joker1974!' ssh myron@10.48.200.18 # Homebridge sshpass -p 'Joker1974!' ssh myron@10.48.200.18 # Homebridge
sshpass -p 'Joker1974!' ssh myron@10.48.200.99 # NetworkBackup sshpass -p 'Joker1974!' ssh myron@10.48.200.99 # NetworkBackup
# Run command inside VM via Proxmox (requires QEMU agent installed) # Run command inside VM via Proxmox (requires QEMU agent installed; use VMID not IP)
sshpass -p 'Joker1974!!!' ssh root@10.48.200.90 \ sshpass -p 'Joker1974!!!' ssh root@10.48.200.90 \
'qm guest exec 210 -- bash -c "CMD"' 'qm guest exec 106 -- bash -c "export HOME=/root; CMD"' # Ollama = VMID 106
# Other VMIDs: Jellyfin=112, MediaStack=103, JARVIS=211, NovaCPX=120, HomeAssistant=101, Homebridge=118
``` ```
**Password fallback order:** `Joker1974!@#` → `Joker1974!!!` → `Joker1974!` **Password fallback order:** `Joker1974!@#` → `Joker1974!!!` → `Joker1974!`