[pve] Weekly backup 2026-07-26 — 7 files changed, 46 insertions(+), 77 deletions(-)

- vm-configs/fstab/: fstab snapshots for JARVIS, NPM, NovaCPX, Jellyfin, MediaStack
- vm-configs/network-reference.md: full IP/service/NAS/WireGuard reference
- wireguard/: MediaStack wg0/wg1 and WireGuard CT nord0/wg-clients configs
- msp360/: install and setup scripts + staggered backup schedule

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X8tDRrQqgLjqXebMCBNcP3

msp360/install-msp360.sh

@@ -0,0 +1,84 @@
+#!/bin/bash
+# MSP360 Backup - Complete Linux Install & Configure
+# Run as root from the directory containing this script and the .deb file.
+#
+# Credentials are fetched from private Gitea repo (myron/msp360-config).
+# Requires /etc/msp360-gitea-token on the target machine.
+# OR place a filled-in msp360.conf in the same directory as this script.
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+CONF="$SCRIPT_DIR/msp360.conf"
+TOKEN_FILE="/etc/msp360-gitea-token"
+GITEA_RAW="https://gitea.orbishosting.com/myron/msp360-config/raw/branch/main/msp360.conf"
+CBB="/opt/local/MSP360 Backup/bin/cbbCommandLine"
+
+if [ -f "$CONF" ]; then
+    echo "Using local msp360.conf"
+    source "$CONF"
+elif [ -f "$TOKEN_FILE" ]; then
+    echo "Fetching config from Gitea..."
+    GITEA_TOKEN=$(cat "$TOKEN_FILE")
+    curl -sf -H "Authorization: token $GITEA_TOKEN" "$GITEA_RAW" -o /tmp/msp360.conf
+    source /tmp/msp360.conf
+    rm -f /tmp/msp360.conf
+else
+    echo "ERROR: No msp360.conf found and no /etc/msp360-gitea-token present."
+    echo "  Option A: Place a filled-in msp360.conf in $SCRIPT_DIR"
+    echo "  Option B: Put your Gitea token in /etc/msp360-gitea-token (chmod 600)"
+    exit 1
+fi
+
+BACKUP_PATH="${MOUNT_POINT}/${BACKUP_SUBDIR}"
+CBB_DEB=$(ls "$SCRIPT_DIR"/ubuntu14_MSP360_*.deb 2>/dev/null | head -1)
+
+echo "=== Step 1: Install MSP360 ==="
+if [ -f "$CBB_DEB" ]; then
+    dpkg -i "$CBB_DEB"
+    sleep 5
+else
+    echo "WARNING: No .deb found — assuming already installed"
+fi
+
+echo "=== Step 2: Activate license ==="
+"$CBB" activateLicense -e "$LICENSE_EMAIL" -free
+
+echo "=== Step 3: Install cifs-utils ==="
+apt-get install -y cifs-utils
+
+echo "=== Step 4: Mount NAS ==="
+mkdir -p "$MOUNT_POINT" /etc/nas-creds
+printf "username=%s\npassword=%s\n" "$NAS_USER" "$NAS_PASS" > /etc/nas-creds/msp360
+chmod 600 /etc/nas-creds/msp360
+
+if ! mountpoint -q "$MOUNT_POINT"; then
+    mount -t cifs "//${NAS_HOST}/${NAS_SHARE}" "$MOUNT_POINT" \
+        -o credentials=/etc/nas-creds/msp360,uid=0,gid=0,noperm,_netdev
+fi
+df -h "$MOUNT_POINT"
+
+echo "=== Step 5: Create backup directory ==="
+mkdir -p "$BACKUP_PATH"
+
+echo "=== Step 6: Add fstab entry ==="
+FSTAB_LINE="//${NAS_HOST}/${NAS_SHARE} ${MOUNT_POINT} cifs credentials=/etc/nas-creds/msp360,uid=0,gid=0,noperm,_netdev 0 0"
+grep -q "$MOUNT_POINT" /etc/fstab || echo "$FSTAB_LINE" >> /etc/fstab
+
+echo "=== Step 7: Register storage account ==="
+"$CBB" addAccount -st FileSystem -d "NAS-MSPBackups" -c "$BACKUP_PATH"
+
+echo "=== Step 8: Create backup plan ==="
+"$CBB" addBackupPlan \
+    -n "$PLAN_NAME" \
+    -a "NAS-MSPBackups" \
+    -f "/" \
+    -ef "/proc" -ef "/sys" -ef "/dev" -ef "/run" -ef "/tmp" -ef "/mnt" \
+    -es no \
+    -purge 1m -purgeBy backupDate -keepLastVersion yes \
+    -runMissed yes \
+    -en yes -every day -at "$INC_TIME" \
+    -enFull yes -everyFull week -atFull "$FULL_TIME" -weekdayFull "su"
+
+echo ""
+echo "=== Done! Plan list: ==="
+"$CBB" plan -l

msp360/msp360-schedule.md

@@ -0,0 +1,35 @@
+# MSP360 Backup Schedule
+
+License: myronblair@outlook.com (free)
+NAS: //10.48.200.249/Storage → /mnt/nas-backups
+Backup path: /mnt/nas-backups/MSPBackups/CBB_<hostname>/
+Credentials: fetched from Gitea private repo myron/msp360-config via /etc/msp360-gitea-token
+
+## Plan: All files, weekly full + daily incremental, 1 month retention
+
+| Host         | IP              | Plan Name          | Full (Sun) | Incremental (daily) | Status   |
+|--------------|-----------------|--------------------|------------|---------------------|----------|
+| JARVIS       | 10.48.200.211   | JARVIS-Backup      | 01:00      | 02:00               | Stopped  |
+| NPM          | 10.48.200.200   | NPM-Backup         | 01:15      | 02:15               | Stopped  |
+| NovaCPX      | 10.48.200.110   | NovaCPX-Backup     | 01:30      | 02:30               | Stopped  |
+| Jellyfin     | 10.48.200.33    | Jellyfin-Backup    | 01:45      | 02:45               | Stopped  |
+| Homebridge   | 10.48.200.18    | Homebridge-Backup  | 02:00      | 03:00               | Unknown  |
+| MediaStack   | 10.48.200.35    | MediaStack-Backup  | 02:15      | 03:15               | Running  |
+| PVE1         | 10.48.200.90    | PVE1-Backup        | 02:30      | 03:30               | Stopped  |
+| PVE2         | 10.48.200.91    | PVE2-Backup        | 02:45      | 03:45               | Pending  |
+| Ollama       | 10.48.200.210   | Ollama-Backup      | 03:00      | 04:00               | Pending  |
+| NetworkBak   | 10.48.200.99    | NetworkBak-Backup  | 03:15      | 04:15               | Pending  |
+
+Pending = offline, needs install when back up.
+DO server (165.22.1.228) and FusionPBX (134.209.72.226) cannot reach internal NAS.
+
+## Install on new host
+```bash
+# 1. Place Gitea token
+echo "<token>" > /etc/msp360-gitea-token && chmod 600 /etc/msp360-gitea-token
+
+# 2. Run setup (MSP360 already installed)
+curl -sk https://web.orbishosting.com/downloads/msp360-linux-installer.zip -o /tmp/msp360.zip
+unzip /tmp/msp360.zip -d /tmp/msp360 && cd /tmp/msp360
+bash msp360-setup.sh "HOSTNAME-Backup" "HH:MM" "HH:MM"
+```

msp360/msp360-setup.sh

@@ -0,0 +1,61 @@
+#!/bin/bash
+# MSP360 Backup - Configure only (MSP360 already installed)
+# Usage: bash msp360-setup.sh <plan_name> <full_time> <inc_time>
+# Credentials: fetched from Gitea (/etc/msp360-gitea-token) or local msp360.conf
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+CONF="$SCRIPT_DIR/msp360.conf"
+TOKEN_FILE="/etc/msp360-gitea-token"
+GITEA_RAW="https://gitea.orbishosting.com/myron/msp360-config/raw/branch/main/msp360.conf"
+CBB="/opt/local/MSP360 Backup/bin/cbbCommandLine"
+
+if [ -f "$CONF" ]; then
+    source "$CONF"
+elif [ -f "$TOKEN_FILE" ]; then
+    GITEA_TOKEN=$(cat "$TOKEN_FILE")
+    curl -sf -H "Authorization: token $GITEA_TOKEN" "$GITEA_RAW" -o /tmp/msp360.conf
+    source /tmp/msp360.conf
+    rm -f /tmp/msp360.conf
+else
+    echo "ERROR: No msp360.conf and no /etc/msp360-gitea-token"
+    exit 1
+fi
+
+PLAN_NAME="${1:-${PLAN_NAME:-MyHost-Backup}}"
+FULL_TIME="${2:-${FULL_TIME:-01:00}}"
+INC_TIME="${3:-${INC_TIME:-02:00}}"
+BACKUP_PATH="${MOUNT_POINT:-/mnt/nas-backups}/${BACKUP_SUBDIR:-MSPBackups}"
+
+"$CBB" activateLicense -e "$LICENSE_EMAIL" -free
+apt-get install -y cifs-utils 2>/dev/null | tail -1
+
+mkdir -p "${MOUNT_POINT}" /etc/nas-creds
+[ -f /etc/nas-creds/msp360 ] || \
+    printf "username=%s\npassword=%s\n" "$NAS_USER" "$NAS_PASS" > /etc/nas-creds/msp360
+chmod 600 /etc/nas-creds/msp360
+
+mountpoint -q "${MOUNT_POINT}" || \
+    mount -t cifs "//${NAS_HOST}/${NAS_SHARE}" "${MOUNT_POINT}" \
+        -o credentials=/etc/nas-creds/msp360,uid=0,gid=0,noperm,_netdev
+
+mkdir -p "$BACKUP_PATH"
+
+grep -q "${MOUNT_POINT}" /etc/fstab || \
+    echo "//${NAS_HOST}/${NAS_SHARE} ${MOUNT_POINT} cifs credentials=/etc/nas-creds/msp360,uid=0,gid=0,noperm,_netdev 0 0" >> /etc/fstab
+
+"$CBB" addAccount -st FileSystem -d "NAS-MSPBackups" -c "$BACKUP_PATH" 2>&1
+
+"$CBB" addBackupPlan \
+    -n "$PLAN_NAME" \
+    -a "NAS-MSPBackups" \
+    -f "/" \
+    -ef "/proc" -ef "/sys" -ef "/dev" -ef "/run" -ef "/tmp" -ef "/mnt" \
+    -es no \
+    -purge 1m -purgeBy backupDate -keepLastVersion yes \
+    -runMissed yes \
+    -en yes -every day -at "$INC_TIME" \
+    -enFull yes -everyFull week -atFull "$FULL_TIME" -weekdayFull "su" 2>&1
+
+echo "Done. Plans:"
+"$CBB" plan -l

pve/cron/root

@@ -4,3 +4,5 @@
 */3 * * * * /usr/local/bin/jarvis-netscan.sh >>/var/log/jarvis-netscan.log 2>&1
 * * * * * /usr/local/bin/jarvis-phone-probe.sh >/dev/null 2>&1
 0 3 * * 0 /usr/local/bin/proxmox-backup >> /var/log/proxmox-backup.log 2>&1
+*/15 * * * * /usr/local/bin/msp360-mount-ensure.sh
+0 6 * * * /usr/local/bin/backup-status-collect.sh >> /var/log/backup-status-collect.log 2>&1

pve/scripts/backup-status-collect.sh

@@ -0,0 +1,126 @@
+#!/bin/bash
+# Collects MSP360 backup plan status from all known hosts and writes a JSON
+# status file, then pushes it to web.orbishosting.com (VM110).
+set -u
+CBB="/opt/local/MSP360 Backup/bin/cbb"
+CBBV2="/opt/local/MSP360 Backup/bin/cbbV2"
+SSHPW="Joker1974!!!"
+OUT=/tmp/backup-status.json
+NOW="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+
+get_plan_status() {
+  # $1=host $2=user $3=planname $4=mode(local|hop)
+  local host="$1" user="$2" plan="$3" mode="$4" out
+  if [ "$mode" = "local" ]; then
+    out="$("$CBB" plan -l 2>&1)"
+  elif [ "$mode" = "hop" ]; then
+    out="$(sshpass -p "$SSHPW" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=8 "$user@$host" "'$CBB' plan -l 2>&1")"
+  fi
+  local state result id
+  state=$(echo "$out" | grep 'State:' | head -1 | sed 's/.*State: *//')
+  result=$(echo "$out" | grep 'Last result:' | head -1 | sed 's/.*Last result: *//')
+  id=$(echo "$out" | grep 'Id:' | head -1 | sed 's/.*Id: *//')
+  echo "${state:-unreachable}|${result:-unreachable}|${id:-}"
+}
+
+# Fixed 2026-07-20: previously read CBB_Configuration/<planId>.cbb$/ generation
+# folders on the NAS, assuming that was "more trustworthy" than the plan's own
+# self-reported status. That folder turned out to only get written once, at
+# initial plan setup/first test run, and never again on subsequent scheduled
+# runs (even though those runs were genuinely succeeding daily and writing
+# real file data elsewhere in the destination tree) - so every host showed a
+# stale last_success frozen at its original setup date, making working daily
+# backups look dead for weeks. The plan's own "Last run time" (from cbbV2
+# plan details) reflects the actual most recent run and is accurate.
+get_last_run_time() {
+  # $1=host $2=user $3=mode $4=plan_id
+  local host="$1" user="$2" mode="$3" plan_id="$4" out line
+  [ -z "$plan_id" ] && { echo "null"; return; }
+  if [ "$mode" = "local" ]; then
+    out="$("$CBBV2" plan details -i "$plan_id" --progress 2>&1)"
+  else
+    out="$(sshpass -p "$SSHPW" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=8 "$user@$host" "'$CBBV2' plan details -i $plan_id --progress 2>&1")"
+  fi
+  line=$(echo "$out" | grep '^Last run time:' | head -1 | sed 's/^Last run time: *//')
+  [ -z "$line" ] && { echo "null"; return; }
+  date -u -d "$line" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || echo "null"
+}
+
+echo "[" > "$OUT"
+first=1
+
+emit() {
+  local name="$1" ip="$2" state="$3" result="$4" last_success="$5"
+  [ "$first" -eq 1 ] && first=0 || echo "," >> "$OUT"
+  if [ "$last_success" = "null" ]; then
+    cat >> "$OUT" <<EOF
+  {"name": "$name", "ip": "$ip", "state": "$state", "result": "$result", "last_success": null}
+EOF
+  else
+    cat >> "$OUT" <<EOF
+  {"name": "$name", "ip": "$ip", "state": "$state", "result": "$result", "last_success": "$last_success"}
+EOF
+  fi
+}
+
+collect() {
+  local name="$1" ip="$2" user="$3" mode="$4"
+  local r state result id last_success
+  r=$(get_plan_status "$ip" "$user" "" "$mode")
+  state="${r%%|*}"
+  rest="${r#*|}"
+  result="${rest%%|*}"
+  id="${rest#*|}"
+  last_success=$(get_last_run_time "$ip" "$user" "$mode" "$id")
+  emit "$name" "$ip" "$state" "$result" "$last_success"
+}
+
+# Homebridge dropped its in-guest MSP360 agent (repeated, unresolved storage
+# errors) in favor of the cluster-wide Proxmox vzdump job, which snapshots
+# the whole VM disk nightly at 21:00 to the same NAS. Reads the dump
+# directory directly instead of querying an in-guest agent.
+collect_proxmox_vm() {
+  local name="$1" ip="$2" vmid="$3" dump_dir="/mnt/pve/SynologyProx/dump"
+  local latest_dump latest_log ts iso result state
+
+  latest_dump=$(ls "$dump_dir"/vzdump-qemu-"$vmid"-*.vma.zst 2>/dev/null | sort | tail -1)
+  if [ -z "$latest_dump" ]; then
+    emit "$name" "$ip" "Unknown" "unreachable" "null"
+    return
+  fi
+
+  ts=$(basename "$latest_dump" | sed -E 's/vzdump-qemu-[0-9]+-([0-9_]+-[0-9_]+)\.vma\.zst/\1/')
+  iso=$(date -u -d "$(echo "$ts" | sed -E 's/(....)_(..)_(..)-(..)_(..)_(..)/\1-\2-\3 \4:\5:\6/')" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || echo "")
+
+  latest_log="$dump_dir/vzdump-qemu-$vmid-$ts.log"
+  if [ -f "$latest_log" ] && grep -q "Finished Backup" "$latest_log"; then
+    result="Success"
+  else
+    result="Warning"
+  fi
+  state="Proxmox nightly"
+
+  if [ -n "$iso" ]; then
+    emit "$name" "$ip" "$state" "$result" "$iso"
+  else
+    emit "$name" "$ip" "$state" "$result" "null"
+  fi
+}
+
+collect "PVE1" "10.48.200.90" "" "local"
+collect "JARVIS" "10.48.200.211" "root" "hop"
+collect "NovaCPX" "10.48.200.110" "root" "hop"
+collect "Jellyfin" "10.48.200.33" "root" "hop"
+collect "MediaStack" "10.48.200.35" "root" "hop"
+collect_proxmox_vm "Homebridge" "10.48.200.18" "118"
+
+echo "]" >> "$OUT"
+
+python3 -c "
+import json
+data = json.load(open('$OUT'))
+data = {'updated': '$NOW', 'hosts': data}
+json.dump(data, open('$OUT', 'w'), indent=2)
+"
+
+sshpass -p "$SSHPW" scp -o StrictHostKeyChecking=no "$OUT" root@10.48.200.110:/home/webacct/public_html/downloads/backup-status.json

pve/scripts/jarvis-netscan.sh

@@ -2,13 +2,17 @@
 # JARVIS Network Scanner — runs on PVE1, pushes nmap results to JARVIS
 # Cron: */3 * * * * /usr/local/bin/jarvis-netscan.sh >/dev/null 2>&1
 
-JARVIS_URL="https://165.22.1.228"
+JARVIS_URL="http://10.48.200.211"
 JARVIS_HOST="jarvis.orbishosting.com"
-REG_KEY="f846a9aaf7ce9a61742c63c87c4186052a71d2a580c65518"
+REG_KEY=$(cat /etc/jarvis-agent/reg-key 2>/dev/null)
+if [ -z "$REG_KEY" ]; then
+    echo "$(date): ERROR: /etc/jarvis-agent/reg-key not found" >&2
+    exit 1
+fi
 SUBNET="10.48.200.0/24"
 
 TMPFILE=$(mktemp)
-nmap -sn --send-ip "$SUBNET" 2>/dev/null > "$TMPFILE"
+nmap -sn "$SUBNET" 2>/dev/null > "$TMPFILE"
 
 if [ ! -s "$TMPFILE" ]; then
     echo "$(date): nmap produced no output" >&2

pve/scripts/jarvis-phone-probe.sh

@@ -3,9 +3,13 @@
 # Pings all Yealink phones + checks FusionPBX SIP registration (read-only)
 # 200.3 is on an external FusionPBX — ping only, no SIP check
 
-JARVIS_URL="https://165.22.1.228"
+JARVIS_URL="http://10.48.200.211"
 JARVIS_HOST="jarvis.orbishosting.com"
-REG_KEY="f846a9aaf7ce9a61742c63c87c4186052a71d2a580c65518"
+REG_KEY=$(cat /etc/jarvis-agent/reg-key 2>/dev/null)
+if [ -z "$REG_KEY" ]; then
+    echo "$(date): ERROR: /etc/jarvis-agent/reg-key not found" >&2
+    exit 1
+fi
 FUSION_HOST="134.209.72.226"
 
 # IP|alias|extension(none=skip SIP check)|mac
@@ -21,19 +25,17 @@ PHONES=(
 REG_OUTPUT=$(ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5 -o BatchMode=yes \
   root@$FUSION_HOST "fs_cli -x 'show registrations'" 2>/dev/null || echo "")
 
-DEVICES="["
-FIRST=1
+# Collect results as TSV, delegate JSON building to python3 to avoid injection
+RESULTS=""
 for PHONE in "${PHONES[@]}"; do
   IFS='|' read -r IP ALIAS EXT MAC <<< "$PHONE"
 
-  # Ping probe
   if ping -c 1 -W 2 "$IP" > /dev/null 2>&1; then
     STATUS="online"
   else
     STATUS="offline"
   fi
 
-  # SIP check — skip for external phones (ext=none)
   if [ "$EXT" = "none" ]; then
     SIP="external"
   elif [ -n "$REG_OUTPUT" ] && echo "$REG_OUTPUT" | grep -q "^${EXT},"; then
@@ -42,15 +44,31 @@ for PHONE in "${PHONES[@]}"; do
     SIP="unregistered"
   fi
 
-  [ $FIRST -eq 0 ] && DEVICES+=","
-  DEVICES+="{\"ip\":\"$IP\",\"alias\":\"$ALIAS\",\"mac\":\"$MAC\",\"vendor\":\"Yealink\",\"status\":\"$STATUS\",\"sip_status\":\"$SIP\",\"extension\":\"$EXT\"}"
-  FIRST=0
+  RESULTS="${RESULTS}${IP}\t${ALIAS}\t${MAC}\t${STATUS}\t${SIP}\t${EXT}\n"
 done
-DEVICES+="]"
+
+JSON=$(printf "%b" "$RESULTS" | python3 -c "
+import sys, json
+devices = []
+for line in sys.stdin:
+    line = line.rstrip('\n')
+    if not line:
+        continue
+    parts = line.split('\t')
+    if len(parts) < 6:
+        continue
+    ip, alias, mac, status, sip, ext = parts[:6]
+    devices.append({
+        'ip': ip, 'alias': alias, 'mac': mac,
+        'vendor': 'Yealink', 'status': status,
+        'sip_status': sip, 'extension': ext,
+    })
+print(json.dumps({'devices': devices}))
+")
 
 curl -sk --max-time 10 \
   -X POST "$JARVIS_URL/api/netscan" \
   -H "Host: $JARVIS_HOST" \
   -H "Content-Type: application/json" \
   -H "X-Registration-Key: $REG_KEY" \
-  -d "{\"devices\":$DEVICES}" > /dev/null 2>&1
+  -d "$JSON" > /dev/null 2>&1

pve/scripts/jarvis-ping-probe.py

@@ -11,7 +11,7 @@ import urllib.request
 import urllib.error
 import ssl
 
-JARVIS_URL  = "https://165.22.1.228"
+JARVIS_URL  = "http://10.48.200.211"
 HOST_HEADER = "jarvis.orbishosting.com"
 
 # Devices to probe: agent_id → api_key
@@ -93,7 +93,6 @@ def main():
         status = "online" if alive else "offline"
         print(f"{agent_id} ({ip}): {status}", flush=True)
         heartbeat(agent_id, api_key, alive)
-        if alive:
         update_status(agent_id, api_key, status)
 
 if __name__ == "__main__":

pve/scripts/msp360-mount-ensure.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+# Ensures the NAS CIFS mount and the MSP360 bind-mount are both live.
+# MSP360's pre-flight check does `mountpoint <Path>` on the exact configured
+# storage Path (/mnt/nas-backups/MSPBackups). Since that's a subdirectory of
+# the real CIFS mount (/mnt/nas-backups), it never registers as a mountpoint
+# on its own -- so we bind-mount it onto itself to make it one.
+set -u
+MOUNT=/mnt/nas-backups
+SUBDIR="$MOUNT/MSPBackups"
+LOG=/var/log/msp360-mount-ensure.log
+
+log() { echo "$(date '+%F %T') $1" >> "$LOG"; }
+
+if ! mountpoint -q "$MOUNT"; then
+    log "CIFS mount down, remounting $MOUNT..."
+    if mount "$MOUNT" 2>>"$LOG"; then
+        log "CIFS remount OK"
+        umount "$SUBDIR" 2>/dev/null || true
+    else
+        log "CIFS remount FAILED"
+        exit 1
+    fi
+fi
+
+if ! mountpoint -q "$SUBDIR"; then
+    log "Bind mount down, rebinding $SUBDIR..."
+    mkdir -p "$SUBDIR"
+    if mount --bind "$SUBDIR" "$SUBDIR" 2>>"$LOG"; then
+        log "Bind mount OK"
+    else
+        log "Bind mount FAILED"
+        exit 1
+    fi
+fi
+
+exit 0

shared/jobs.cfg

@@ -7,6 +7,7 @@ vzdump: backup-aa6b1890-23c0
 	node pve
 	notes-template {{guestname}}
 	notification-mode notification-system
+	prune-backups keep-daily=5,keep-last=3,keep-monthly=1,keep-weekly=1,keep-yearly=1
 	schedule 21:00
 	storage SynologyProx
 

shared/nodes/pve/lxc/104.conf

@@ -0,0 +1,17 @@
+arch: amd64
+cores: 8
+dev0: /dev/net/tun
+features: nesting=1,keyctl=1,mount=nfs;cifs
+hostname: StreamHoard
+memory: 12288
+mp0: /mnt/nas-video,mp=/mnt/nas/video
+mp1: /mnt/nas-backups,mp=/mnt/nas-backups
+nameserver: 1.1.1.1
+net0: name=eth0,bridge=vmbr0,gw=10.48.200.1,hwaddr=BC:24:11:47:D1:14,ip=10.48.200.104/24,type=veth
+onboot: 1
+ostype: debian
+rootfs: local-lvm:vm-104-disk-0,size=60G
+searchdomain: orbishosting.com
+startup: order=10,up=30
+swap: 512
+unprivileged: 1

shared/nodes/pve/lxc/110.conf

@@ -1,15 +0,0 @@
-arch: amd64
-cores: 2
-features: nesting=1,keyctl=1
-hostname: WireGuard-19
-memory: 1024
-nameserver: 10.48.200.90
-net0: name=eth0,bridge=vmbr0,gw=10.48.200.1,hwaddr=BC:24:11:46:1E:70,ip=10.48.200.67/24,type=veth
-onboot: 1
-ostype: alpine
-rootfs: GoFlex:110/vm-110-disk-0.raw,size=8G
-swap: 512
-timezone: America/Chicago
-unprivileged: 1
-lxc.cgroup2.devices.allow: c 10:200 rwm
-lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file

shared/nodes/pve/qemu-server/100.conf

@@ -3,12 +3,12 @@ audio0: device=AC97,driver=none
 boot: order=ide0;ide2;net0
 cores: 2
 cpu: host
-ide0: GoFlex:100/vm-100-disk-0.raw,cache=writeback,discard=on,size=100G
+ide0: SynologyLVM:vm-100-disk-0,cache=writeback,discard=on,size=100G
 ide2: none,media=cdrom
 machine: pc-q35-10.1
 memory: 8192
 meta: creation-qemu=10.1.2,ctime=1771397582
-name: SynchroNet-50
+name: SynchroNet-112
 net0: e1000=BC:24:11:78:E0:81,bridge=vmbr0,firewall=1
 numa: 0
 onboot: 1

shared/nodes/pve/qemu-server/101.conf

@@ -0,0 +1,18 @@
+agent: 1
+boot: order=scsi0;ide2;net0
+cores: 1
+cpu: host
+ide2: SynologyProx:iso/ubuntu-26.04-live-server-amd64.iso,media=cdrom,size=2850194K
+machine: q35
+memory: 2048
+meta: creation-qemu=11.0.2,ctime=1784216596
+name: Shoutcast
+net0: virtio=BC:24:11:B3:90:CE,bridge=vmbr0,firewall=1
+numa: 0
+onboot: 1
+ostype: l26
+scsi0: SynologyLVM:vm-101-disk-0,iothread=1,size=32G
+scsihw: virtio-scsi-single
+smbios1: uuid=04502349-ab0a-4f38-b3cc-61cd152c19b2
+sockets: 1
+vmgenid: ea8db439-0a82-439c-8bc3-18d900024d70

shared/nodes/pve/qemu-server/102.conf

@@ -0,0 +1,18 @@
+boot: order=ide0;ide2;net0
+cores: 2
+cpu: host
+ide0: SynologyLVM:vm-102-disk-0,size=50G
+ide1: SynologyLVM:vm-102-disk-1,size=1000G
+ide2: SynologyProx:iso/WinServ2019.rs5_release_svc_refresh_SERVER_EVAL_x64FRE_en-us.iso,media=cdrom,size=5519618K
+machine: pc-q35-11.0+pve2
+memory: 16384
+meta: creation-qemu=11.0.2,ctime=1784244235
+name: WinServer
+net0: e1000=BC:24:11:16:F9:98,bridge=vmbr0,firewall=1
+numa: 0
+onboot: 1
+ostype: win10
+scsihw: virtio-scsi-single
+smbios1: uuid=dbb79eab-5102-4811-bb8c-4839f5d8f272
+sockets: 2
+vmgenid: 2c03e9dc-d438-47b0-bb46-7002710c67d1

shared/nodes/pve/qemu-server/103.conf

@@ -1,20 +0,0 @@
-agent: enabled=1
-boot: order=scsi0
-cipassword: $5$tLqUKTpU$CYpX9cKbAdJ8JwaimzUUrcrPqwLvkm69PERl8AtvQg8
-ciuser: root
-cores: 4
-ipconfig0: ip=10.48.200.35/24,gw=10.48.200.1
-lock: backup
-machine: q35
-memory: 4096
-meta: creation-qemu=11.0.0,ctime=1780635620
-name: MediaStack-35
-nameserver: 10.48.200.90
-net0: virtio=BC:24:11:84:40:0E,bridge=vmbr0
-onboot: 1
-ostype: l26
-scsi0: GoFlex:103/vm-103-disk-0.qcow2,discard=on,size=50G
-scsihw: virtio-scsi-pci
-smbios1: uuid=48b8e543-f0bb-49a3-857f-90603379193a
-sshkeys: ssh-rsa%20AAAAB3NzaC1yc2EAAAADAQABAAACAQDNYf4z78s4%2BK4HoiUiHoqPbCCEFngCAXKP7mGwhCAc86TTbAosTpAnG1HycPzb2s2B3K3geQPUzQzcLvWdBX8hJM8IamvAZ%2FWXPtOszWTuVnaYM6BQY7ldIdXi3a%2BxscWr%2BM8dM6OexXqdCAy66HXmgl98%2BCg2uEbxCFelH81%2F5d3cuoCXllpvUawyYZe5UjFjPeBpPc%2FQyhDxG4ovYYpcCeHbzLXc9jIfawjwJTDcYfeXVHFisMdSUp0%2BeXndRM1TybeSOfT4oQbuijdsy4IQo0md5fRYgZuXxHMIgy7obNB3OPf9szgbWTEWK6jNFhkQHIZXPSRxSM9L1a0RkarQk%2BxqTf96wTJL%2FUz6hSyImYjhtPvcOoBRejaQaK96HuWGe3At96%2BI6WjvJNEDM%2FjF9tosp2nbdhcGRitYmxREdv7M8AYM393MKT94BBrulr6tI504%2B0dDTH7IaojYc8SBAtu1TrUwinLA9zQ35Ney5Ry%2FMr7tNOLU1Ni3lkqNRWysEjWxEizM%2F1sK7u2fbAzx3kE%2BTRpyzmFv6gSiGHqjs5j%2FtG6daK7Hv6OvbHSWwV%2FpW6CKslJWFAsa5tVv%2BFw8cXdcMMyb6%2FCYTUtcFMgcF0hhtsd1g6YfnOWRGLcUxFe9odiayhMlstne%2FdqeyvQCjStrzOxUT5ta9L9JZifDkQ%3D%3D%20root%40pve%0A
-vmgenid: ebe24bf0-94b7-4ba5-a207-c709c360c2fa

shared/nodes/pve/qemu-server/105.conf

@@ -14,7 +14,7 @@ nameserver: 8.8.8.8 1.1.1.1
 net0: virtio=BC:24:11:67:1D:47,bridge=vmbr0
 onboot: 1
 ostype: l26
-scsi0: GoFlex:105/vm-105-disk-0.raw,discard=on,size=20G,ssd=1
+scsi0: SynologyLVM:vm-105-disk-0,discard=on,size=20G,ssd=1
 scsihw: virtio-scsi-pci
 smbios1: uuid=726b96f7-8643-4d68-a49a-fa971561d20d
 sshkeys: ssh-rsa%20AAAAB3NzaC1yc2EAAAADAQABAAACAQDNYf4z78s4%2BK4HoiUiHoqPbCCEFngCAXKP7mGwhCAc86TTbAosTpAnG1HycPzb2s2B3K3geQPUzQzcLvWdBX8hJM8IamvAZ%2FWXPtOszWTuVnaYM6BQY7ldIdXi3a%2BxscWr%2BM8dM6OexXqdCAy66HXmgl98%2BCg2uEbxCFelH81%2F5d3cuoCXllpvUawyYZe5UjFjPeBpPc%2FQyhDxG4ovYYpcCeHbzLXc9jIfawjwJTDcYfeXVHFisMdSUp0%2BeXndRM1TybeSOfT4oQbuijdsy4IQo0md5fRYgZuXxHMIgy7obNB3OPf9szgbWTEWK6jNFhkQHIZXPSRxSM9L1a0RkarQk%2BxqTf96wTJL%2FUz6hSyImYjhtPvcOoBRejaQaK96HuWGe3At96%2BI6WjvJNEDM%2FjF9tosp2nbdhcGRitYmxREdv7M8AYM393MKT94BBrulr6tI504%2B0dDTH7IaojYc8SBAtu1TrUwinLA9zQ35Ney5Ry%2FMr7tNOLU1Ni3lkqNRWysEjWxEizM%2F1sK7u2fbAzx3kE%2BTRpyzmFv6gSiGHqjs5j%2FtG6daK7Hv6OvbHSWwV%2FpW6CKslJWFAsa5tVv%2BFw8cXdcMMyb6%2FCYTUtcFMgcF0hhtsd1g6YfnOWRGLcUxFe9odiayhMlstne%2FdqeyvQCjStrzOxUT5ta9L9JZifDkQ%3D%3D%20root%40pve%0A

shared/nodes/pve/qemu-server/106.conf

@@ -3,23 +3,25 @@ boot: order=scsi0
 cicustom: vendor=local:snippets/jarvis-vendor.yml
 cipassword: $5$3l1elEQR$uF3zLlu1mHjuEHrGG8oi8i7J.K/7zl4GL1p/R6bUEV/
 ciuser: root
-cores: 4
+cores: 8
 cpu: host
 ide2: SynologyProx:106/vm-106-cloudinit.raw,media=cdrom
 ipconfig0: ip=10.48.200.210/24,gw=10.48.200.1
-memory: 8192
+memory: 32768
 meta: creation-qemu=11.0.0,ctime=1781725674
-name: Ollama-95
+name: Ollama-210
 nameserver: 8.8.8.8 1.1.1.1
 net0: virtio=BC:24:11:F6:ED:73,bridge=vmbr0
 onboot: 1
 ostype: l26
-scsi0: GoFlex:106/vm-106-disk-1.raw,discard=on,size=30G,ssd=1
+scsi0: SynologyLVM:vm-106-disk-0,discard=on,size=30G,ssd=1
 scsihw: virtio-scsi-pci
 searchdomain: local
 smbios1: uuid=7c666354-b26d-427c-9ce3-67023c547bb8
 sockets: 1
 sshkeys: ssh-rsa%20AAAAB3NzaC1yc2EAAAADAQABAAACAQDNYf4z78s4%2BK4HoiUiHoqPbCCEFngCAXKP7mGwhCAc86TTbAosTpAnG1HycPzb2s2B3K3geQPUzQzcLvWdBX8hJM8IamvAZ%2FWXPtOszWTuVnaYM6BQY7ldIdXi3a%2BxscWr%2BM8dM6OexXqdCAy66HXmgl98%2BCg2uEbxCFelH81%2F5d3cuoCXllpvUawyYZe5UjFjPeBpPc%2FQyhDxG4ovYYpcCeHbzLXc9jIfawjwJTDcYfeXVHFisMdSUp0%2BeXndRM1TybeSOfT4oQbuijdsy4IQo0md5fRYgZuXxHMIgy7obNB3OPf9szgbWTEWK6jNFhkQHIZXPSRxSM9L1a0RkarQk%2BxqTf96wTJL%2FUz6hSyImYjhtPvcOoBRejaQaK96HuWGe3At96%2BI6WjvJNEDM%2FjF9tosp2nbdhcGRitYmxREdv7M8AYM393MKT94BBrulr6tI504%2B0dDTH7IaojYc8SBAtu1TrUwinLA9zQ35Ney5Ry%2FMr7tNOLU1Ni3lkqNRWysEjWxEizM%2F1sK7u2fbAzx3kE%2BTRpyzmFv6gSiGHqjs5j%2FtG6daK7Hv6OvbHSWwV%2FpW6CKslJWFAsa5tVv%2BFw8cXdcMMyb6%2FCYTUtcFMgcF0hhtsd1g6YfnOWRGLcUxFe9odiayhMlstne%2FdqeyvQCjStrzOxUT5ta9L9JZifDkQ%3D%3D%20root%40pve%0A
-unused0: GoFlex:106/vm-106-disk-0.raw
 vga: std
 vmgenid: 25331e1a-8884-4b61-bd92-5297618596bb
+
+[special:cloudinit]
+name: Ollama-95

shared/nodes/pve/qemu-server/107.conf

@@ -1,18 +0,0 @@
-agent: 1,fstrim_cloned_disks=1
-boot: order=scsi0;ide2;net0
-cores: 2
-cpu: host
-ide2: none,media=cdrom
-machine: q35
-memory: 4096
-meta: creation-qemu=10.1.2,ctime=1775177879
-name: Claude-DHCP
-net0: virtio=BC:24:11:2D:C6:85,bridge=vmbr0,firewall=1
-numa: 0
-onboot: 1
-ostype: l26
-scsi0: GoFlex:107/vm-107-disk-0.raw,iothread=1,size=150G
-scsihw: virtio-scsi-single
-smbios1: uuid=b0b1c8aa-c799-4e2a-b393-748ed55cf6c0
-sockets: 2
-vmgenid: b2c71a5a-2356-43b9-b815-5acba58ac22f

shared/nodes/pve/qemu-server/109.conf

@@ -1,18 +1,18 @@
-agent: enabled=1
+agent: 0
 bios: ovmf
 boot: order=sata0
 cores: 4
 cpu: kvm64
-efidisk0: GoFlex:109/vm-109-disk-0.raw,efitype=4m,pre-enrolled-keys=0,size=528K
+efidisk0: SynologyLVM:vm-109-disk-1,efitype=4m,pre-enrolled-keys=0,size=4M
 machine: q35
-memory: 16384
+memory: 32768
 meta: creation-qemu=11.0.0,ctime=1782605900
 name: HomeAssistant-97
 net0: virtio=BC:24:11:A3:BD:26,bridge=vmbr0
 numa: 0
 onboot: 1
 ostype: l26
-sata0: GoFlex:109/vm-109-disk-1.qcow2,discard=on,size=32G,ssd=1
+sata0: SynologyLVM:vm-109-disk-0,discard=on,size=150G,ssd=1
 scsihw: virtio-scsi-pci
 smbios1: uuid=b0d7ba62-72df-4573-bcc4-fcfc5c9b24e8
 sockets: 2

shared/nodes/pve/qemu-server/112.conf

@@ -1,22 +0,0 @@
-agent: 1
-boot: order=scsi0
-cipassword: $5$XnJRY7/D$aqDdg7nCNwAoNv2qhwxbn4awlik1g3LslC3ckCxWCcD
-ciuser: root
-cores: 2
-ide2: GoFlex:112/vm-112-cloudinit.qcow2,media=cdrom
-ipconfig0: ip=10.48.200.33/24,gw=10.48.200.1
-machine: q35
-memory: 4096
-meta: creation-qemu=11.0.0,ctime=1782570362
-name: Jellyfin-33
-nameserver: 10.48.200.90
-net0: virtio=BC:24:11:B9:CD:D9,bridge=vmbr0
-onboot: 1
-ostype: l26
-scsi0: GoFlex:112/vm-112-disk-0.qcow2,discard=on,iothread=1,size=50G
-scsihw: virtio-scsi-single
-searchdomain: local
-smbios1: uuid=5bed9e81-9d6d-4195-8129-60ed9c44b6c5
-sockets: 2
-sshkeys: ssh-rsa%20AAAAB3NzaC1yc2EAAAADAQABAAACAQDNYf4z78s4%2BK4HoiUiHoqPbCCEFngCAXKP7mGwhCAc86TTbAosTpAnG1HycPzb2s2B3K3geQPUzQzcLvWdBX8hJM8IamvAZ%2FWXPtOszWTuVnaYM6BQY7ldIdXi3a%2BxscWr%2BM8dM6OexXqdCAy66HXmgl98%2BCg2uEbxCFelH81%2F5d3cuoCXllpvUawyYZe5UjFjPeBpPc%2FQyhDxG4ovYYpcCeHbzLXc9jIfawjwJTDcYfeXVHFisMdSUp0%2BeXndRM1TybeSOfT4oQbuijdsy4IQo0md5fRYgZuXxHMIgy7obNB3OPf9szgbWTEWK6jNFhkQHIZXPSRxSM9L1a0RkarQk%2BxqTf96wTJL%2FUz6hSyImYjhtPvcOoBRejaQaK96HuWGe3At96%2BI6WjvJNEDM%2FjF9tosp2nbdhcGRitYmxREdv7M8AYM393MKT94BBrulr6tI504%2B0dDTH7IaojYc8SBAtu1TrUwinLA9zQ35Ney5Ry%2FMr7tNOLU1Ni3lkqNRWysEjWxEizM%2F1sK7u2fbAzx3kE%2BTRpyzmFv6gSiGHqjs5j%2FtG6daK7Hv6OvbHSWwV%2FpW6CKslJWFAsa5tVv%2BFw8cXdcMMyb6%2FCYTUtcFMgcF0hhtsd1g6YfnOWRGLcUxFe9odiayhMlstne%2FdqeyvQCjStrzOxUT5ta9L9JZifDkQ%3D%3D%20root%40pve%0A
-vmgenid: 893ec4e4-8314-4546-8fce-1588e18b84ce

shared/nodes/pve/qemu-server/118.conf

@@ -2,20 +2,26 @@ agent: 1
 boot: order=scsi0
 cipassword: $5$NQ7B8hO2$gPudtAlk/B.29SOFizc4a.VleFYAieTK0VCuzpg660/
 ciuser: myron
-cores: 1
-ide2: GoFlex:118/vm-118-cloudinit.qcow2,media=cdrom
+cores: 2
+cpu: kvm64
+ide2: SynologyLVM:vm-118-cloudinit,media=cdrom,size=4M
 ipconfig0: ip=10.48.200.18/24,gw=10.48.200.1
 machine: q35
-memory: 1024
+memory: 4096
 meta: creation-qemu=11.0.0,ctime=1782570349
-name: HomeBridge-26
+name: HomeBridge-18
 nameserver: 10.48.200.90
 net0: virtio=BC:24:11:68:FA:DB,bridge=vmbr0
+numa: 0
 onboot: 1
 ostype: l26
-scsi0: GoFlex:118/vm-118-disk-0.qcow2,discard=on,iothread=1,size=20G
+scsi0: SynologyLVM:vm-118-disk-0,discard=on,iothread=1,size=20G
 scsihw: virtio-scsi-single
 searchdomain: local
 smbios1: uuid=c6c0a84a-6052-43fe-ade3-9ff137b94e59
+sockets: 1
 sshkeys: ssh-rsa%20AAAAB3NzaC1yc2EAAAADAQABAAACAQDNYf4z78s4%2BK4HoiUiHoqPbCCEFngCAXKP7mGwhCAc86TTbAosTpAnG1HycPzb2s2B3K3geQPUzQzcLvWdBX8hJM8IamvAZ%2FWXPtOszWTuVnaYM6BQY7ldIdXi3a%2BxscWr%2BM8dM6OexXqdCAy66HXmgl98%2BCg2uEbxCFelH81%2F5d3cuoCXllpvUawyYZe5UjFjPeBpPc%2FQyhDxG4ovYYpcCeHbzLXc9jIfawjwJTDcYfeXVHFisMdSUp0%2BeXndRM1TybeSOfT4oQbuijdsy4IQo0md5fRYgZuXxHMIgy7obNB3OPf9szgbWTEWK6jNFhkQHIZXPSRxSM9L1a0RkarQk%2BxqTf96wTJL%2FUz6hSyImYjhtPvcOoBRejaQaK96HuWGe3At96%2BI6WjvJNEDM%2FjF9tosp2nbdhcGRitYmxREdv7M8AYM393MKT94BBrulr6tI504%2B0dDTH7IaojYc8SBAtu1TrUwinLA9zQ35Ney5Ry%2FMr7tNOLU1Ni3lkqNRWysEjWxEizM%2F1sK7u2fbAzx3kE%2BTRpyzmFv6gSiGHqjs5j%2FtG6daK7Hv6OvbHSWwV%2FpW6CKslJWFAsa5tVv%2BFw8cXdcMMyb6%2FCYTUtcFMgcF0hhtsd1g6YfnOWRGLcUxFe9odiayhMlstne%2FdqeyvQCjStrzOxUT5ta9L9JZifDkQ%3D%3D%20root%40pve%0A
 vmgenid: e936e7a9-2e76-41d4-9abb-825e9a51df8d
+
+[special:cloudinit]
+name: HomeBridge-26

shared/nodes/pve/qemu-server/120.conf

@@ -5,7 +5,7 @@ cipassword: $5$PHfGFCU6$CXXrwjtXLw0wYmQVMhFnGIHOdS.t3x.dswMJJOWJ769
 ciuser: root
 cores: 4
 cpu: host
-efidisk0: local-lvm:vm-120-disk-0,size=4M
+efidisk0: SynologyLVM:vm-120-disk-1,size=4M
 ide2: local-lvm:vm-120-cloudinit,media=cdrom
 ipconfig0: ip=10.48.200.110/24,gw=10.48.200.1
 machine: q35
@@ -15,7 +15,7 @@ name: NovaCPX-110
 nameserver: 10.48.200.90
 net0: virtio=BC:24:11:18:2E:8B,bridge=vmbr0
 ostype: l26
-scsi0: local-lvm:vm-120-disk-1,discard=on,size=50G
+scsi0: SynologyLVM:vm-120-disk-0,discard=on,size=50G
 scsihw: virtio-scsi-pci
 smbios1: uuid=2d98fed4-0522-475c-b9a7-9e0f7dae8549
 sockets: 1

shared/nodes/pve/qemu-server/130.conf

@@ -0,0 +1,20 @@
+agent: enabled=1
+boot: order=scsi0
+cicustom: vendor=local:snippets/jarvis-vendor.yml
+cipassword: $5$fd1SkHUr$.vh02pJWxFGATr4fCYUH/OS3qUGZSRriwhi64E.Apo4
+ciuser: root
+cores: 4
+cpu: host
+ide2: SynologyLVM:vm-130-cloudinit,media=cdrom
+ipconfig0: ip=10.48.200.130/24,gw=10.48.200.1
+memory: 4096
+meta: creation-qemu=11.0.2,ctime=1783540984
+name: FusionPBX-130
+nameserver: 8.8.8.8 1.1.1.1
+net0: virtio=BC:24:11:CA:B9:3A,bridge=vmbr0
+onboot: 1
+ostype: l26
+scsi0: SynologyLVM:vm-130-disk-0,discard=on,size=40G,ssd=1
+scsihw: virtio-scsi-pci
+smbios1: uuid=b6428824-8c13-4139-8efb-8ce7c1670d9a
+vmgenid: 5ceae801-54fe-40a9-912c-182583a05b99

shared/nodes/pve/qemu-server/211.conf

@@ -4,19 +4,22 @@ cipassword: $5$deY08jA9$Jk3go7Gq6WM6CUTN6F2OXt16XjsgOJJoQZNZiEciTr7
 ciuser: root
 cores: 8
 cpu: host
-ide2: GoFlex:211/vm-211-cloudinit.qcow2,media=cdrom
+ide2: SynologyLVM:vm-211-cloudinit,media=cdrom,size=4M
 ipconfig0: ip=10.48.200.211/24,gw=10.48.200.1
 machine: q35
 memory: 16384
 meta: creation-qemu=11.0.0,ctime=1782570375
-name: JARVIS-211
+name: Jarvis-211
 nameserver: 10.48.200.90
 net0: virtio=BC:24:11:36:52:ED,bridge=vmbr0
 onboot: 1
 ostype: l26
-scsi0: GoFlex:211/vm-211-disk-0.qcow2,discard=on,size=50G,ssd=1
+scsi0: SynologyLVM:vm-211-disk-0,discard=on,size=50G,ssd=1
 scsihw: virtio-scsi-pci
 searchdomain: local
 smbios1: uuid=507ccb4f-d721-496a-adfa-5cf90479655e
 sshkeys: ssh-rsa%20AAAAB3NzaC1yc2EAAAADAQABAAACAQDNYf4z78s4%2BK4HoiUiHoqPbCCEFngCAXKP7mGwhCAc86TTbAosTpAnG1HycPzb2s2B3K3geQPUzQzcLvWdBX8hJM8IamvAZ%2FWXPtOszWTuVnaYM6BQY7ldIdXi3a%2BxscWr%2BM8dM6OexXqdCAy66HXmgl98%2BCg2uEbxCFelH81%2F5d3cuoCXllpvUawyYZe5UjFjPeBpPc%2FQyhDxG4ovYYpcCeHbzLXc9jIfawjwJTDcYfeXVHFisMdSUp0%2BeXndRM1TybeSOfT4oQbuijdsy4IQo0md5fRYgZuXxHMIgy7obNB3OPf9szgbWTEWK6jNFhkQHIZXPSRxSM9L1a0RkarQk%2BxqTf96wTJL%2FUz6hSyImYjhtPvcOoBRejaQaK96HuWGe3At96%2BI6WjvJNEDM%2FjF9tosp2nbdhcGRitYmxREdv7M8AYM393MKT94BBrulr6tI504%2B0dDTH7IaojYc8SBAtu1TrUwinLA9zQ35Ney5Ry%2FMr7tNOLU1Ni3lkqNRWysEjWxEizM%2F1sK7u2fbAzx3kE%2BTRpyzmFv6gSiGHqjs5j%2FtG6daK7Hv6OvbHSWwV%2FpW6CKslJWFAsa5tVv%2BFw8cXdcMMyb6%2FCYTUtcFMgcF0hhtsd1g6YfnOWRGLcUxFe9odiayhMlstne%2FdqeyvQCjStrzOxUT5ta9L9JZifDkQ%3D%3D%20root%40pve%0A
 vmgenid: b67913ee-9569-49c9-8980-b4b165d68b52
+
+[special:cloudinit]
+name: JARVIS-211

shared/storage.cfg

@@ -1,26 +1,18 @@
 dir: local
 	path /var/lib/vz
-	content vztmpl,snippets,iso,rootdir,backup,images
+	content iso,images,rootdir,snippets,backup,vztmpl
 	shared 0
 
 lvmthin: local-lvm
 	thinpool data
 	vgname pve
-	content rootdir,images
-
-dir: GoFlex
-	path /mnt/goflex
-	content snippets,rootdir,vztmpl,images
-	nodes pve
-	prune-backups keep-all=1
-	shared 1
-	snapshot-as-volume-chain 1
+	content images,rootdir
 
 cifs: SynologyProx
 	path /mnt/pve/SynologyProx
 	server 10.48.200.249
 	share homes
-	content snippets,iso,rootdir,backup,images,import,vztmpl
+	content iso,import,rootdir,images,snippets,backup,vztmpl
 	prune-backups keep-all=1
 	snapshot-as-volume-chain 1
 	subdir /NAS/ProxMoxBackups

shared/user.cfg

@@ -1,6 +1,6 @@
 user:pveb@pam:1:0::::::
 user:root@pam:1:0:::myronblair@outlook.com:::
-token:root@pam!homeassistant:0:0::
+token:root@pam!hoa:0:1::
 token:root@pam!jarvis:0:0:Jarvis Monitoring:
 token:root@pam!pdm-admin-pdm:0:0:auto-generated by PDM host 'pdm' on Wed, 11 Feb 2026 07%3A18%3A36 -0600:
 token:root@pam!pdm-admin-pve35:0:0:auto-generated by PDM host 'pdm' on Wed, 18 Mar 2026 09%3A22%3A08 -0500:

vm-configs/fstab/jarvis.fstab

@@ -0,0 +1,4 @@
+LABEL=cloudimg-rootfs	/	 ext4	discard,commit=30,errors=remount-ro	0 1
+LABEL=BOOT	/boot	ext4	defaults	0 2
+LABEL=UEFI	/boot/efi	vfat	umask=0077	0 1
+//10.48.200.249/Storage /mnt/nas-backups cifs credentials=/etc/nas-creds/msp360,uid=0,gid=0,file_mode=0700,dir_mode=0700,_netdev 0 0

vm-configs/fstab/jellyfin.fstab

@@ -0,0 +1,6 @@
+LABEL=cloudimg-rootfs	/	 ext4	discard,commit=30,errors=remount-ro	0 1
+LABEL=BOOT	/boot	ext4	defaults	0 2
+LABEL=UEFI	/boot/efi	vfat	umask=0077	0 1
+10.48.200.35:/media/movies /mnt/mediastack/movies nfs defaults,_netdev 0 0
+10.48.200.35:/media/tv /mnt/mediastack/tv nfs defaults,_netdev 0 0
+//10.48.200.249/Storage /mnt/nas-backups cifs credentials=/etc/nas-creds/msp360,uid=0,gid=0,file_mode=0700,dir_mode=0700,_netdev 0 0

vm-configs/fstab/mediastack.fstab

@@ -0,0 +1,7 @@
+LABEL=cloudimg-rootfs	/	 ext4	discard,commit=30,errors=remount-ro	0 1
+LABEL=BOOT	/boot	ext4	defaults	0 2
+LABEL=UEFI	/boot/efi	vfat	umask=0077	0 1
+10.48.200.249:/volume1/video /mnt/nas/video nfs defaults,_netdev 0 0
+/mnt/nas/video/movies /media/movies none bind 0 0
+/mnt/nas/video/tv /media/tv none bind 0 0
+//10.48.200.249/Storage /mnt/nas-backups cifs credentials=/etc/nas-creds/msp360,uid=0,gid=0,file_mode=0700,dir_mode=0700,_netdev 0 0

vm-configs/fstab/novacpx.fstab

@@ -0,0 +1,4 @@
+LABEL=cloudimg-rootfs	/	 ext4	discard,commit=30,errors=remount-ro	0 1
+LABEL=BOOT	/boot	ext4	defaults	0 2
+LABEL=UEFI	/boot/efi	vfat	umask=0077	0 1
+//10.48.200.249/Storage /mnt/nas-backups cifs credentials=/etc/nas-creds/msp360,uid=0,gid=0,file_mode=0700,dir_mode=0700,_netdev 0 0

vm-configs/fstab/npm.fstab

@@ -0,0 +1,4 @@
+LABEL=cloudimg-rootfs	/	 ext4	discard,commit=30,errors=remount-ro	0 1
+LABEL=BOOT	/boot	ext4	defaults	0 2
+LABEL=UEFI	/boot/efi	vfat	umask=0077	0 1
+//10.48.200.249/Storage /mnt/nas-backups cifs credentials=/etc/nas-creds/msp360,uid=0,gid=0,file_mode=0700,dir_mode=0700,_netdev 0 0

vm-configs/network-reference.md

@@ -0,0 +1,66 @@
+# VM Network Reference
+Updated: 2026-06-30
+
+## Subnet: 10.48.200.0/24 (Internal LAN via FortiGate)
+
+| VM/CT           | VMID | IP              | Role                          | Host  |
+|-----------------|------|-----------------|-------------------------------|-------|
+| PVE1 (baremetal)| —    | 10.48.200.90    | Proxmox hypervisor            | —     |
+| PVE2 (baremetal)| —    | 10.48.200.91    | Proxmox hypervisor (offline)  | —     |
+| NPM             | 101  | 10.48.200.200   | Nginx Proxy Manager           | PVE1  |
+| NovaCPX         | 120  | 10.48.200.110   | web.orbishosting.com (Apache) | PVE1  |
+| JARVIS          | 200  | 10.48.200.211   | Home automation / agent host  | PVE1  |
+| Homebridge      | 103  | 10.48.200.18    | Homebridge (SSH: myron only)  | PVE1  |
+| Jellyfin        | 104  | 10.48.200.33    | Jellyfin media server         | PVE1  |
+| MediaStack      | 105  | 10.48.200.35    | Sonarr/Radarr/Prowlarr/qBit   | PVE1  |
+| WireGuard CT    | 110  | 10.48.200.67    | VPN kill-switch for MediaStack| PVE1  |
+| Ollama          | 106  | 10.48.200.210   | Ollama LLM server (offline)   | PVE1  |
+| NetworkBackup   | 302  | 10.48.200.99    | Network backup (offline)      | PVE1  |
+| NAS (Synology)  | —    | 10.48.200.249   | File storage                  | —     |
+
+## External Servers
+
+| Server       | IP              | Role                     |
+|--------------|-----------------|--------------------------|
+| FortiGate WAN| 97.154.207.5    | Internet gateway (Verizon)|
+| DO server    | 165.22.1.228    | DigitalOcean VPS         |
+| FusionPBX    | 134.209.72.226  | VoIP server              |
+
+## NAS Storage (10.48.200.249 — Synology)
+
+| Share        | Protocol | Mount point (on client)     | Used by         |
+|--------------|----------|-----------------------------|-----------------|
+| /volume1/video| NFS     | /mnt/nas/video              | MediaStack      |
+| /volume1/video/movies | NFS | /media/movies            | MediaStack      |
+| /volume1/video/tv | NFS | /media/tv                  | MediaStack      |
+| /media/movies | NFS (re-export) | /mnt/mediastack/movies | Jellyfin     |
+| /media/tv    | NFS (re-export) | /mnt/mediastack/tv      | Jellyfin        |
+| Storage/MSPBackups | CIFS | /mnt/nas-backups         | All VMs (MSP360)|
+| homes        | CIFS    | (unused)                    | —               |
+
+NAS CIFS credentials: /etc/nas-creds/msp360 (username=nas) on each VM
+
+## WireGuard VPN Subnet: 10.200.0.0/24
+
+| Host           | WG IP       | Role                    |
+|----------------|-------------|-------------------------|
+| WireGuard CT   | 10.200.0.1  | Gateway (NordVPN relay) |
+| Jellyfin       | 10.200.0.3  | NFS client              |
+| MediaStack     | 10.200.0.4  | Kill-switch client      |
+
+NordVPN exit node: 2.56.190.69 (Clouvider UK, AS62240)
+NordVPN WireGuard endpoint: 2.56.190.66:51820
+
+## NPM Proxy (10.48.200.200)
+Reverse proxies HTTPS from FortiGate WAN → internal services.
+All certs via Let's Encrypt. Admin panel: http://10.48.200.200:81
+
+## MediaStack Services
+
+| Service     | Port  | URL                               |
+|-------------|-------|-----------------------------------|
+| qBittorrent | 8080  | http://10.48.200.35:8080          |
+| Sonarr      | 8989  | http://10.48.200.35:8989          |
+| Radarr      | 7878  | http://10.48.200.35:7878          |
+| Prowlarr    | 9696  | http://10.48.200.35:9696          |
+| Jellyfin    | 8096  | http://10.48.200.33:8096          |

wireguard/mediastack-wg0.conf

@@ -0,0 +1,17 @@
+# MediaStack (10.48.200.35) WireGuard client config
+# Tunnels all internet traffic through WireGuard CT (10.48.200.67)
+# Kill-switch: iptables blocks any non-WireGuard internet traffic
+# File: /etc/wireguard/wg0.conf
+
+[Interface]
+PrivateKey = UAaoNldLsxWJerLJAjGlncrm41Ay9QMsK3O1XaTlxmg=
+Address = 10.200.0.4/24
+DNS = 10.48.200.90
+PostUp = iptables -I OUTPUT ! -o wg0 -m mark ! --mark 51820 -m addrtype ! --dst-type LOCAL -j REJECT; iptables -I OUTPUT -d 10.48.200.0/24 -j ACCEPT
+PostDown = iptables -D OUTPUT -d 10.48.200.0/24 -j ACCEPT; iptables -D OUTPUT ! -o wg0 -m mark ! --mark 51820 -m addrtype ! --dst-type LOCAL -j REJECT
+
+[Peer]
+PublicKey = Fqb1KLfHe1r3+Hwhem7YGZB2KikGYy/8pPsOIP4rn18=
+Endpoint = 10.48.200.67:51821
+AllowedIPs = 0.0.0.0/0
+PersistentKeepalive = 25

wireguard/mediastack-wg1.conf

@@ -0,0 +1,16 @@
+# MediaStack (10.48.200.35) WireGuard server config (for Jellyfin peer)
+# Serves as internal VPN hub for Jellyfin to reach MediaStack NFS exports
+# File: /etc/wireguard/wg1.conf
+
+[Interface]
+PrivateKey = UPTGveBLFZLGcimi80npmrEB3tOfE8GjQEl4aTPOWV0=
+Address = 10.200.0.1/24
+ListenPort = 51820
+PostUp   = sysctl -w net.ipv4.ip_forward=1; iptables -A FORWARD -i wg1 -o nordlynx -j ACCEPT; iptables -A FORWARD -i nordlynx -o wg1 -m state --state RELATED,ESTABLISHED -j ACCEPT; iptables -t nat -A POSTROUTING -o nordlynx -s 10.200.0.0/24 -j MASQUERADE
+PostDown = iptables -D FORWARD -i wg1 -o nordlynx -j ACCEPT; iptables -D FORWARD -i nordlynx -o wg1 -m state --state RELATED,ESTABLISHED -j ACCEPT; iptables -t nat -D POSTROUTING -o nordlynx -s 10.200.0.0/24 -j MASQUERADE
+
+[Peer]
+# Jellyfin
+PublicKey = T+mr/+Z+9F0FXG/8AxJClH7kgxvqFVeSouJQo2+D82M=
+AllowedIPs = 10.200.0.3/32
+PersistentKeepalive = 25

wireguard/wgct-nord0.conf

@@ -0,0 +1,17 @@
+# WireGuard CT (LXC 110, 10.48.200.67) NordVPN tunnel config
+# Connects to NordVPN server at 2.56.190.66:51820 (Clouvider UK)
+# Policy routes 10.200.0.0/24 (MediaStack tunnel clients) through NordVPN
+# File: /etc/wireguard/nord0.conf
+
+[Interface]
+PrivateKey = Ebk+g1cMK14ured/u+QLvHPYxmoh9dCmeq65qbS/Aqg=
+Address = 10.5.0.2/32
+Table = off
+PostUp = sysctl -w net.ipv4.conf.all.rp_filter=0 || true; ip route add default dev nord0 table 201 || true; ip rule add from 10.200.0.0/24 lookup 201 prio 100 || true; iptables -t nat -A POSTROUTING -o nord0 -j MASQUERADE || true
+PostDown = ip route del default dev nord0 table 201 2>/dev/null; ip rule del from 10.200.0.0/24 lookup 201 2>/dev/null; iptables -t nat -D POSTROUTING -o nord0 -j MASQUERADE 2>/dev/null
+
+[Peer]
+PublicKey = 8pRFH/FfMBs3eBJCM2ABFoOs/13n78LYQvoovZVLdgI=
+Endpoint = 2.56.190.66:51820
+AllowedIPs = 0.0.0.0/0
+PersistentKeepalive = 25

wireguard/wgct-wg-clients.conf

@@ -0,0 +1,15 @@
+# WireGuard CT (LXC 110, 10.48.200.67) client-server config
+# Accepts connections from MediaStack and Jellyfin
+# File: /etc/wireguard/wg-clients.conf
+
+[Interface]
+Address = 10.200.0.1/24
+ListenPort = 51821
+PrivateKey = uMdYzpGScR4D8cIm7WNbTJ5KHZQGAIFUInMI+4MZjkU=
+PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; sysctl -w net.ipv4.ip_forward=1
+PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
+
+[Peer]
+# MediaStack (10.48.200.35)
+PublicKey = CaG79S1fJeJDlYCMhHz8BrDfizBq+OiGnO5VzFIk3gE=
+AllowedIPs = 10.200.0.4/32