From a7cd997c2b4b31c09426e4f379960d0273ab17fa Mon Sep 17 00:00:00 2001 From: Garrett Allen <98648590+Gerrrt@users.noreply.github.com> Date: Sat, 19 Sep 2026 04:49:10 +0000 Subject: [PATCH] docs(nas): the transcode passed, ADR-0040's condition is closed, and the share is television-only (#413) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Read off the ffmpeg command line Jellyfin logged, not off the dashboard: libva opened the iHD driver, -hwaccel vaapi decoded the input, scale_vaapi shrank it on the GPU and h264_qsv encoded it — 300 frames of 1080p to 540p in 0.76 s. That is the half of ADR-0040's reopen condition a shell could not check, and it closes it. Decision 2 stands and the stack stays on this host; hardware.md, roadmap.md and the media README stop calling it untested. Found on the way: no workstation can mount the share. Hicks passes 443 and 8096 to smaug and SMB is 445, so the test clip went in over the console with curl. §5 records it and #523 tracks it. §7 also carries the post-deploy re-reads: up=1 in Prometheus, the tripwire at 143,780 evaluations and 0 packets, the four passes still above the block. Refs #413 #138 #523 Co-Authored-By: Claude Fable 5.1 --- docs/hardware.md | 6 ++++-- docs/roadmap.md | 7 ++++--- docs/runbooks/build-the-nas.md | 32 +++++++++++++++++++++++++++----- stacks/media/README.md | 14 ++++++++------ 4 files changed, 43 insertions(+), 16 deletions(-) diff --git a/docs/hardware.md b/docs/hardware.md index 3d14cd42..6fde4af3 100644 --- a/docs/hardware.md +++ b/docs/hardware.md @@ -204,8 +204,10 @@ revisions of this repository treated `shiva` as the hypervisor itself. `MJ05N4NK`. Xeon E3-1225 v6 at 3.30 GHz, four cores, and `Active Video: IGD` — so the P630 this box was chosen for is live, which is the hardware half of [ADR-0040](adr/0040-run-truenas-on-smaug-and-keep-the-media-stack-in-this-repository.md)'s - reopen condition and not the whole of it; whether Quick Sync reaches a - container is still untested. 8192 MB at 2133 MHz, which is **one** Samsung + reopen condition and not the whole of it; **whether Quick Sync reaches a + container was tested on 2026-09-19 and it does** — a hardware decode, + scale and `h264_qsv` encode inside the Jellyfin container, per + [`build-the-nas.md`](runbooks/build-the-nas.md) §6.1. 8192 MB at 2133 MHz, which is **one** Samsung `M391A1G43EB1-CPBQ` — 8 GB 2Rx8 PC4-2133P, ECC unbuffered, date code 1728 — in one of four slots. More memory is therefore an add and not a replace, and the part to match is ECC **unbuffered**: a registered DIMM will not run on diff --git a/docs/roadmap.md b/docs/roadmap.md index 1601790a..ac2026d1 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -803,9 +803,10 @@ what left this one unfireable for months. drives landed 2026-09-18**, both at zero hours by the FARM log and not only by SMART, and the rest followed: the mirror `erebor`, its two datasets, the household share `media`, and the stack running under TrueNAS's Docker with - the scrape live on 2026-09-19. Of ADR-0040's reopen condition, the render - node reaches the container and the process carries the render group; the - transcode itself is the half still unrun. + the scrape live on 2026-09-19. **ADR-0040's reopen condition is closed**: + the render node reaches the container, the process carries the render + group, and a forced transcode ran through VAAPI and `h264_qsv` at about + five times real time the same day. The stack stays on this host. Reading the enforced ruleset first changed two of the answers, and both were borne out when the rules were created. **50→40 is not simply a rule to add**: Hicks and Winterfell each carry an explicit *Block access to diff --git a/docs/runbooks/build-the-nas.md b/docs/runbooks/build-the-nas.md index 94917fcb..7e64e38d 100644 --- a/docs/runbooks/build-the-nas.md +++ b/docs/runbooks/build-the-nas.md @@ -466,6 +466,17 @@ compression stays on and costs nothing on already-compressed media. > which is nobody's group and not `builtin_users` — so one entry was added: > `everyone@`, Allow, Basic Read, Inherit. The list now has five entries, the > four the preset wrote and that one. +> +> **No workstation can mount this share, and that was found by trying.** The +> Hicks rules from §0.5 pass `443` and `8096` to `smaug` and nothing else; +> SMB is `445`, so a Hicks machine that reaches the TrueNAS UI and Jellyfin +> gets nothing from `\\10.0.40.30\media`. Only devices already on +> CasaBonita can mount it, and those are televisions. Getting a film onto the +> library today means the console shell — `mkdir` and `curl` under +> `/mnt/erebor/media/` — which is how the test clip in §6.1 arrived. Whether +> the answer is a fifth Hicks rule on `445` or something else is +> [#523](https://github.com/Gerrrt/HomeLab/issues/523)'s; it is recorded +> here because the share exists and looks usable and is not. **Shares → Windows (SMB) → Add**, pointed at `erebor/media`. @@ -561,8 +572,16 @@ minutes: no restart, no deploy, no `--force-recreate`. > target was uncommented the same morning. Inside the container: > `renderD128` listed as `root 107` and `id` read > `uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup),107` — both -> halves of the check below that a shell can make. The transcode is the one -> it cannot, and is still to run. +> halves of the check below that a shell can make. **The transcode passed +> the same day**, read off the ffmpeg command line Jellyfin logged rather +> than off the dashboard, which hides the answer behind a hover: libva +> opened the `iHD` driver, the input was decoded with `-hwaccel vaapi`, +> scaled on the GPU with `scale_vaapi`, and encoded by **`h264_qsv`** — +> 300 frames of 1080p to 540p in 0.76 s, about five times real time, on a +> 10-second Big Buck Bunny clip played at a forced 480p. **ADR-0040's +> reopen condition is closed and decision 2 stands.** The log is +> `/config/log/FFmpeg.Transcode-*.log` inside the container; `docker top +> media-jellyfin` shows the same line while a stream is running. Expect **no** `node_network_*` series from this host. Those collectors are disabled on purpose, because a bridged container reads its own veth and would @@ -599,9 +618,12 @@ measurement. ## §7 — Verify > **As of 2026-09-19:** the monitoring-host line holds in both halves, the -> device checks hold, and `zpool status erebor` is `ONLINE` with no errors. -> **Not yet read:** a television playing, the QSV transcode, the two extended -> self-tests, and the post-deploy re-reads of the tripwire and port 15. +> QSV transcode passed (§6.1), `zpool status erebor` is `ONLINE` with no +> errors, `up{job="node",instance="smaug"}` reads 1, and the tripwire and +> the rule order were re-read from `morpheus` after the stack came up: +> 143,780 evaluations, **0 packets**, all four passes still above the block. +> **Not yet read:** a television playing, the two extended self-tests, and +> port 15 in the switch UI. - A television on CasaBonita finds Jellyfin and plays something **without** any firewall rule being involved diff --git a/stacks/media/README.md b/stacks/media/README.md index 47e76c0b..541be939 100644 --- a/stacks/media/README.md +++ b/stacks/media/README.md @@ -134,7 +134,7 @@ Every non-obvious line in `compose.yaml` came off the pinned image on is a restart loop. - **65 MiB idle RSS**, which is what the 2 GiB ceiling is a ceiling over. -## The check that is half done +## The check that passed [ADR-0040] keeps the media stack in this repository on the strength of Quick Sync working, and names its own reopen condition: **the iGPU reaching a @@ -144,11 +144,13 @@ different claims. `devices: /dev/dri` and `RENDER_GID` are where the second claim is made; [`build-the-nas.md`] §6 is where it gets tested, **before the library exists**, because moving a populated library is a weekend. -**On 2026-09-19 the shell half passed**: `renderD128` is listed inside the -container as `root 107`, and `id` there reads -`groups=65534(nogroup),107`. What that does not prove is a transcode, which -is a claim only Jellyfin's playback settings and a played file can make, and -that is the half still open. +**On 2026-09-19 both halves passed.** `renderD128` is listed inside the +container as `root 107`, `id` there reads `groups=65534(nogroup),107`, and +a 1080p clip played at a forced 480p was decoded with `-hwaccel vaapi` on +the `iHD` driver, scaled by `scale_vaapi` and encoded by `h264_qsv` at about +five times real time — read off the ffmpeg command line in +`/config/log/FFmpeg.Transcode-*.log`, not off the dashboard. [ADR-0040]'s +reopen condition is closed; the stack stays here. [ADR-0008]: ../../docs/adr/0008-place-services-by-data-trust.md [ADR-0012]: ../../docs/adr/0012-publish-only-ports-with-an-off-host-consumer.md