Replace single llama-server with llama-swap so all benchmarked models are
selectable from Hermes' menu and hot-swapped on the one P100. Menu: gpt-oss-20b
(default, ~45s cold start), gemma-4-26b-a4b (MoE), gemma-4-12b, gemma-4-e4b.
qwen3-30b-a3b excluded (OOMs at 64k in 16GB). All 64k, q8/q8 KV, --parallel 1.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The q4_0 V-cache + flash-attention path is pathological on the GP100: 1.28
tok/s generation at 5-8% GPU util. q8_0 V-cache gives 9.2 tok/s and still fits
64k context in 16GB (15.3GB used, ~950MB free).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
llama-server caps the slot to the GGUF training context (32768) and ignores the
YaRN-extended size, leaving per-seq context at 32k. Raise qwen2.context_length
metadata to 65536 so the full window is served per request.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
With the default 4 slots, llama-server splits ctx into 32k per sequence, which
fails Hermes' 64K minimum. One slot serves the full 65536 per request (serial
agent use; concurrent calls queue).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Hermes Agent rejects models with <64K context. Qwen2.5-14B is 32k native, so
enable YaRN rope-scaling (2x → 65536) and drop the V-cache to q4_0 for VRAM
headroom on the 16GB P100.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The server-cuda image parses -fa as --flash-attn [on|off|auto], so a bare -fa
swallowed the following --cache-type-k as its value and crash-looped.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
New stacks/llm/ serves Qwen2.5-14B-Instruct (Q4_K_M GGUF) via llama.cpp's
OpenAI-compatible server on the Tesla P100 (CDI nvidia.com/gpu=0), published on
172.20.0.1:8090 for the host-side Hermes agent. vLLM was rejected: the P100
(cc 6.0) lacks the DP4A INT8 instructions its AWQ/GPTQ kernels need.
Includes design spec and implementation plan under docs/superpowers/.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
SameSite=Strict caused Safari and Firefox to drop the freshly-set cookie on
the immediate same-site redirect when the top-level navigation originated
from an external app (Discord). SameSite=Lax explicitly permits the cookie
on same-site redirects regardless of the initiating context.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
{env.SHARE_KEY} is not resolved by Caddy's query matcher or CEL expression at
request time — the literal placeholder string was compared against the URL key,
causing every external request to fall through to 403. {$SHARE_KEY} is
substituted by the Caddyfile adapter at reload/start, baking the literal key
value into the compiled config.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
sonarr/radarr/prowlarr/whisparr/bazarr were hitting the default Docker
nofile limit of 1024, causing EMFILE errors and excessive virtiofsd FD
churn on the /storage1 virtiofs mount.
Capability-URL snippet: external users visit ?k=SHARE_KEY once, Caddy
sets a 30-day HttpOnly cookie and redirects to the clean path. Subsequent
visits check the cookie only. Internal IPs and tailnet pass through
unconditionally. Applied to roms.ginnoir.com and romhacks.ginnoir.com.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The previous commit used `hbbs -R 192.168.1.69` (uppercase -R sets
rendezvous/cluster servers), so hbbs advertised an empty relay list and
clients failed with "failed to connect to relay server". Lowercase -r is
the relay-server flag; hbbs now advertises 192.168.1.69 and LAN clients
relay correctly.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The save-sync (/api/sync/*) and raw content_hash fixes that forced the
beta pin shipped in stable 4.9.x (now 4.9.2). Return to the watchtower-
tracked :4 tag per the original design.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
R510 -> R730XD/Proxmox migration helpers (consistent DB dumps, B2/Kopia snapshot refresh, cutover final backup) plus the previously-untracked gitea-portainer-registry cutover plan under docs/.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
grant_types must be set explicitly ([] = all auth rejected). Scope PKs
were truncated placeholders — replaced with actual UUIDs from this
Authentik instance. Signing key was already correct.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Switch files.ginnoir.com from ownCloud to Nextcloud (internal-only).
Fix Authentik scope PKs in CLAUDE.md — the last UUID segments were
wrong and would have caused provider creation failures.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replaces ownCloud with Nextcloud (postgres + redis) and adds OnlyOffice
Document Server for Google Docs-style editing. Migration is staged:
nextcloud.ginnoir.com for testing, files.ginnoir.com still points at
ownCloud until cutover is verified.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Pattern A (native OAuth2) is preferred — create provider + app in
Authentik, configure service with discovery URL. Pattern B (Caddy
forward_auth) is the fallback for services with no native auth.
Reusable Authentik flow/scope PKs pinned so they don't need re-deriving.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
New services: all in except TB-020 Mealie (deferred to famapp).
Active interest: TB-015 Vault, TB-027 Jellyfin, TB-028 HA, TB-031 Pingvin.
Dropped: TB-017 MinIO consolidation, TB-018 Plane, TB-029 Firefly III,
TB-030 AdGuard (handled at router), TB-032 Wiki.js (using BookStack).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Image moved from ghcr.io/jorenn92/maintainerr to ghcr.io/maintainerr/maintainerr
with the v3.x release series. v3 runs its own DB migrations on startup.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace sctx/overseerr:latest with ghcr.io/seerr-team/seerr:latest.
Same port (5055), same config volume (/config/overseerr:/app/config) —
Seerr auto-migrates the DB on first boot. Add init: true as required.
Rename container overseerr → seerr; update Caddy upstream to match.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Mount /config/maintainerr to /opt/data (actual DB location, not /opt/maintainerr/data)
- Add NODE_TLS_REJECT_UNAUTHORIZED=0 so Node.js accepts Plex's self-signed cert
- Mark TB-007/008/009/012/013/016 tasks as done/dropped in improvement plan
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Switch CLAUDE.md and AGENTS.md to Gitea-primary language. Remove
github-runner from the management plane now that Gitea Actions handles
Caddy reloads and famapp builds. Disable GitHub deploy workflow.
Update apply-compose.ps1 status text.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Switch famapp container from ghcr.io/ginnoir/famapp:latest to
registry.ginnoir.com/ginnoir/famapp:latest.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Portainer go-git resolves gitea.ginnoir.com inside Docker. Alias was on
the gitea container → port 443 refused. Moved alias to Caddy so go-git
reaches Caddy:443 (TLS ok) → proxies to gitea:3000.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
