# albok-service moved to its own VM: nh3-albok (VM 110 on nh3-pve-2)

`[2026-10-04]` **albok-service moved off nh3-docker onto nh3-albok, a VM that runs nothing else** (albok-dev relaying
Prime ~2235; built and cut over by infra-ops 2311–2332). → `servers/nh3-albok/README.md`, `stacks/albok-service/README.md`

**Why.** Unit 4 will ingest the operator's personal vault (~7,600 notes) and licensed books into restricted wings. On
nh3-docker, four things were root over `/srv/albok`: portainer, portainer_agent and dockge (socket rw), and dockerd on
plaintext **tcp/2375** for Homepage. albok-dev's list named the three containers; the 2375 exposure was found during
this work and is the bigger one, since any LAN host can reach it. Memory too: 2.4 of a 4 GiB cap on a 7.7 GiB host shared with the post office
and AdGuard.

**What was built.**
- nh3-pve-2 `vmbr0` made VLAN-aware (`playbooks/nh3-pve-2-vmbr0-vlan-aware.yaml`), applied by a **reboot at 2311 with no
  guests**, never a live ifreload (the 10-03 lesson). AMT port came back up at 1 Gb.
- VM 110 `nh3-albok`, 10.100.50.44 on VLAN 50, Debian 13 genericcloud + cloud-init, 4 vCPU x86-64-v3 / 12 GiB / 100 GB
  vmstore (`playbooks/nh3-albok-vm.yaml`). `vh` 1000 via cloud-init → infra-ops 850 bootstrapped as vh → the bootstrap
  key taken back off vh (`playbooks/nh3-albok-host.yaml`). Docker 29.8 with `docker` pinned at 851 before install.
- **Deliberately single-tenant:** no socket containers, no `-H tcp://`, so Homepage cannot discover it. The Albok tile is a static
  `services.yaml` entry; it hot-reloaded without a container recreate. `mem_limit` 4g → 8g.
- PBS: nh3-pve-2 got storage `pbs-ana` (namespace **`nh3-pve-2`**, created on pbs-ana) and a 21:30 `all 1` vzdump job.
  pbs-nh3's sync is root-namespace recursive, so the DR mirror needed nothing. The `root@pam!fleet-vzdump` secret is
  now vaulted as `pbs-ana/fleet-vzdump-token`. albok-dev asked for "a PBS job on pbs-nh3"; the pbs-ana job keeps the fleet
  pattern and keeps an off-site copy, and they were told why.

**Cutover (2330–2332, ~2.5 min down).** Container removed on nh3-docker and its `compose.yaml` renamed
`compose.yaml.moved-to-nh3-albok-2026-10-04` (a stray `up` there would be a second writer on a stale copy, i.e. split
brain). One `tar --format=posix --numeric-owner` stream under `sudo /usr/bin/tar` (BULK_DATA, so nothing is recorded).
Verified by digests only, so no restricted path was printed: 166,305 entries each side, contents identical, and owner/group/
mode/mtime/type identical. ⚠ **A full-manifest digest that includes `%s` will MISMATCH on directories**: ext4 directory
st_size reflects blocks once allocated, so it is not data. Split the manifest by field before deciding a copy is bad.
New host healthy at 2331:25: 4 wings ready, drift 0, needs_reindex 0, so no reindex was needed. Then DNS moved.

**CLOSED 2026-10-05 0021.** Acceptance passed at 0018 (albok-check at 2350 and 0018; the Nemi walk 0003–0016 exited 0. Its 1,187
updates were the restamped source_commit from memory commits, not the move). The old `/srv/albok` (1.4 G) was deleted at 0018.
First VM 110 backup 0019–0021 to pbs-ana ns nh3-pve-2. The albok user/groups on nh3-docker remain, unused.

**Was open (as of 2332):** albok-dev's acceptance (albok-check + one Nemi walk); the first manual PBS backup of VM
110 after acceptance; deleting the old `/srv/albok` on nh3-docker. **Prime approved the deletion directly at 2349,
conditional on albok-dev's acceptance passing** (it cannot be undone, so it needed his word, not the relay). Until then it
sits under the same 2375 exposure as before, with nothing reading it. Delete with literal paths only, and leave the renamed
compose file as the tombstone.