vh
32349b7653
Rewrites the in-flight section, which had gone stale in one place (speaches is stopped, not live) and did not reflect a session in which everything opened was also closed. Three detail files carry the bulk: the FortiGate's public surface reduced to nothing including the ACME listener, Scriberr's deployment and the three upstream defects it required working around, and the ESH DNS repair that also made the IPv6 naming scheme real on three hosts. The tunnel entry in the decisions log described a cipher change as proposed and pending; it has since been attempted, found impossible in the form intended, and resolved differently, so the line now points at the outcome rather than the intention. New decisions cover the cipher adoption and the finding that the per-flow ceiling belongs to the UniFi gateway's software cipher rather than the firewall, the administrative closure, the transcription deployment, the DNS repair, the retirement of an ASR service whose only consumer was abandoned, and a database VM that until now had no fleet identity and no vaulted credential at all. Three approaches are recorded as abandoned: an AEAD cipher the far end cannot express, an upstream DNS setting the gateway accepts and ignores, and a scheme to claim unused delegated prefixes that founders not on the prefixes but on having to rebuild a firewall policy to use them.
47 lines
2.5 KiB
Markdown
47 lines
2.5 KiB
Markdown
# [2026-08-24] Scriberr transcription deployed on ana-ml2, GPU1
|
||
|
||
Self-hosted audio/video transcription + diarization. Operator chose GPU
|
||
placement over ana-docker (8 cores shared with 50 containers, 37 GB disk)
|
||
against ana-ml2's 96 cores, `/tank`'s terabytes and GPU1's headroom.
|
||
|
||
**Live:** `http://scriberr.ana.internal:8080` (DNS alias added), health `healthy`,
|
||
all seven backends up, zero failures: `whisperx pyannote sortformer parakeet
|
||
canary voxtral openai`. ~30 GB of weights on `/tank`.
|
||
|
||
Stack: `stacks/scriberr/`. Full gotcha list in auto-memory
|
||
`reference_scriberr_ana_ml2`.
|
||
|
||
## Three upstream bugs, none of them ours
|
||
|
||
**1. The Blackwell image does not exist.** Upstream's README documents
|
||
`scriberr-cuda-blackwell`; GHCR has **no tags for it**. Published
|
||
`scriberr-cuda` covers sm_61–sm_89 only — on these sm_120 cards it fails or
|
||
silently drops to CPU. The real sm_120 path is `Dockerfile.cuda.12.9`
|
||
(CUDA 12.9.1, cu128 torch), **built from source**. Do not "simplify" the compose
|
||
back to the published image.
|
||
|
||
**2. It must run as uid 10001, not 1000** — and the error lies:
|
||
`unable to open database file: out of memory (14)`. Error 14 is
|
||
`SQLITE_CANTOPEN`, not an OOM, on a box with 566 GB RAM. That Dockerfile creates
|
||
`appuser` at 10001 (Ubuntu 24.04 owns uid 1000 as `ubuntu`) and chowns `/app` to
|
||
it, while the entrypoint's PUID remap covers only the data dirs.
|
||
**Isolated by elimination**: SQLite writes fine to `/tank` as 1000 → not the
|
||
mount; fails on a plain named volume too → not the storage; the **published CPU
|
||
image works at PUID=1000** because there `appuser` *is* 1000.
|
||
Generalisable: *when a container "permission" bug appears, compare the uid the
|
||
image was BUILT for against the uid you are RUNNING as.*
|
||
|
||
**3. `UV_LINK_MODE=copy` is required.** Scriberr builds each backend's Python env
|
||
with `uv` at start; uv's reflink mode fails on overlayfs+ZFS with
|
||
`Failed to clone … Resource temporarily unavailable (os error 11)`. **Partial
|
||
failure** — WhisperX and PyAnnote came up and the app looked fine while Parakeet
|
||
and Sortformer were silently absent. Occurrences 2 → 0 after the fix.
|
||
|
||
## Related
|
||
|
||
`speaches` on irv-ml1 **stopped** the same day (stack retained, one command to
|
||
restart): Eyra was abandoned pre-implementation because Scriberr covers the need,
|
||
leaving it with no consumer. Scriberr runs its **own** WhisperX in-container and
|
||
is **not** a speaches consumer. Idle footprint at stop was 274 MiB, not the
|
||
~5.9 GB quoted — that figure is the loaded-model working set.
|