vh
5960526c3f
NH3 site visit done: Secure Boot off, iGPU restored as boot VGA, AMT port cabled. - nh3-pve: NVIDIA 580.178.04 (DKMS, open modules) via pve-nvidia-host.yaml. - nh3-ml1 = CT 109 @ 10.100.50.80 via gpu-lxc.yaml; embed-rerank (TEI 1.9.4) deployed with HOST_NAME/HOST_IP labels. - Parity vs esh-ml1 (1,126 texts, 2 runs/host, controls): embed cosine min 0.999993 = own noise floor; overlap@10 1.000 vs MRL-256 positive control 0.684; rerank top-1 1.00, max diff 0.0014 vs floor 0.0020. On-box speed identical within rep spread. - gpu-lxc.yaml: first step upgrades lxc-pve to >= 6.0.0-2 (Proxmox fix #7006). With 6.0.0-1 every docker run in a nesting CT failed on runc 1.5's sysctl reopen; applied on nh3-pve (one package). - pve-nvidia-host.yaml: document that the headers meta drags in the newest kernel (nh3-pve went 6.8.12-11 -> -43 at the next reboot). - Monitoring: Beszel NVIDIA agent + 5 alerts, Kuma #29/#30, Homepage nh3-ml1-docker, Dozzle agent (hub 8 clients). DNS nh3-ml1.nh3.internal. - nh3-pve README: SB/IGFX/driver/kernel state, btmtk oops on -4x kernels, AMT cabled but unreachable on the network. Gateway routing to nh3-ml1 is not changed.
54 lines
1.6 KiB
YAML
54 lines
1.6 KiB
YAML
---
|
|
# https://gethomepage.dev/latest/configs/docker/
|
|
#
|
|
# All four Docker hosts expose the engine on port 2375. This is plaintext
|
|
# and works fine on a trusted LAN; if any host is ever exposed or shared,
|
|
# switch to a TLS socket (examples commented below).
|
|
|
|
esh-vm-docker:
|
|
host: 10.0.50.45
|
|
port: 2375
|
|
|
|
ana-pfi-docker:
|
|
host: 10.250.50.70
|
|
port: 2375
|
|
|
|
nh3-pfi-docker:
|
|
host: 10.100.50.40
|
|
port: 2375
|
|
|
|
# fv-ml1-docker — direct. The socat relay on ana-docker (stacks/fv-ml1-proxy) was
|
|
# retired 2026-09-12: once FV joined the mesh and the three site gateways got
|
|
# 10.251.0.0/16 statics, ESH reaches fv-ml1:2375 directly (verified).
|
|
fv-ml1-docker:
|
|
host: 10.251.50.54
|
|
port: 2375
|
|
|
|
# irv-ml1 — moved 10.100.79.3 -> 10.6.110.50 on 2026-09-06 (headscale cutover;
|
|
# the old wg0 tunnel IP is dormant and no longer answers). Reachable from
|
|
# esh-docker-vm via the mesh (10.6.110.50:2375 verified OPEN 2026-09-07).
|
|
irv-ml1-docker:
|
|
host: 10.6.110.50
|
|
port: 2375
|
|
|
|
# esh-ml1 — CT 110 on esh-pve: the fleet embed/rerank (TEI) + reward seats.
|
|
# dockerd listens only on its own address (playbooks/gpu-lxc.yaml), 2026-09-25.
|
|
esh-ml1-docker:
|
|
host: 10.0.50.80
|
|
port: 2375
|
|
|
|
# nh3-ml1 — CT 109 on nh3-pve: the second embed/rerank (TEI) backend.
|
|
# dockerd listens only on its own address (playbooks/gpu-lxc.yaml), 2026-09-25.
|
|
nh3-ml1-docker:
|
|
host: 10.100.50.80
|
|
port: 2375
|
|
|
|
# Example TLS socket (if/when a host moves off plaintext 2375):
|
|
# ana-pfi-docker:
|
|
# host: 10.250.50.70
|
|
# port: 2376
|
|
# tls:
|
|
# keyFile: docker-tls/ana-docker/key.pem
|
|
# caFile: docker-tls/ana-docker/ca.pem
|
|
# certFile: docker-tls/ana-docker/cert.pem
|