vh
32349b7653
Rewrites the in-flight section, which had gone stale in one place (speaches is stopped, not live) and did not reflect a session in which everything opened was also closed. Three detail files carry the bulk: the FortiGate's public surface reduced to nothing including the ACME listener, Scriberr's deployment and the three upstream defects it required working around, and the ESH DNS repair that also made the IPv6 naming scheme real on three hosts. The tunnel entry in the decisions log described a cipher change as proposed and pending; it has since been attempted, found impossible in the form intended, and resolved differently, so the line now points at the outcome rather than the intention. New decisions cover the cipher adoption and the finding that the per-flow ceiling belongs to the UniFi gateway's software cipher rather than the firewall, the administrative closure, the transcription deployment, the DNS repair, the retirement of an ASR service whose only consumer was abandoned, and a database VM that until now had no fleet identity and no vaulted credential at all. Three approaches are recorded as abandoned: an AEAD cipher the far end cannot express, an upstream DNS setting the gateway accepts and ignores, and a scheme to claim unused delegated prefixes that founders not on the prefixes but on having to rebuild a firewall policy to use them.
2.5 KiB
[2026-08-24] Scriberr transcription deployed on ana-ml2, GPU1
Self-hosted audio/video transcription + diarization. Operator chose GPU
placement over ana-docker (8 cores shared with 50 containers, 37 GB disk)
against ana-ml2's 96 cores, /tank's terabytes and GPU1's headroom.
Live: http://scriberr.ana.internal:8080 (DNS alias added), health healthy,
all seven backends up, zero failures: whisperx pyannote sortformer parakeet canary voxtral openai. ~30 GB of weights on /tank.
Stack: stacks/scriberr/. Full gotcha list in auto-memory
reference_scriberr_ana_ml2.
Three upstream bugs, none of them ours
1. The Blackwell image does not exist. Upstream's README documents
scriberr-cuda-blackwell; GHCR has no tags for it. Published
scriberr-cuda covers sm_61–sm_89 only — on these sm_120 cards it fails or
silently drops to CPU. The real sm_120 path is Dockerfile.cuda.12.9
(CUDA 12.9.1, cu128 torch), built from source. Do not "simplify" the compose
back to the published image.
2. It must run as uid 10001, not 1000 — and the error lies:
unable to open database file: out of memory (14). Error 14 is
SQLITE_CANTOPEN, not an OOM, on a box with 566 GB RAM. That Dockerfile creates
appuser at 10001 (Ubuntu 24.04 owns uid 1000 as ubuntu) and chowns /app to
it, while the entrypoint's PUID remap covers only the data dirs.
Isolated by elimination: SQLite writes fine to /tank as 1000 → not the
mount; fails on a plain named volume too → not the storage; the published CPU
image works at PUID=1000 because there appuser is 1000.
Generalisable: when a container "permission" bug appears, compare the uid the
image was BUILT for against the uid you are RUNNING as.
3. UV_LINK_MODE=copy is required. Scriberr builds each backend's Python env
with uv at start; uv's reflink mode fails on overlayfs+ZFS with
Failed to clone … Resource temporarily unavailable (os error 11). Partial
failure — WhisperX and PyAnnote came up and the app looked fine while Parakeet
and Sortformer were silently absent. Occurrences 2 → 0 after the fix.
Related
speaches on irv-ml1 stopped the same day (stack retained, one command to
restart): Eyra was abandoned pre-implementation because Scriberr covers the need,
leaving it with no consumer. Scriberr runs its own WhisperX in-container and
is not a speaches consumer. Idle footprint at stop was 274 MiB, not the
~5.9 GB quoted — that figure is the loaded-model working set.