676 Commits

Author SHA1 Message Date
Hermes Agent service account
c3755aa29e llm-inference-multimodel: role + day1 playbook (phase 0 discover approved) 2026-08-05 15:53:31 -05:00
Hermes Agent service account
782cbe33d1 llm-inference: size ctx-size/parallel for aux task offload
Previous ctx-size=8192/parallel=4 gave 2048 tokens/slot, too small for
context compression inputs (observed live rejection at 3826 tokens).

Measured VRAM on astro-orbiter (RTX 3090 24GB): weights ~17GB resident,
~294KiB/token pool-wide for KV cache+buffers at prior sizing.

New: ctx-size=16384, parallel=2 -> 8192 tokens/slot (matches model's
native n_ctx_train max). Projected VRAM ~21.8GB, ~2.7GB headroom.

Applied directly via ansible-playbook (Semaphore currently broken --
fix tracked separately).
2026-08-05 12:14:11 -05:00
Hermes Agent service account
aff792a061 feat(llm-inference): move astro-orbiter monitoring to GitOps (values.yaml + dashboards.yaml)
- Prometheus scrape configs for node/gpu/llama-server exporters on
  astro-orbiter now declared in cluster/applications/monitoring/values.yaml
  (additionalScrapeConfigs), applied via ArgoCD sync instead of an
  imperative kubectl secret patch from the Ansible role.
- Grafana dashboard for astro-orbiter LLM inference added as a ConfigMap
  in cluster/applications/monitoring/dashboards.yaml (grafana_dashboard=1
  sidecar label), replacing the role's ad-hoc kubectl apply of a rendered
  Jinja template.
- ansible/roles/llm-inference/tasks/monitoring.yml: removed the kubectl
  get/patch/apply tasks and orphaned grafana-llm-dashboard.json.j2
  template; role now only stands up node_exporter + nvidia_gpu_exporter
  and verifies they're reachable — cluster-facing config lives in Git.
- host_vars/vars.yml + inventory.yml: finalize astro-orbiter as the
  llama.cpp/RTX 3090 host (jarvis user, ssh key), drop stale Ollama/AMD
  vars and ollama_server inventory group superseded by the ATX rebuild.
2026-08-05 09:43:54 -05:00
Hermes Agent service account
aa8e229e64 fix(llm-inference): switch serve phase from vLLM+bitsandbytes to llama.cpp+GGUF
bitsandbytes peak RAM ~54GB (bf16 load before quantize) — kills 40GB OptiPlex.
llama.cpp Q4_K_M GGUF loads pre-quantized: peak RAM ~15.5GB, fits cleanly.

Changes:
- serve.yml: build llama.cpp with CUDA, download Q4_K_M GGUF from bartowski,
  disable vllm-serve, deploy llama-server.service
- llama-server.service.j2: OpenAI-compatible server on same port 8000,
  --n-gpu-layers 99 (full GPU offload), --parallel 4, gemma chat template
- defaults: llm_gguf_dir, llm_gguf_path, llm_gpu_layers, llm_parallel_slots
- handlers: restart llama-server, vllm-serve failed_when=false (may not exist)

GGUF: bartowski/gemma-2-27b-it-Q4_K_M.gguf (15.5GB, 24GB VRAM fits w/ ~8GB headroom)
2026-08-03 12:37:03 -05:00
Hermes Agent service account
22a020e4c7 fix(llm-inference): bitsandbytes int4 OOM — pending switch to llama.cpp+GGUF
bitsandbytes quantizes on-the-fly: loads full bf16 weights (~54GB RAM peak)
before compressing to int4. Kills the 40GB OptiPlex on torch.compile warmup.

Fix in next commit: switch serve phase to llama.cpp + GGUF Q4_K_M.
Pre-quantized weights load directly — peak RAM ~16GB, no compile overhead.
2026-08-03 12:35:46 -05:00
Hermes Agent service account
e879cf73d3 fix(llm-inference): gpu_exporter version 1.2.2 → 1.13.1 (correct release tag) 2026-08-03 11:57:42 -05:00
Hermes Agent service account
423891001c feat(llm-inference): Phase 7 — Prometheus monitoring + Grafana dashboard
- Phase 7 task file: monitoring.yml
  - node_exporter (port 9100) via apt, systemd managed
  - nvidia_gpu_exporter v1.2.2 (port 9835) — GPU util, VRAM, temp, power
  - Patches kube-prometheus additionalScrapeConfigs secret with 3 new jobs:
    node-astro-orbiter, gpu-astro-orbiter, vllm-astro-orbiter
  - Deploys Grafana dashboard ConfigMap via kubectl apply

- Grafana dashboard (11 panels):
  - Row 1: GPU util %, VRAM used, GPU temp gauge
  - Row 2: GPU power draw, vLLM token throughput, request queue depth
  - Row 3: vLLM e2e latency p50/p95/p99, KV cache utilization %
  - Row 4: System CPU %, memory, root disk gauge

- defaults/main.yml: llm_gpu_exporter_version, llm_gpu_exporter_port
- handlers/main.yml: restart nvidia-gpu-exporter
2026-08-03 11:53:36 -05:00
Hermes Agent service account
dda6b91330 feat(llm-inference): Day 1 playbook for RTX 3090 vLLM stack on astro-orbiter
- nvidia-driver-595-open (already installed 2026-08-03, idempotent)
- Python venv + vLLM 0.26.0 (already installed, idempotent)
- Gemma 2 27B model download via HuggingFace hub
- systemd vllm-serve.service on port 8000
- Hermes provider integration on carousel-of-progress
- vault_hf_token added to group_vars/all/vault
- ansible.cfg: vault_password_file set to absolute path
- inventory: astro_orbiter group added

Run with: env -u ANSIBLE_VAULT_PASSWORD_FILE ansible-playbook -i inventory.yml playbooks/day1_deploy_llm_inference.yml
2026-08-03 11:51:34 -05:00
Hermes Agent service account
265d3f8fd6 jmri: remove one-shot xpra migration task (idempotency fix)
Migration from Ubuntu 3.x to upstream 6.x is complete. The explicit
removal task was firing changed on every run. state: latest on the
install task handles upgrades going forward.
2026-08-01 22:15:11 -05:00
Hermes Agent service account
b61d19cb91 jmri: add udev rule for LCC buffer (Microchip CDC -> jmri-lcc) 2026-08-01 22:09:19 -05:00
Hermes Agent service account
00be18b1f1 jmri: move udev symlinks to /dev/jmri-* (flat, JMRI-enumerable)
/dev/jmri/ subdirectory is invisible to JMRI's device scanner.
Symlinks must live directly in /dev to appear in the port dropdown.
2026-08-01 21:58:42 -05:00
Hermes Agent service account
6c7ec507ef jmri: fix NCE udev rule — FTDI FT232 (ttyUSB), not Microchip CDC (ttyACM) 2026-08-01 21:55:43 -05:00
Hermes Agent service account
63b0bc72fe jmri: deploy udev rules for stable /dev/jmri/* symlinks
Rules were documented but never deployed — /dev/jmri/nce was missing
entirely, only /dev/jmri/loconet existed (created manually).

Adds:
- templates/99-jmri-devices.rules.j2: LocoBuffer-NG -> loconet,
  NCE Power Pro (Microchip CDC) -> nce
- Task to deploy rules + trigger udev settle
- Trigger udev handler (reload-rules alone is insufficient)
2026-08-01 21:18:06 -05:00
Hermes Agent service account
02af5d26dc jmri: fix xpra remove task idempotency (skip if already from upstream repo) 2026-08-01 21:07:32 -05:00
Hermes Agent service account
3eb38b74bd jmri: add rblundon@laptop SSH key for xpra access
Adds jmri_ssh_authorized_keys_extra list to support multiple authorized
keys on the jmri account. Deploys rblundon's MacBook key so xpra can
connect via SSH without a password.
2026-08-01 21:06:07 -05:00
Hermes Agent service account
2b95acb8cc jmri: install xpra from upstream repo (v6.x, replaces Ubuntu v3.x)
Ubuntu 24.04 packages xpra 3.1.5 which is wire-incompatible with the
v6.x macOS client from xpra.org. Add xpra.org apt repo and install
current stable release so client and server versions match.
2026-08-01 20:25:01 -05:00
Hermes Agent service account
62e9f13a45 jmri: replace TigerVNC with Xpra for JMRI GUI display
VNC had window management issues and some dialogs wouldn't open correctly.
Xpra runs in rootless mode — each JMRI window appears natively on the
client without a VNC client or XQuartz required.

Changes:
- Remove tigervnc-standalone-server, jmri-vnc.service, .vnc/ directory
- Install xpra, deploy jmri-xpra.service.j2 (systemd unit)
- Update jmri-gui wrapper: DISPLAY=:100, attach instructions printed on launch
- Update defaults: drop VNC vars, add jmri_xpra_display=100
- Rename handler: Restart jmri-vnc -> Restart jmri-xpra

Connect from macOS/Linux:
  xpra attach ssh://jmri@main-street-station/100
2026-08-01 20:14:49 -05:00
Hermes Agent service account
4cb87a57ad jmri: add Phase 4 TigerVNC server on :1 (port 5901) — replaces X11 forwarding 2026-07-29 23:17:35 -05:00
Hermes Agent service account
d2eaddfd11 jmri: headless service uses Lake_Country_Railroad profile 2026-07-29 22:33:49 -05:00
Hermes Agent service account
0e741aab38 jmri: gui launcher uses last-session profile instead of --profile flag 2026-07-29 22:32:22 -05:00
Hermes Agent service account
9ebd19ab52 jmri: remove udev symlink phase — JMRI uses /dev/ttyACM* natively 2026-07-29 22:17:29 -05:00
Hermes Agent service account
e47cbf2044 jmri: add jmri_lcrr_branch var; main-street-station tracks clean-profile 2026-07-29 21:50:46 -05:00
Hermes Agent service account
ce632e88b9 jmri: upgrade to 5.16 (R909e15189e) 2026-07-29 21:35:01 -05:00
Hermes Agent service account
11d8796764 jmri: version-aware install/upgrade via marker file
Replace binary-exists check with .jmri_installed_version marker pattern.
- Reads marker on each run; skips install if version matches
- On version mismatch: stops JMRI, wipes /opt/JMRI, downloads new archive
- Separates build hash into jmri_build_hash var (templated into download URL)
- Config is preserved — lives in git-managed .jmri symlink
To upgrade: bump jmri_version + jmri_build_hash, re-run playbook.
2026-07-29 21:34:26 -05:00
Hermes Agent service account
d974c75d7c feat(jmri): headless JMRI server with Leviton layout power monitor and X11 GUI mode
- Stable udev device symlinks (/dev/jmri/nce, /dev/jmri/loconet, /dev/jmri/lcc)
- jmri-monitor: polls Leviton Decora Smart switch to start/stop JMRI automatically
  - Quiet hours 1-10 AM (no polling)
  - 30s off-delay before shutdown
- LCRR config cloned from Gitea (ssh://gitea.mk-labs.cloud:2221/rblundon/LCRR.git)
- ~/.jmri symlinked to LCRR repo for GitOps config management
- jmri-gui: X11 remote GUI access (PanelPro/DecoderPro) via ssh -X as jmri user
  - Stops daemon, launches GUI, restarts daemon on exit if layout still on
- jmri user gets login shell + SSH key for GUI sessions
- Full JRE installed (openjdk-21-jre) for AWT/X11 support
2026-07-29 00:43:23 -05:00
Hermes Agent service account
a5433dcb5b minecraft: queue AntiSilverFish v0.0.4 — apply on next restart 2026-07-20 00:39:46 -05:00
Hermes Agent service account
e0eb47f5ce minecraft: add sleep-most to PLUGINS url list so it survives pod restarts 2026-07-19 21:18:57 -05:00
Hermes Agent service account
a8822f0778 minecraft: disable whitelist — open server 2026-07-19 21:02:32 -05:00
bedf87b492 change seed 2026-07-19 20:56:03 -05:00
Hermes Agent service account
b6f7791c98 minecraft: add SkinsRestorer v15.12.4 plugin for offline-mode skin support 2026-07-19 20:48:22 -05:00
Hermes Agent service account
1a48e60afd minecraft: fix Grafana dashboard queries for prometheus-exporter v3 mc_ metric names 2026-07-19 18:27:22 -05:00
Hermes Agent service account
c26b19793b minecraft: bind prometheus exporter to 0.0.0.0 — localhost blocks Prometheus scrape 2026-07-19 18:20:11 -05:00
Hermes Agent service account
dfe81a5c20 minecraft: set prometheus exporter to port 9225, manage config via ConfigMap 2026-07-19 18:17:47 -05:00
Hermes Agent service account
4afb05e56b minecraft: wire PLUGINS env var into Deployment — prometheus exporter was never downloaded 2026-07-19 18:15:37 -05:00
Hermes Agent service account
46b49259d2 minecraft: manage sleep-most config via ConfigMap — single player sleep enabled 2026-07-19 18:13:55 -05:00
Hermes Agent service account
3f3ce68e18 minecraft: fix backup script — skip missing nether/end dirs, safe save-on on tar failure 2026-07-19 17:52:54 -05:00
Hermes Agent service account
e44805c9b6 minecraft: fix backup image — itzg/rcon-cli is distroless, use minecraft-server instead 2026-07-19 17:51:15 -05:00
Hermes Agent service account
1aa6b4234a minecraft: add hourly world backup CronJob with 3-day local retention 2026-07-19 17:48:53 -05:00
Hermes Agent service account
4cde540e70 minecraft: enable whitelist with RyansRailroad, Nylarac19, ga_eul_pabo, Ghoulish_Hannah 2026-07-19 17:39:30 -05:00
Hermes Agent service account
69fb5f5641 minecraft: disable online-mode to bypass Zscaler session auth blocking 2026-07-19 17:35:22 -05:00
Hermes Agent service account
430552a0b1 fix(minecraft): set enforce-secure-profile=false to bypass Mojang WAF block on homelab egress IP 2026-07-19 15:01:30 -05:00
Hermes Agent service account
18bb111843 feat(minecraft): add Prometheus metrics + Grafana dashboard
- minecraft-prometheus-exporter v3.1.2 plugin (port 9225)
- ServiceMonitor for Prometheus scraping
- Grafana dashboard ConfigMap (ID 20659, Minecraft server stats)
- metrics port added to Service and Deployment containerPorts
2026-07-19 14:53:36 -05:00
Hermes Agent service account
712425ee17 feat(minecraft): upgrade PaperMC to 26.2 (build 62) 2026-07-19 14:22:06 -05:00
Hermes Agent service account
1d77821e5f feat(minecraft): add Cloudflare ExternalDNS annotations for public DNS record 2026-07-19 14:17:14 -05:00
Hermes Agent service account
7ad40bb509 fix(minecraft): remove SleepMost plugin 2026-07-19 13:52:37 -05:00
Hermes Agent service account
3950a2b069 fix(minecraft): correct SleepMost plugin URL to v5.5.3 (5.6.2 never existed) 2026-07-19 13:50:15 -05:00
Hermes Agent service account
d20fd80798 fix(minecraft): use px-fa-direct-access storage class for world data PVC 2026-07-19 13:47:12 -05:00
Hermes Agent service account
308ee553c3 fix(minecraft): exclude application.yaml from self-sync to resolve SharedResourceWarning 2026-07-19 13:44:30 -05:00
Hermes Agent service account
56110d52bd feat(minecraft): deploy journey-into-imagination PaperMC server
- PaperMC 26.1.2 via itzg/minecraft-server:2026.7.0
- Namespace: minecraft, Service: journey-into-imagination
- TCP port 10182 (non-standard) via ingress-nginx tcp forwarding
- Pure Storage CSI PVC (pure-block, 50Gi) for world data
- World seed hardcoded: -5177989977648707969
- RCON password via ExternalSecret + 1Password Connect
- SleepMost v5.6.2 plugin for single-player sleep
- Whitelist off at launch, toggle-ready
- ExternalDNS annotations for internal Technitium record
- Manual steps: UniFi port forward WAN:10182→10.1.71.80:10182,
  Cloudflare A record + SRV for journey-into-imagination.mk-labs.cloud
2026-07-19 13:36:27 -05:00
Hermes Agent service account
1f07fdff45 revert: restore wed as ansible_user for main-street-station 2026-07-18 20:03:20 -05:00