Auto-commit: 2026-01-17 21:28 session changes

- Changed library mount from /mnt/kavnas/Roms/roms to /mnt/kavnas/Roms
  to match RomM's expected Structure A (/library/roms/<platform>/)
- Added docker volumes for romm_resources and romm_redis_data
- Documented docker-pm3 gateway (10.4.2.1) in netplan config

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.claude/settings.local.json

@@ -4,7 +4,9 @@
       "Bash(chmod:*)",
       "Bash(ssh:*)",
       "Bash(ping:*)",
-      "WebSearch"
+      "WebSearch",
+      "Bash(tee:*)",
+      "Bash(curl:*)"
     ],
     "deny": [],
     "ask": []

CLAUDE.md

@@ -31,6 +31,33 @@ Types: `add`, `update`, `fix`, `docs`, `config`
 
 **Remote**: `origin` → https://git.kavcorp.com/kavren/proxmox-infra.git
 
+## Gitea Integration
+
+**Server**: https://git.kavcorp.com (self-hosted Gitea)
+**CLI Tool**: `tea` (Gitea's official CLI, similar to GitHub's `gh`)
+
+### Issue Tracking
+Use Gitea issues for enhancement tracking and task management:
+```bash
+# List issues
+tea issues list
+
+# Create new issue
+tea issues create --title "Title" --body "Description"
+
+# View issue
+tea issues view <number>
+```
+
+### Common tea Commands
+```bash
+tea repos list          # List repositories
+tea pr list             # List pull requests
+tea pr create           # Create pull request
+tea issues list         # List issues
+tea repo clone <repo>   # Clone a repository
+```
+
 ## Repository Purpose
 
 Infrastructure documentation and management repository for the **KavCorp** Proxmox cluster - a 5-node homelab cluster running self-hosted services. This repository supports migration from Docker containers to Proxmox LXCs where appropriate.
@@ -167,12 +194,12 @@ ip -br addr show
 - 10.4.2.14: elantris
 
 **Media Stack**:
-- 10.4.2.15: sonarr (LXC 105)
+- 10.4.2.20: sonarr (LXC 105)
 - 10.4.2.16: radarr (LXC 108)
 - 10.4.2.17: prowlarr (LXC 114)
 - 10.4.2.18: bazarr (LXC 119)
 - 10.4.2.19: whisparr (LXC 117)
-- 10.4.2.20: jellyseerr (LXC 115)
+- 10.4.2.25: jellyseerr (LXC 115)
 - 10.4.2.21: kometa (LXC 120)
 - 10.4.2.22: jellyfin (LXC 121)
 

docs/CHANGELOG.md

@@ -2,8 +2,90 @@
 
 > **Purpose**: Historical record of all significant infrastructure changes
 
+## 2026-01-12
+
+### Sonarr Disk Space Fix
+- Fixed SQLite disk I/O errors in Sonarr (LXC 105)
+- Root cause: 4GB rootfs was 100% full, causing database corruption
+- Resized rootfs from 4GB to 12GB
+- Ran e2fsck to repair filesystem corruption
+- Deleted corrupted logs.db (Sonarr recreates automatically)
+
+### Documentation IP Corrections
+- Updated Sonarr IP from 10.4.2.15 to 10.4.2.20 across all docs
+- Updated Jellyseerr IP from 10.4.2.20 to 10.4.2.25 in infrastructure-map.md
+- Files updated: CLAUDE.md, network.md, recyclarr-setup.md, CONFIGURATIONS.md, inventory.md, infrastructure-map.md, services.md, scripts/cleanup/*
+
+### RomM 4.5 Installation
+- Deployed RomM (ROM Manager) via Docker on docker-pm3 (VM 109)
+- URL: http://10.4.2.202:8998
+- ROM library mounted from KavNas at /mnt/kavnas/Roms/roms
+- Assets directory at /mnt/kavnas/Roms/assets
+- Added persistent NFS mount for KavNas on docker-pm3
+- MariaDB backend for metadata storage
+
+## 2026-01-04
+
+### Foundry VTT Network Fix
+- Fixed bad gateway error for vtt.kavcorp.com
+- Issue: LXC 112 was using DHCP and got IP 10.4.2.177 instead of expected 10.4.2.37
+- Fix: Set static IP 10.4.2.37/24 with gateway 10.4.2.1 on LXC 112
+- Rebooted container to apply network changes
+
+## 2026-01-03
+
+### Sunshine Remote Desktop on KavHTPC
+- Installed Sunshine (game streaming host) on KavHTPC for remote desktop access
+- Configured UFW firewall rules for Sunshine ports from Trusted (10.4.0.0/24) and LAN (10.4.2.0/24)
+  - TCP: 47984, 47989, 47990, 48010
+  - UDP: 47998-48000
+- Enabled sunshine.service as user service (auto-starts with user session)
+- Hardware encoding: NVIDIA nvenc (H.264, HEVC, AV1)
+- Web UI: https://10.4.2.190:47990
+
+### Basement HTPC Added
+- Added basement HTPC to infrastructure (10.4.2.190)
+- Created SSH profile `htpc` in ~/.ssh/config
+- Added new "Clients / Endpoints" section to INFRASTRUCTURE.md for DHCP-range devices
+
+## 2026-01-02
+
+### Synology DSM Traefik Route
+- Added Traefik route for `dsm.kavcorp.com` → KavNas DSM (10.4.2.13:5001)
+- Config: `/etc/traefik/conf.d/dsm.yaml`
+- Note: DSM is serving HTTP on port 5001 (not HTTPS), Traefik terminates TLS
+
 ## 2025-12-28
 
+### Guest VLAN Traefik Access
+- Added firewall rule allowing Guest VLAN to access Traefik (10.4.2.10:443)
+- Guests can now use `https://jellyfin.kavcorp.com` etc. with valid certs
+
+### Internal DNS for kavcorp.com Domains
+- Added Pi-hole DNS entries for `*.kavcorp.com` pointing to Traefik (10.4.2.10)
+- Internal clients can now access `https://jellyfin.kavcorp.com` etc. with valid Let's Encrypt certs
+- No port numbers needed, same URLs work internally and externally
+- Also added Traefik `internal` entrypoint on port 8080 for .kav HTTP access (optional)
+
+### Guest VLAN Media Access
+- Added firewall rules allowing Guest VLAN to access Jellyseerr (10.4.2.25) and Jellyfin (10.4.2.26)
+- Rules inserted before "Block Guest to LAN" to allow media streaming for guests
+
+### Guest VLAN Internet Fix
+- Fixed Guest VLAN (10.4.30.0/24) having no internet access
+- Root cause: OPNsense DHCP and firewall rules referenced non-existent 10.4.2.129 for DNS
+- Fix: Updated all DNS references in OPNsense config.xml from 10.4.2.129 to 10.4.2.11 (Pi-hole)
+- Affected: DHCP DNS server settings for all VLANs, firewall DNS allow rules
+- Guest clients need DHCP lease renewal to get correct DNS server
+
+### RustDesk Server Deployment
+- Deployed RustDesk server LXC 129 on pm2 via ProxmoxVE helper script
+- Configured static IP: 10.4.2.36
+- Added local DNS: rustdesk.kav
+- Public key: `UCLpXJifKwWZRWIPqVkyrVfFH89DE8Ca0iBNZselaSU=`
+- Services: hbbs (signal), hbbr (relay), api
+- Ports: 21115-21119 (TCP), 21116 (UDP)
+
 ### Network Infrastructure Cleanup
 
 #### Static IP Migration Complete

docs/CONFIGURATIONS.md

@@ -141,6 +141,33 @@ http:
       insecureSkipVerify: true
 ```
 
+## Synology DSM
+
+**Location**: KavNas (Synology NAS)
+**IP**: 10.4.2.13:5001
+**Domain**: dsm.kavcorp.com
+
+**Traefik Config** (`/etc/traefik/conf.d/dsm.yaml`):
+```yaml
+http:
+  routers:
+    dsm:
+      rule: "Host(`dsm.kavcorp.com`)"
+      entryPoints:
+        - websecure
+      service: dsm
+      tls:
+        certResolver: letsencrypt
+
+  services:
+    dsm:
+      loadBalancer:
+        servers:
+          - url: "http://10.4.2.13:5001"
+```
+
+**Note**: DSM is configured for HTTP on port 5001 (not HTTPS). Traefik terminates TLS.
+
 ## AMP (Application Management Panel)
 
 **Location**: LXC 124 on elantris
@@ -183,7 +210,7 @@ http:
 ## Sonarr
 
 **Location**: LXC 105 on pm2
-**IP**: 10.4.2.15:8989
+**IP**: 10.4.2.20:8989
 **API Key**: b331fe18ec2144148a41645d9ce8b249
 
 **Media Management Settings**:
@@ -352,3 +379,81 @@ http:
           - url: "http://10.4.2.24:2283"
 ```
 
+## RomM
+
+**Location**: Docker on docker-pm3 (VM 109)
+**IP**: 10.4.2.202:8998
+**Version**: 4.5.0
+
+**Docker Compose** (`/opt/romm/docker-compose.yml`):
+```yaml
+services:
+  romm:
+    image: rommapp/romm:latest
+    container_name: romm
+    ports:
+      - 8998:8080
+    environment:
+      - DB_HOST=romm-db
+      - DB_NAME=romm
+      - DB_USER=romm-user
+      - DB_PASSWD=55e7720ac5100322678bacf0a7705bf9
+      - ROMM_AUTH_SECRET_KEY=05817a5501383c44287fc4079082f9fc0543013f186e61789aa2cc2be58d22e8
+      - HASHEOUS_API_ENABLED=true
+      - ENABLE_SCHEDULED_RESCAN=true
+      - SCHEDULED_RESCAN_CRON=0 3 * * *
+      - ENABLE_RESCAN_ON_FILESYSTEM_CHANGE=true
+      - RESCAN_ON_FILESYSTEM_CHANGE_DELAY=5
+      - SCREENSCRAPER_USER=kavren
+      - SCREENSCRAPER_PASSWORD=outlaw
+      - RETROACHIEVEMENTS_USERNAME=kavren
+      - RETROACHIEVEMENTS_API_KEY=obwPWYqylOhy9LA0Mapr64LrUuKNUZLc
+      - STEAMGRIDDB_API_KEY=447ec66ceaef54d52e249a403ec4d4ec
+      - PLAYMATCH_API_ENABLED=true
+    volumes:
+      - romm_resources:/romm/resources
+      - romm_redis_data:/redis-data
+      - /mnt/kavnas/Roms:/romm/library
+      - /opt/romm/config:/romm/config
+
+  romm-db:
+    image: mariadb:latest
+    container_name: romm-db
+    environment:
+      - MARIADB_ROOT_PASSWORD=55e7720ac5100322678bacf0a7705bf9
+      - MARIADB_DATABASE=romm
+      - MARIADB_USER=romm-user
+      - MARIADB_PASSWORD=55e7720ac5100322678bacf0a7705bf9
+```
+
+**NFS Mount** (docker-pm3 `/etc/fstab`):
+```
+10.4.2.13:/volume1/Media /mnt/kavnas nfs rw,soft,nfsvers=4 0 0
+```
+
+**ROM Library Structure** (RomM expects Structure A: `/library/roms/<platform>/`):
+- Mount: `/mnt/kavnas/Roms:/romm/library`
+- ROMs location: `/mnt/kavnas/Roms/roms/<platform>/` → `/romm/library/roms/<platform>/`
+- Assets: `/mnt/kavnas/Roms/assets/` (cover art, screenshots)
+
+**Network Note**: docker-pm3 gateway is 10.4.2.1 (configured in `/etc/netplan/50-cloud-init.yaml`)
+
+**Traefik Config** (`/etc/traefik/conf.d/romm.yaml`):
+```yaml
+http:
+  routers:
+    romm:
+      rule: "Host(`romm.kavcorp.com`)"
+      entryPoints:
+        - websecure
+      service: romm
+      tls:
+        certResolver: letsencrypt
+
+  services:
+    romm:
+      loadBalancer:
+        servers:
+          - url: "http://10.4.2.202:8998"
+```
+

docs/DECISIONS.md

@@ -55,7 +55,14 @@
 - `.local` - Conflicts with mDNS/Bonjour
 - `.home.arpa` - RFC 8375 compliant but verbose
 
-**Usage**: All services accessible via `<service>.kav` (e.g., traefik.kav, sonarr.kav)
+**Usage**:
+- **HTTPS (recommended)**: `https://<service>.kavcorp.com` - valid Let's Encrypt certs, works internally and externally
+- **HTTP (optional)**: `http://<service>.kav:8080/` - internal only, no certs needed
+
+**Internal DNS Configuration**:
+- Pi-hole resolves `*.kavcorp.com` to Traefik (10.4.2.10) for internal HTTPS access
+- Pi-hole resolves `.kav` domains to Traefik for HTTP:8080 access
+- Direct access (no Traefik): pm1-4.kav, elantris.kav, kavnas.kav, docker hosts, mqtt.kav, zwave.kav
 
 ### SSH Access Policy
 
@@ -107,16 +114,18 @@ Unmanaged Gigabyte switches pass VLAN tags through (they just don't understand t
 #### DHCP Configuration
 
 All DHCP served by OPNsense:
-- LAN: 10.4.2.100-200, DNS: 10.4.2.129 (Pi-hole)
+- LAN: 10.4.2.100-200, DNS: 10.4.2.11 (Pi-hole)
-- Trusted: 10.4.10.100-200, DNS: 10.4.2.129
+- Trusted: 10.4.10.100-200, DNS: 10.4.2.11
-- IoT: 10.4.20.100-200, DNS: 10.4.2.129
+- IoT: 10.4.20.100-200, DNS: 10.4.2.11
-- Guest: 10.4.30.100-200, DNS: 10.4.2.129
+- Guest: 10.4.30.100-200, DNS: 10.4.2.11
 
 #### OPNsense Firewall Rules (Implemented)
 
 | Rule | Source | Destination | Action |
 |------|--------|-------------|--------|
-| Allow DNS | IoT/Guest | 10.4.2.129:53 | Pass |
+| Allow DNS | IoT/Guest | 10.4.2.11:53 | Pass |
+| Allow Guest→Traefik | 10.4.30.0/24 | 10.4.2.10:443 | Pass |
+| Allow Guest→Media | 10.4.30.0/24 | 10.4.2.25, 10.4.2.26 | Pass |
 | Block IoT→LAN | 10.4.20.0/24 | 10.4.2.0/24 | Block |
 | Block Guest→LAN | 10.4.30.0/24 | 10.4.2.0/24 | Block |
 | Block Guest→IoT | 10.4.30.0/24 | 10.4.20.0/24 | Block |

docs/INFRASTRUCTURE.md

@@ -60,6 +60,7 @@
 | **Home Assistant** | 10.4.2.33:8123 | VM 100 (pm1) | hass.kavcorp.com | homeassistant.kav |
 | **Ollama** | 10.4.2.34:11434 | LXC 123 (elantris) | ollama.kavcorp.com | ollama.kav |
 | **Twingate** | 10.4.2.35 | LXC 101 (pm1) | - | twingate.kav |
+| **RustDesk** | 10.4.2.36:21115-21119 | LXC 129 (pm2) | - | rustdesk.kav |
 | **Foundry VTT** | 10.4.2.37:30000 | LXC 112 (pm3) | vtt.kavcorp.com | foundryvtt.kav |
 
 ### Game Servers (10.4.2.40-49)
@@ -84,6 +85,12 @@
 | **docker-pm3** | 10.4.2.202 | VM 109 (pm3) | docker-pm3.kav |
 | **Dockge** | 10.4.2.203 | LXC 107 (pm3) | dockge.kav |
 
+### Clients / Endpoints (DHCP Range 10.4.2.100-199)
+
+| Device | IP | Location | Notes |
+|--------|-----|----------|-------|
+| **KavHTPC** | 10.4.2.190 | Basement | CachyOS HTPC for media playback, Sunshine (47990) |
+
 ### Other
 
 | Service | IP:Port | Location | Domain |

docs/infrastructure-map.md

@@ -14,17 +14,18 @@
 
 | Service | IP:Port | Location | Notes |
 |---------|---------|----------|-------|
-| Sonarr | 10.4.2.15:8989 | LXC 105 on pm2 | TV shows |
+| Sonarr | 10.4.2.20:8989 | LXC 105 on pm2 | TV shows |
 | Radarr | 10.4.2.16:7878 | - | Movies |
 | Prowlarr | 10.4.2.17:9696 | - | Indexer manager |
 | Bazarr | 10.4.2.18:6767 | - | Subtitles |
 | Whisparr | 10.4.2.19:6969 | - | Adult content |
-| Jellyseerr | 10.4.2.20:5055 | LXC 115 on pm2 | Request management |
+| Jellyseerr | 10.4.2.25:5055 | LXC 115 on pm2 | Request management |
 | Jellyfin | 10.4.2.21:8096 | LXC 121 on elantris | Media server |
 | NZBGet | 10.4.2.13:6789 | Docker on kavnas | Download client |
 | Traefik | 10.4.2.10 | LXC 104 on pm2 | Reverse proxy |
 | Home Assistant | 10.4.2.62:8123 | VM 100 on pm1 | Home automation |
 | Frigate | 10.4.2.63:5000 | - | NVR/Camera system |
+| RomM | 10.4.2.202:8998 | Docker on docker-pm3 | ROM manager |
 
 ## Storage
 
@@ -37,7 +38,7 @@
 
 All services accessible via `*.kavcorp.com` through Traefik reverse proxy:
 - pm.kavcorp.com → pm2 (10.4.2.6:8006)
-- sonarr.kavcorp.com → 10.4.2.15:8989
+- sonarr.kavcorp.com → 10.4.2.20:8989
 - radarr.kavcorp.com → 10.4.2.16:7878
 - jellyfin.kavcorp.com → 10.4.2.21:8096
 - hass.kavcorp.com → 10.4.2.62:8123

docs/inventory.md

@@ -69,7 +69,7 @@
 
 #### VMID 105 - sonarr
 - **Node**: pm2
-- **IP**: 10.4.2.15
+- **IP**: 10.4.2.20
 - **CPU**: 2 cores
 - **Memory**: 1GB
 - **Disk**: 4GB (KavNas)

docs/network.md

@@ -50,7 +50,7 @@ iface vmbr0 inet static
 #### Media Automation Stack
 | IP | Service | VMID | Node | Purpose |
 |---|---|---|---|---|
-| 10.4.2.15 | sonarr | 105 | pm2 | TV show management |
+| 10.4.2.20 | sonarr | 105 | pm2 | TV show management |
 | 10.4.2.16 | radarr | 108 | pm2 | Movie management |
 | 10.4.2.17 | prowlarr | 114 | pm2 | Indexer manager |
 | 10.4.2.18 | bazarr | 119 | pm2 | Subtitle management |

docs/recyclarr-setup.md

@@ -32,7 +32,7 @@ Recyclarr automatically syncs TRaSH Guides recommended custom formats and qualit
 - Uses TRaSH Guides release group tiers (BD, WEB, Anime BD, Anime WEB)
 
 ### Sonarr (TV Shows)
-- **URL**: http://10.4.2.15:8989
+- **URL**: http://10.4.2.20:8989
 - **API Key**: b331fe18ec2144148a41645d9ce8b249
 - **Quality Profiles**:
   - WEB-1080p (standard)
@@ -122,7 +122,7 @@ ssh pm2 "pct exec 122 -- /usr/local/bin/recyclarr sync --preview"
 curl -H "X-Api-Key: 5e6796988abf4d6d819a2b506a44f422" http://10.4.2.16:7878/api/v3/system/status
 
 # Test Sonarr
-curl -H "X-Api-Key: b331fe18ec2144148a41645d9ce8b249" http://10.4.2.15:8989/api/v3/system/status
+curl -H "X-Api-Key: b331fe18ec2144148a41645d9ce8b249" http://10.4.2.20:8989/api/v3/system/status
 ```
 
 ### Force resync all custom formats

docs/services.md

@@ -34,7 +34,7 @@
 
 #### Sonarr (VMID 105)
 - **Node**: pm2
-- **IP**: 10.4.2.15
+- **IP**: 10.4.2.20
 - **Port**: 8989 (default)
 - **Purpose**: TV show automation
 - **Dependencies**: Prowlarr

scripts/cleanup/README.md

@@ -34,7 +34,7 @@ ssh pm2 "python3 /root/organize-media.py --quiet"
    - Gets all movies and their file paths
    - Identifies which files are actively managed
 
-2. **Queries Sonarr API** (http://10.4.2.15:8989)
+2. **Queries Sonarr API** (http://10.4.2.20:8989)
    - Gets all TV series and their episode files
    - Identifies which files are actively managed
 
@@ -106,7 +106,7 @@ The script has hardcoded configuration at the top:
 ```python
 RADARR_URL = "http://10.4.2.16:7878"
 RADARR_API_KEY = "5e6796988abf4d6d819a2b506a44f422"
-SONARR_URL = "http://10.4.2.15:8989"
+SONARR_URL = "http://10.4.2.20:8989"
 SONARR_API_KEY = "b331fe18ec2144148a41645d9ce8b249"
 
 MEDIA_DIRS = {

scripts/cleanup/organize-media.py

@@ -19,7 +19,7 @@ import urllib.error
 # Configuration
 RADARR_URL = "http://10.4.2.16:7878"
 RADARR_API_KEY = "5e6796988abf4d6d819a2b506a44f422"
-SONARR_URL = "http://10.4.2.15:8989"
+SONARR_URL = "http://10.4.2.20:8989"
 SONARR_API_KEY = "b331fe18ec2144148a41645d9ce8b249"
 
 MEDIA_DIRS = {