Buy and build the NAS, smaug, on CasaBonita (ADR-0016, ADR-0040)

The NAS that ADR-0008 named as the second of "two purchases where the plan
originally assumed zero", and that ADR-0016 placed and addressed. #95 closed on
2026-09-04 when ADR-0016 answered its four questions, and the purchase and the
build lost their tracker that day — the same shape #102 had, which is how one
ProDesk came to be bought for two jobs (ADR-0034). This is the tracker.

Note

Body rewritten 2026-09-17. As filed it described a host called zion
running Ubuntu Server, with three firewall rules deliberately not created.
Each of those three is now wrong, and each for a written reason:
ADR-0038
named the host smaug,
ADR-0040
replaced ADR-0016's operating-system clause with TrueNAS, and the rules were
created and verified in position on 2026-09-16 — as four, not three. The
comment history below is left exactly as filed.

Body rewritten again 2026-09-19. The 2026-09-17 body said the drives were
in transit and §1–§7 were all outstanding. The drives landed 2026-09-18, §1–§6
were done that evening and the next morning (#522), ADR-0040's transcode test
passed (#524), and a television played on the evening of 2026-09-19 (#541).
One reading is left. The comment history is again left exactly as filed.

What is decided

Host smaug at 10.0.40.30 on CasaBonita (40), a static below the DHCP
range (ADR-0016), with a Kea reservation on morpheus beside it because
either alone is a single point of drift. The name is ADR-0038's: zion is
reserved for the dedicated firewall cold spare that does not exist, and no
host answers to it.
Scraped, never pushing. Metrics over 99 → 40:9100, and no logs at all —
Loki has no pull and its ingest is unauthenticated, so the reversal that keeps
CasaBonita terminal outward costs this host its logs. smaug has no logs, and that is a decision — record it as a residual #255 recorded that as a
residual and is closed.
Hardware: a Lenovo ThinkServer TS150 — Xeon E3-1225 v6, 8 GB ECC, four
3.5" bays, HD P630 whose Quick Sync is what Media tier: Jellyfin — placement answers the terminal-VLAN problem #138 needed. Not the "quiet
N100-class" chassis ADR-0008 pictured; docs/hardware.md describes it off the
machine rather than off the listing, down to the machine type-model, the
serial and the one DIMM in four slots.
TrueNAS 25.10, not Ubuntu Server (ADR-0040, superseding ADR-0016's
operating-system clause). stacks/media/ stays in this repository as a
compose file TrueNAS launches rather than becoming catalogue apps, so
Dependabot, the digest pin check and make validate keep reaching it. What
leaves CI's reach permanently is the pool and share layout, which
build-the-nas.md carries instead.
It is where backups go: ADR-0027 installs Proxmox Backup Server with a
sync job here, and ADR-0015's volume sets want an off-host home beyond
oracle's shelf. Both shapes want re-reading under TrueNAS — ADR-0027's PBS trigger has fired, and its sync job was designed for a host smaug is not #485 and erebor/apps is declared backed up in two files and backed up by nothing #484
carry that.

What has landed

build-the-nas.md §0 was complete on 2026-09-16 and §1–§6 on 2026-09-19,
and everything in it was read or verified rather than assumed.

§0 (PRs #476–#479, comment of 2026-09-17 below):

BIOS flashed S06KT03R (2017) → S06KT81L (2024), boot block 1.03 → 1.81,
done while the machine was empty. AHCI and CSM-disabled were already correct.
AMT was on Intel's factory-default credential — MEBx accepted admin, so
no password had ever been set. Unprovisioned and disabled the same day, and
recorded in SECURITY.md. Disabled rather than hardened, which is
deliberately the opposite of what ADR-0033 does for shiva.
The boot disk is fitted — the optical drive came out of the 5.25" bay and
the Intel DC S3520 240 GB went in on SATA5, on the bracket bought for it.
SMART read back before the install: PASSED, 13,182 power-on hours, wearout
088, and four reallocated sectors.
Addressed and reachable. Static set, reservation added, and four
inbound passes created and verified from morpheus rather than from the UI.
Every pass sits above Block access to CasaBonita. Winterfell is still
refused on 443, and the TerminalSegmentReachedInternalNetwork cannot fire — the firewall logs blocks only #223 tripwire on igc0.40 reads zero packets.

On interface	Source → destination	Port
Hicks (50)	`vlan50 net` → `10.0.40.30`	`443`
Hicks (50)	`vlan50 net` → `10.0.40.30`	`8096`
Winterfell (99)	`10.0.99.20` → `10.0.40.30`	`9100`
Winterfell (99)	`10.0.99.20` → `10.0.40.30`	`22`

Hicks reaches 443 and not the 22 ADR-0016's table names — TrueNAS is
administered over HTTPS, and ADR-0040 carries the correction. Port 22 survives
on the Winterfell rule and is inert, because TrueNAS ships SSH disabled.

§1–§6 (#522, #524, comments of 2026-09-19 below):

Step	Read rather than assumed
§1 fit	`SATA2`/`SATA3`, bay fan untouched. The power lead has four wires and no orange one, so the pin-3 Power Disable trap does not fire on this supply
§2 SMART	`ZVTBS4NL` and `ZVTBSDL3`, firmware `SN03`, both `PASSED`, 0 reallocated, 0 pending, 0 power-on hours by SMART and by `smartctl -l farm` — the counter a SMART reset does not touch. Extended tests started 2026-09-18
§3 pool	`erebor`, a mirror of the two. Encryption off by decision. `ONLINE`, 0/0/0, no known data errors. 18 TB usable, not 36
§4 datasets	`erebor/media` (SMB preset, 1M records, not backed up) and `erebor/apps` (Apps preset). Jellyfin's `/config` is a named volume on `erebor/ix-apps`, not `erebor/apps` — #484's finding
§5 share	`media`, user `bilbo` — SMB only, no UI, shell, SSH or sudo. One ACL entry added for Jellyfin's read as uid 65534. No workstation can mount it: SMB is `445` and no rule carries it — #523
§6 stack	Running under TrueNAS's Docker from `/mnt/erebor/apps/stack`, from a copy of the two files in `stacks/media/`. `make up STACK=media` does not run on that host; a change is deployed there by hand
§6.1 scrape	`9100` open, `443`/`8096` refused from the monitoring host, 36 `node_filesystem_avail_bytes` series including `erebor` and both datasets. `up{job="node",instance="smaug"}` reads 1
ADR-0040's reopen condition	Closed. `renderD128` listed inside `media-jellyfin` as `root 107`, `id` carries 107, and a forced transcode ran VAAPI decode on `iHD`, `scale_vaapi`, `h264_qsv` encode at about five times real time. Decision 2 stands
§7 television	A television on CasaBonita played something on the evening of 2026-09-19, with no firewall rule involved. An earlier same-day claim was withdrawn within the hour; this is the reading
§7 re-reads	Tripwire at 143,780 evaluations, 0 packets, all four passes still above the block; port 15 on `neo` reads PVID 40, untagged, in the switch UI

What is left

One reading. Both Exos extended self-tests, started 2026-09-18 and at
10 % remaining on the evening of 2026-09-19, completing without error. Read
at the console — SSH is off by design and the monitoring host reaches 9100
and nothing else, so nothing in the estate can read it remotely:

smartctl -l selftest /dev/sda
smartctl -l selftest /dev/sdb

Completed without error on both, and PASSED, goes into hardware.md's
Exos entry and the §7 line, and closes this issue. A Completed: read failure
with an LBA on either drive is a return, not a pool member, and reopens §2.

What waits on it

Still waiting: #446's ISO store and the fifth inbound rule, and #139's
Plex test, which is now runnable rather than blocked.

No longer waiting — closed: #138 Jellyfin (on #522 and #524), #255 the
no-logs residual, #256 the scrape path.

Spawned by the build and not blocked by it: #484 erebor/apps is declared
backed up and backed up by nothing; #485 ADR-0027's PBS sync job was
designed for a host smaug is not; #523 the share is unreachable from
Hicks; #528 the stack has no secrets file. #140 and #141 land in
stacks/media/ in the shape it already has.

Purchases this needs

None. The box, the mirror, the boot disk and its bracket are all bought, all
landed, and all in the machine. This has not been blocked on money since
2026-09-11 and not on parts since 2026-09-18.

NAS has already been named smaug

Bought 2026-09-09, in transit: Lenovo ThinkServer TS150 — Xeon E3-1225 v6,
8 GB ECC, four 3.5" bays, no drives, no OS. Recorded in
#420.

Against ADR-0016's shape

ADR-0016 said	The TS150 is	Verdict
"quiet N100-class"	a 73 W Kaby Lake desktop Xeon in a tower with a 250 W supply	Different. More draw and more noise than pictured; it will not rack. Worth a sentence in `hardware.md` when its idle wattage is measured on the UPS, not a redesign — the ADR chose the segment and the direction, not the silicon
four bays, two populated	four 3.5" bays, none populated	Matches once two drives are bought — still the outstanding purchase, chosen at the till per the ADR
ZFS mirror	8 GB ECC	Better than pictured: ECC under ZFS is the combination the ADR's "checksums and a scheduled scrub" argument quietly assumes
Jellyfin with hardware transcoding (#138)	Intel HD P630, Quick Sync present	Matches; QSV on Kaby Lake covers H.264 and HEVC 8-bit
Ubuntu Server + one compose stack, not an appliance	ships with no OS	Matches by absence — nothing to remove
`zion`, `10.0.40.30`, static below the pool	one onboard GbE	Fine; a second NIC is not wanted on a terminal segment

What is left, in order

Two drives for the mirror. Cost per terabyte at the till; the ADR
deliberately names no size. NAS-rated 3.5" spinners; the bays are not
hot-swap, so a drive swap is a shutdown, which a mirror tolerates.
Placement. A tower does not go in the rack. It needs a wired port on
neo tagged for VLAN 40 and a UPS-fed outlet — both closer to the rack
than to the televisions, which is fine: placement on 40 is a VLAN tag, not
a room.
Address, reservation, network.md and hardware.md rows.
Ubuntu Server, ZFS, node_exporter; then the three ADR-0016 rules in
order; then Add the scrape path for a host that pushes nothing #256's scrape target and relabel; then stacks/media/.
smaug has no logs, and that is a decision — record it as a residual #255's residual rows, the day it answers on its address.

8 GB is enough for a NAS with Jellyfin and a small library; the TS150 takes
ECC UDIMMs to 64 GB if Immich's photo backup ever wants to live here instead
of on trinity, which ADR-0027's PBS sync target also argues for.

🤖 Generated with Claude Code

Merge pull request #420 from Gerrrt/gerrrt/nas-bought-413

Drives bought — two Seagate Exos X20 18 TB (ST18000NM003D), 2026-09-11, in transit.

A mirror of two is one drive's capacity, so this is 18 TB usable, not 36.
The listing recorded zero power-on hours. That is a claim, not a fact — read it back with smartctl -a on arrival and record what the drives actually report in hardware.md, before the mirror is built on them.

Recorded in #457: the buy-list row moves to Already paid for, and hardware.md gains the entry beside the TS150.

Still outstanding for this issue: the 240–256 GB boot SSD and its optical-bay bracket. ADR-0016 chose Ubuntu Server and one compose stack rather than an appliance, so the OS wants a disk that is not the mirror. Step 1 of the order of work above is otherwise done.

docs: zion's boot SSD is bought; the bracket is what is left

Boot disk bought — Intel DC S3520 240 GB, 2.5" SATA 6 Gb/s, 2026-09-11, in transit.

This issue is no longer blocked on money for the machine. Box, mirror and boot disk are all bought.

One thing outstanding, and it is a blocker for the fit rather than a nicety: there is no bracket. The TS150's optical bay is 5.25" and this is a 2.5" drive, so an adapter is needed before the disk can go in. The roadmap row narrowed to exactly that rather than leaving the list.

On arrival, before the install: read SMART back on all three drives — the two Exos (whose zero power-on hours is a listing claim) and this one. Recorded in #457.

docs(adr): ADR-0038 — the NAS is smaug, and zion is reserved

The box landed 2026-09-15, and with it the boot SSD and the bracket and tape that mount it in the TS150's 5.25" optical bay. Recorded in docs/hardware.md by #472 — arrival only, no row into the Compute table, which per that bullet waits on the box being placed, addressed and in network.md.

The two Exos X20 18 TB drives did not land. So this is not unblocked: what it waits on is those two drives and a bench, and it has not waited on money since 2026-09-11.

Nothing has been read off the machine yet, and hardware.md now says so against each entry rather than trusting the listing. Owed before the build:

TS150 — Xeon E3-1225 v6 and 8 GB ECC read off POST or the BIOS rather than off the listing; machine type-model and serial off the chassis label; how many of the four bays came with a caddy, because a bay without one holds no drive; and that the 5.25" optical bay is empty, which the boot disk's bracket assumes.
Intel DC S3520 240 GB — model, part number, serial, and smartctl -a read back before the install rather than after. The same caution the Exos pair is bought under: a listing's hours are a claim.
The bracket — that it is a 5.25"-to-2.5" adapter and not the 3.5" version, which would fit neither the drive nor the bay. And its model, now that naming it is owed rather than deferred.

ADR-0027's deferral is unchanged and said as much in advance: PBS follows the NAS answering on 10.0.40.30, not the box arriving.

Merge pull request #476 from Gerrrt/gerrrt/boot-disk-fitted-and-detected

Merge pull request #477 from Gerrrt/gerrrt/boot-disk-smart-read

docs(runbook): name the pool erebor, not hoard (#413)

docs: four rules for smaug, said once per document

docs(network): count the CasaBonita passes in one bullet, not two

Merge pull request #501 from Gerrrt/gerrrt/nas-smaug-casabonita-10f61a

docs: the TS150's power lead has no 3.3 V wire, so pin 3 is moot on t…

docs(runbook): erebor is ONLINE with no errors (#413)

2026-09-19 — the drives are in, erebor exists, the stack runs, and the scrape is live. The Exos pair landed on 2026-09-18, a day after the carrier's window lapsed. §1–§6 of build-the-nas.md were done that evening and the next morning, and #522 records them. This is the dated entry.

What was read rather than assumed

Step	Result
§1 fit	`SATA2`/`SATA3`, bay fan untouched. The power lead has four wires and no orange one, so the pin-3 Power Disable trap — which §1 now documents — does not fire on this supply; both drives enumerated first time
§2 SMART	`ZVTBS4NL` and `ZVTBSDL3`, firmware `SN03`, both `PASSED`, 0 reallocated, 0 pending, 0 power-on hours by SMART — and 0 hours, 0 spindle hours by `smartctl -l farm`, the counter a SMART reset does not touch. One drive carried a Windows quick format and a short self-test at hour 0: a seller's bench, nothing more. Extended tests running, ~28 h each
§3 pool	Mirror, encryption off by decision (reason in §3). `zpool status`: `ONLINE`, 0/0/0, no known data errors
§4 datasets	`erebor/media` on the SMB preset, `erebor/apps` on the Apps preset
§5 share	`media`, user `bilbo` (SMB only — no UI, shell, SSH or sudo). One ACL entry added, and not for `bilbo`: `everyone@` Read, because Jellyfin reads the library as uid 65534 and the preset grants only `builtin_users`
§6 stack	Running under TrueNAS's Docker from `/mnt/erebor/apps/stack`. `renderD128` is `root 107` inside `media-jellyfin` and `id` there carries 107
§6.1 scrape	From the monitoring host: 9100 open, 443/8096 refused, 36 `node_filesystem_avail_bytes` series including `erebor` and both datasets, 0 `node_network_*`. Target uncommented; after a hand-run converge `up{job="node",instance="smaug"}` reads 1, the same 36 series are in Prometheus, and nothing alerted
§0.6 re-read	All four passes still above Block access to CasaBonita; the `igc0.40` tripwire at 143,780 evaluations, 0 packets (138,707 before the stack came up)

Two things the runbook had wrong, now fixed

§6 said make up STACK=media. That renders secrets this stack does not have, on a box with neither make nor sops. It now says what runs: give Apps the pool, fetch the two files from main, docker compose up -d. Nothing on smaug pulls from main on its own, so a merged Dependabot bump is deployed there by hand; stacks/media/README.md says so.
§4's "backed up" row named a dataset nothing writes to. Jellyfin's /config is a named volume, and TrueNAS keeps those on erebor/ix-apps, not erebor/apps. Noted for erebor/apps is declared backed up in two files and backed up by nothing #484.

Still open here

The QSV transcode, the half of ADR-0040's reopen condition a shell cannot check. Jellyfin's wizard is being run now.
A television on CasaBonita playing something.
The two extended self-tests, due ~2026-09-19 evening.
Port 15 on neo re-read in the switch UI.

Refs #413 #223

2026-09-19, later — the transcode passed and two more §7 lines are read. #524 carries them.

§7 line	Read
Monitoring host reaches `9100` and nothing else	`up{job="node",instance="smaug"}` = 1; `443` and `8096` refused
Tripwire packets still zero	143,780 evaluations, 0 packets, after the stack came up
`zpool status erebor` `ONLINE`	yes, 0/0/0
ADR-0040's transcode	passed — VAAPI decode on `iHD`, `scale_vaapi`, `h264_qsv` encode, 5× real time. Decision 2 stands
A television plays	not yet
Both self-tests complete	running, due this evening
Port 15 reads PVID 40	not re-read in the UI since the deploy

Found while loading the test clip: no workstation can mount the media share. Hicks reaches smaug on 443 and 8096, SMB is 445, and no rule carries it. The clip went in over the console with curl. #523.

Refs #413 #223

docs(runbook): port 15 re-read after the deploy — PVID 40, untagged o…

2026-09-19, evening — the television played, and one reading is left. The body above is rewritten to match; this is the dated entry. #541 carries the repository side.

Read this evening

§7 line	Read
A television plays with no rule involved	Yes — on CasaBonita, on the screen, this evening. The claim made and withdrawn earlier today is left in the runbook as history; this one stands
Both self-tests complete	Not yet — at 10 % remaining this evening, started 2026-09-18, so they finish overnight or in the morning

And from the monitoring host, in the same hour: up{job="node",instance="smaug"} is 1 with 1,061 samples in the last 24 h, no alert carries instance="smaug", 9100 answers, 22 is refused, 443 is unreachable, erebor, erebor/media and erebor/apps all report through node_filesystem_*, and the three drivetemp sensors read 26–38 °C.

What the repository still had wrong

Two files in stacks/media/ said the stack was not deployed and brought up by make up STACK=media, two days after #522 deployed it under TrueNAS's Docker and #524 wrote the opposite in the README beside them: the header of compose.yaml, and .env.example's claim that render-config.sh regenerates .env on every make up — on smaug that file is the .env, copied unchanged. The RENDER_GID comment also still said the container half of ADR-0040's condition was "§6's to prove", a day after it was. All three are fixed in #541, with the runbook's two status blocks.

What closes this

The self-tests, read at the console — nothing in the estate can read them remotely, by design:

smartctl -l selftest /dev/sda
smartctl -l selftest /dev/sdb

Completed without error on both goes into hardware.md's Exos entry and the §7 line, and this issue closes on it. A read failure with an LBA on either drive is a return rather than a pool member, and reopens §2.

Refs #413 #223

Merge pull request #541 from Gerrrt/gerrrt/nas-smaug-casabonita-01bc0f

feat(backup): jellyfin's state is pulled off smaug from a ZFS snapsho…

2026-09-20 — both self-tests completed without error, and the build is done. #557 records it and closes this issue on merge; this is the dated entry, and the last one.

The reading

Read at the console with smartctl -l selftest, the one place in the estate that can read it:

Drive	Serial	Result	Logged at lifetime hour	LBA of first error
`sda`	`ZVTBS4NL`	`Completed without error`	25	none
`sdb`	`ZVTBSDL3`	`Completed without error`	26	none

sdb's log still shows the seller's short test at hour 0 above the extended one, consistent with §2's reading on arrival. Both drives were at 0 hours by SMART and by the FARM log when they went in; the extended test is the first real work either has done, and neither found a bad sector.

Where the build ends

Every line of build-the-nas.md §7 is now read: the television plays with no rule involved, Hicks reaches 443 and 8096, the monitoring host reaches 9100 and nothing else, the tripwire is at zero packets, port 15 reads PVID 40 in the switch UI, erebor is ONLINE with no errors, and both self-tests passed. hardware.md carries the drives' readings by serial.

What the runbook leaves open is §8, and each item there has its own tracker: #484 (erebor/apps backed up by nothing), #485 (PBS under TrueNAS), #523 (the share is television-only), #528 (no secrets file), #139 (Plex's deferral test), #446 (the ISO store and fifth rule), #140 and #141 (the other two media services).

Refs #223

Merge pull request #557 from Gerrrt/gerrrt/nas-smaug-casabonita-01bc0f

Navigation Menu

Buy and build the NAS, smaug, on CasaBonita (ADR-0016, ADR-0040) #413

What is decided

What has landed

What is left

What waits on it

Purchases this needs

Against ADR-0016's shape

What is left, in order

8 remaining items

What was read rather than assumed

Two things the runbook had wrong, now fixed

Still open here

Read this evening

What the repository still had wrong

What closes this

The reading

Where the build ends

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Buy and build the NAS, smaug, on CasaBonita (ADR-0016, ADR-0040) #413

Description

What is decided

What has landed

What is left

What waits on it

Purchases this needs

Activity

Gerrrt commented on Sep 9, 2026

Gerrrt commented on Sep 9, 2026

Against ADR-0016's shape

What is left, in order

Gerrrt commented on Sep 11, 2026

Gerrrt commented on Sep 11, 2026

Gerrrt commented on Sep 15, 2026

8 remaining items

Gerrrt commented on Sep 19, 2026

What was read rather than assumed

Two things the runbook had wrong, now fixed

Still open here

Gerrrt commented on Sep 19, 2026

Gerrrt commented on Sep 19, 2026

Read this evening

What the repository still had wrong

What closes this

Gerrrt commented on Sep 20, 2026

The reading

Where the build ends

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions