# Video encoding baseline

The `video_encoding` role manages the CPU-only video encoding workload
baseline for the locked `gn-encoding` service account (UID/GID 982) on
`ghostnet-ki`.

It verifies the account identity, the locked password and the deterministic
subordinate ID ranges, enforces the absence of GPU device groups, manages the
root-owned configuration directory and the administrator-managed rootless
Quadlet directory, and proves that the account cannot read `/dev/kfd` or any
DRM render node and uses its own rootless Podman store.

Pipeline storage comes from the PVE-host NFS export
(`10.0.0.2:/media/datenhdd3/Encoding`, GNAI-017/GNAI-019), mounted at
`/var/lib/ghostnet-encoding/pipeline` inside the account home — the home
itself is not the mountpoint, so the rootless Podman store below it stays
visible. The role installs the NFS client, manages the systemd mount unit and
creates the pipeline directory layout (`input/`, `jd/`, `queue/`, `work/`,
`output/`, `state/`, one subdirectory per HandBrake profile) as the service
accounts over NFS, because `root_squash` prevents root-owned creation. The
layout ownership and modes (2777 on the SMB-facing trees, 2770/0750/2750
elsewhere, group `gn-media` GID 970) are verified after convergence
(GNENC-002 section 4).

While no encoder image is selected (`video_encoding_image` empty), the role
additionally guards that no Quadlet file and no container exists for the
account. Encoder image, schedule, resource limits and health checks remain
gated by the open decisions in `docs/platform/llm-server/encoding/GNENC-001`
and are not assumed here.

The account itself is created by the shared `workload_accounts` role in the
host project (`llm-server/host/ansible`), together with `gn-download` (983),
`gn-dashboard` (984) and the shared group `gn-media` (GID 970); this role
requires the host baseline to be applied first.

The file handover between the pipeline identities is exercised by
`playbooks/verify-pipeline-handover.yml`.