spektr
69930f815a
- workload_accounts: gn-media (GID 970), gn-download (983), gn-dashboard (984); gn-media als primäre Gruppe der Pipeline-Konten — AUTH_SYS ueber NFSv4 wirkte serverseitig nicht mit Supplementary-Gruppen (Betriebsbefund 30.10.2026); Sudoers des Deploy-Kontos auf (ALL:ALL) verbreitert (become_user) - video_encoding: NFS-Client, Mount-Unit und Pipeline-Layout auf dem Export (10.0.0.2:/media/datenhdd3/Encoding -> /var/lib/ghostnet-pipeline, ausserhalb der Homes); Layout-Anlage als Dienstkonten wegen root_squash; Verifikation der Verzeichnisrechte als gn-encoding (2777/2770/0750/2750, Gruppe 970) - pve_media_cron: Legacy-Crontab (chown root:root + chmod -R 0777 auf allen Medienplatten, alle 10 min) entfernt — haette jedes echte Berechtigungsmodell plattgewalzt; Backup unter /var/backups/ghostnet/pve/; verify-production prueft das Fehlen ab - verify-pipeline-handover.yml: Handover-Simulation über alle Identitaeten (CT-101-.dlc-Drop -> gn-download -> queue -> gn-encoding -> output/state -> gn-dashboard); einmal vollstaendig bestanden (30.10.2026) - Doku: GNENC-000/001/002, GNAI-017 (6.10/6.11), GNMON-001 auf Stand gebracht Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
Video encoding baseline
The video_encoding role manages the CPU-only video encoding workload
baseline for the locked gn-encoding service account (UID/GID 982) on
ghostnet-ki.
It verifies the account identity, the locked password and the deterministic
subordinate ID ranges, enforces the absence of GPU device groups, manages the
root-owned configuration directory and the administrator-managed rootless
Quadlet directory, and proves that the account cannot read /dev/kfd or any
DRM render node and uses its own rootless Podman store.
Pipeline storage comes from the PVE-host NFS export
(10.0.0.2:/media/datenhdd3/Encoding, GNAI-017/GNAI-019), mounted at
/var/lib/ghostnet-encoding/pipeline inside the account home — the home
itself is not the mountpoint, so the rootless Podman store below it stays
visible. The role installs the NFS client, manages the systemd mount unit and
creates the pipeline directory layout (input/, jd/, queue/, work/,
output/, state/, one subdirectory per HandBrake profile) as the service
accounts over NFS, because root_squash prevents root-owned creation. The
layout ownership and modes (2777 on the SMB-facing trees, 2770/0750/2750
elsewhere, group gn-media GID 970) are verified after convergence
(GNENC-002 section 4).
While no encoder image is selected (video_encoding_image empty), the role
additionally guards that no Quadlet file and no container exists for the
account. Encoder image, schedule, resource limits and health checks remain
gated by the open decisions in docs/platform/llm-server/encoding/GNENC-001
and are not assumed here.
The account itself is created by the shared workload_accounts role in the
host project (llm-server/host/ansible), together with gn-download (983),
gn-dashboard (984) and the shared group gn-media (GID 970); this role
requires the host baseline to be applied first.
The file handover between the pipeline identities is exercised by
playbooks/verify-pipeline-handover.yml.