spektr
69930f815a
- workload_accounts: gn-media (GID 970), gn-download (983), gn-dashboard (984); gn-media als primäre Gruppe der Pipeline-Konten — AUTH_SYS ueber NFSv4 wirkte serverseitig nicht mit Supplementary-Gruppen (Betriebsbefund 30.10.2026); Sudoers des Deploy-Kontos auf (ALL:ALL) verbreitert (become_user) - video_encoding: NFS-Client, Mount-Unit und Pipeline-Layout auf dem Export (10.0.0.2:/media/datenhdd3/Encoding -> /var/lib/ghostnet-pipeline, ausserhalb der Homes); Layout-Anlage als Dienstkonten wegen root_squash; Verifikation der Verzeichnisrechte als gn-encoding (2777/2770/0750/2750, Gruppe 970) - pve_media_cron: Legacy-Crontab (chown root:root + chmod -R 0777 auf allen Medienplatten, alle 10 min) entfernt — haette jedes echte Berechtigungsmodell plattgewalzt; Backup unter /var/backups/ghostnet/pve/; verify-production prueft das Fehlen ab - verify-pipeline-handover.yml: Handover-Simulation über alle Identitaeten (CT-101-.dlc-Drop -> gn-download -> queue -> gn-encoding -> output/state -> gn-dashboard); einmal vollstaendig bestanden (30.10.2026) - Doku: GNENC-000/001/002, GNAI-017 (6.10/6.11), GNMON-001 auf Stand gebracht Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
38 lines
2.0 KiB
Markdown
38 lines
2.0 KiB
Markdown
# Video encoding baseline
|
|
|
|
The `video_encoding` role manages the CPU-only video encoding workload
|
|
baseline for the locked `gn-encoding` service account (UID/GID 982) on
|
|
`ghostnet-ki`.
|
|
|
|
It verifies the account identity, the locked password and the deterministic
|
|
subordinate ID ranges, enforces the absence of GPU device groups, manages the
|
|
root-owned configuration directory and the administrator-managed rootless
|
|
Quadlet directory, and proves that the account cannot read `/dev/kfd` or any
|
|
DRM render node and uses its own rootless Podman store.
|
|
|
|
Pipeline storage comes from the PVE-host NFS export
|
|
(`10.0.0.2:/media/datenhdd3/Encoding`, GNAI-017/GNAI-019), mounted at
|
|
`/var/lib/ghostnet-encoding/pipeline` inside the account home — the home
|
|
itself is not the mountpoint, so the rootless Podman store below it stays
|
|
visible. The role installs the NFS client, manages the systemd mount unit and
|
|
creates the pipeline directory layout (`input/`, `jd/`, `queue/`, `work/`,
|
|
`output/`, `state/`, one subdirectory per HandBrake profile) as the service
|
|
accounts over NFS, because `root_squash` prevents root-owned creation. The
|
|
layout ownership and modes (2777 on the SMB-facing trees, 2770/0750/2750
|
|
elsewhere, group `gn-media` GID 970) are verified after convergence
|
|
(GNENC-002 section 4).
|
|
|
|
While no encoder image is selected (`video_encoding_image` empty), the role
|
|
additionally guards that no Quadlet file and no container exists for the
|
|
account. Encoder image, schedule, resource limits and health checks remain
|
|
gated by the open decisions in `docs/platform/llm-server/encoding/GNENC-001`
|
|
and are not assumed here.
|
|
|
|
The account itself is created by the shared `workload_accounts` role in the
|
|
host project (`llm-server/host/ansible`), together with `gn-download` (983),
|
|
`gn-dashboard` (984) and the shared group `gn-media` (GID 970); this role
|
|
requires the host baseline to be applied first.
|
|
|
|
The file handover between the pipeline identities is exercised by
|
|
`playbooks/verify-pipeline-handover.yml`.
|