# Deep Optimization — June 5, 2026 Session

## What was done
Full end-to-end server audit with online research (PGTune, kernel params, Docker daemon hardening, UFW firewall). Executed all 20 items from priority list.

## Applied configurations

### PostgreSQL (PGTune — 64GB RAM / 32 CPUs / SSD / Web)
- shared_buffers: 16GB (was 128MB)
- effective_cache_size: 48GB
- maintenance_work_mem: 2GB
- wal_buffers: 64MB
- random_page_cost: 1.1
- effective_io_concurrency: 200
- work_mem: 32MB
- max_worker_processes: 32

Config written to: /etc/postgresql/17/main/conf.d/pgtune.conf

### Redis
- maxmemory: 4GB (was unlimited)
- maxmemory-policy: allkeys-lru

### Docker daemon
- live-restore: true
- no-new-privileges: true
- icc: false
- userland-proxy: false
- log-driver: json-file with max-size=10m, max-file=3

### UFW firewall
- Default deny incoming
- Only allow: lo, tailscale0, 192.168.1.0/24
- Explicitly blocked: 0.0.0.0 access to hermes (18789), dashboard (9119), llama-swap (9292), open-terminal (8000), HTTP (80)

### Fail2ban jails added
- nginx-http-auth (5 retries, 10min find, 1h ban)
- nginx-botsearch (10 retries, 10min find)

### GRUB kernel params
- Added: transparent_hugepage=madvise, net.core.somaxconn=65535

### Sysctl live
- net.core.somaxconn=65535
- vm.swappiness=10
- vm.vfs_cache_pressure=50

### Nginx security headers
- Added: HSTS (1 year), CSP (restrictive), Permissions-Policy, rate limiting (30r/s)

### Open WebUI hardening
- CORS locked from `*` to `http://localhost:3081`
- Removed: ENABLE_CODE_INTERPRETER, ENABLE_CODE_EXECUTION, ENABLE_ADMIN_EXPORT

### SSH hardening
- PasswordAuthentication: no
- X11Forwarding: no

### Filesystem
- Added noatime to / in fstab
- TRIM: weekly fstrim already active

### Trivy installed
- Version 0.71.0

## Server state at audit
- All 6 drives: SMART PASSED (0 reallocs, 0 pending)
- RAID0 md0: clean, 2 active devices, 0 events
- GPU: 68C, 136W/250W, 70% VRAM (7.9/11GB)
- llama-server: 31 segfaults in 30 days
- Uptime: 8 days, 0 crashes
- Disk: 36% used (137GB free on 221GB NVMe)

## Container memory (cgroup)
- open-webui: 942MB (now limited to 4GB)
- nexstream-scraper: 66MB (limited 1GB)
- searxng-core: 161MB (limited 512MB)
- searxng-valkey: 7.2MB (limited 256MB)

## Remaining items (not executed)
- userns-remap: requires careful volume migration
- Automated backups to /backup: no script exists yet
- nexus-scraper unhealthy state: predates audit, needs separate investigation