# 2026-07-05 Debian 13 Server Audit

## Corrections to Prior Context
Prior compaction summary claimed 3 issues that were incorrect:
- ❌ "No firewall" → ufw IS active with granular rules, just `/usr/sbin/` not in PATH
- ❌ "nvidia-smi not found" → installed at `/usr/bin/nvidia-smi`, typo in prior audit (`nvsmi`)
- ❌ "5 idle Docker bridges" → only 1 was idle (br-8b0f758a5569, openwebui_openwebui-net), 4 had active containers

## Hardware
| Component | Detail |
|-----------|--------|
| CPU | Xeon E5-2697A v4, 32 cores @ 2.60GHz |
| RAM | 62 GiB (20 GiB free, 36 GiB cache) |
| GPU | RTX 2080 Ti, 11GB VRAM (93% used — 10,506/11,264 MB by llama-server) |
| Root disk | NVMe 221GB, 114G used (55%) |
| Data | md0 RAID0 1.5T (1% used), sda1 458G /models (20% used) |
| Backup | 1.8T /backup, 1.8T /archive (both ~0% used) |

## Services by Memory
| Service | RSS | Notes |
|---------|-----|-------|
| llama-server-sm75 | 2.3 GB | Qwythos-9B Q6_K, 93% VRAM |
| Open WebUI | 870 MB | Uvicorn, 1 worker |
| Hermes gateway | 500 MB | Gateway + dashboard |
| PostgreSQL 17 | 434 MB | |
| OpenCode server | 249 MB | |
| Prowlarr | 204 MB | Docker container |
| SearXNG worker | 159 MB | |
| Docker daemon | 105 MB | |
| Hermes dashboard | 100 MB | |
| Tailscaled | 92 MB | |

## Network — all 0.0.0.0 listeners mapped
| Port | Service | Location | Firewall |
|------|---------|----------|----------|
| 22 | SSH | Host | LAN + Tailscale |
| 80 | nginx → Open WebUI | Host | Tailscale only |
| 443 | Tailscale Funnel | Tailscale IP | via Funnel |
| 3081 | Open WebUI (direct) | Docker | LAN + Tailscale |
| 4096 | OpenCode server | Host | LAN + Tailscale |
| 8090 | TorrServer | Host (image) | LAN + Tailscale |
| 8191 | FlareSolverr | Docker bridge | Docker bridge |
| 8800 | Ultimate Stream Web UI | Host | LAN + Tailscale |
| 9117 | Jackett | Docker (image only) | LAN + Tailscale |
| 9119 | Hermes dashboard | Host | LAN + Tailscale |
| 9292 | llama-swap | Host | LAN + Tailscale + Docker |
| 9696 | Prowlarr | Docker bridge | Docker bridge |
| 18788-9 | Hermes gateway | Host | Tailscale only |

## Fixed Issues
1. **open-terminal.service** — removed (DNS-broken `uvx` bootstrap)
2. **br-8b0f758a5569 (openwebui_openwebui-net)** — removed (0 containers, DOWN)
3. **TorrServer :8090, Jackett :9117, Ultimate Stream :8800** — restricted from "Anywhere" to LAN + Tailscale only

## Issues Found
| Severity | Issue | Action |
|----------|-------|--------|
| P0 | 38 pending OS updates | `apt upgrade` |
| P1 | Docker build cache: 3.96 GB (78 items, 0 active) | `docker builder prune -f` |
| P1 | Stale strix-sandbox image: 7.38 GB (container `nifty_jennings` exited) | `docker image rm` |
| P2 | No unattended-upgrades auto-timer | Create `/etc/apt/apt.conf.d/20auto-upgrades` |
| P2 | 4 overlapping sysctl files with conflict on `vfs_cache_pressure` | Consolidate into `99-server-tuning.conf` |
| P3 | 7 of 11 Docker volumes dangling (1.17 GB) | `docker volume prune -f` |
| P3 | No Docker resource limits on any container | Add mem limits per docker-compose |
| P4 | /home/rurouni consumes 48 GB on root | Consider moving to /data/ |

## Sysctl — active values (verified)
| Param | Active | Source file |
|-------|--------|-------------|
| swappiness | 10 | 99-hermes.conf (overrides) |
| vfs_cache_pressure | 50 | 99-hermes.conf (overrides 99-server-optimization's 200) |
| dirty_ratio | 30 | 99-server-optimization.conf |
| dirty_background_ratio | 5 | 99-server-optimization.conf |
| min_free_kbytes | 524288 | 99-server-optimization.conf |
| overcommit_memory | 1 | 99-server-optimization.conf |
| max_map_count | 1048576 | 99-server-optimization.conf |
| somaxconn | 65535 | boot param + sysctl |
| tcp_congestion_control | bbr | Kernel built-in |
| net.core.default_qdisc | fq | Kernel built-in |
| tcp_fastopen | 3 | 99-server-optimization.conf |
| kernel.pid_max | 4194304 | 99-server-optimizations.conf |

## Nginx Config
- Well-configured: streaming proxies (buffering off, 3600s+ timeouts), security headers, rate limiting on scraper
- Sites: `openwebui` (80 → 3081), `nexstream-scraper` (localhost:3089 → Docker)
- Worker connections 65535, epoll, multi_accept, sendfile on

## Storage Layout
```
nvme0n1  (238.5G)  → root + swap + EFI
sda      (465.8G)  → /models (86G used, 20%)
sdb+sde  (RAID0)   → /data (4.1G used, <1%)
sdc      (1.8T)    → /backup (essentially empty)
sdd      (1.8T)    → /archive (6G used)
```