# Full System Audit — 2026-07-05

## Context
Debian 13 (trixie), Dell Precision Tower 5810, Xeon E5-2697A v4 (32C/64T), 62 GiB RAM, RTX 2080 Ti (11 GB), 221 GiB NVMe root + 5 storage drives. Self-hosted Hermes/Open WebUI/llama-swap/scraper stack.

## Correcting Prior Audit Inaccuracies

**Firewall:** ufw was **active and well-configured**, not missing. Prior audit failed to find it because `/usr/sbin/` is not in the non-interactive shell PATH. `which ufw` and `ufw status` both fail from a non-root, non-login shell.

**NVIDIA driver:** `nvidia-smi` was at `/usr/bin/nvidia-smi` the entire time. Prior audit used a typo (`nvsmi`), reported "not found."

**Docker bridges:** Of 5 named bridges, only 1 (`openwebui_openwebui-net`, 0 containers, DOWN state) was idle — not 5. The rest are actively used.

**Lesson: Always re-verify every pre-existing audit claim against live state before acting.**

## Findings + Fixes Applied

| Issue | Resolution |
|-------|-----------|
| `open-terminal.service` — fails on restart (DNS race during `uvx` fetch from PyPI) | Removed service + unit file |
| Idle Docker bridge `openwebui_openwebui-net` (br-8b0f758a5569) | `docker network rm` |
| TorrServer :8090, Jackett :9117, Ultimate Stream UI :8800 — open to "Anywhere" on ufw | Restricted to 192.168.1.0/24 + 100.64.0.0/10 (Tailscale) |
| 38 pending apt upgrades | `apt upgrade` — all applied |
| Docker build cache — 3.96 GB, 78 items, 0 active | `docker builder prune -af` |
| Stale `strix-sandbox` image (7.38 GB) + exited `nifty_jennings` container | `docker rm` + `docker rmi` |
| Unattended-upgrades auto-timer missing | Created `/etc/apt/apt.conf.d/20auto-upgrades` (daily check, daily install, weekly autoclean) |
| Duplicate sysctl configs — 4 files, overlapping keys, one conflict (vfs_cache_pressure 200 vs 50) | Consolidated into single `99-server-tuning.conf`; removed 3 redundant files |
| Docker resource limits — none on 6 running containers | Applied via `docker update --memory <limit> --memory-swap <limit>` |

## Resource Limits Applied

| Container | Memory | Current Usage | Headroom |
|-----------|--------|--------------|----------|
| open-webui | 8 GB | 1.0 GB | 7 GB |
| nexstream-scraper | 2 GB | 87 MB | 1.9 GB |
| searxng-core | 1 GB | 198 MB | 802 MB |
| flaresolverr | 1 GB | 317 MB | 683 MB |
| prowlarr | 512 MB | 215 MB | 297 MB |
| searxng-valkey | 256 MB | 13 MB | 243 MB |

## Remaining Observations

- **GPU VRAM: 93% utilized** (10510/11264 MiB by llama-server-sm75). Only 493 MiB free.
- **TorrServer and Jackett images** installed but no running containers. 10 MB + 187 MB — negligible.
- **7 Docker volumes are "unused"** by running containers but some are referenced by stopped containers. `volume prune` is conservative — kept them.
- **No docker compose plugin installed** — all containers deployed manually.

## Key Techniques

### Docker `update --memory-swap` requirement
When setting memory limits on containers that have any prior swap config, `--memory-swap` MUST be specified in the same command. Use `--memory-swap <same_as_memory>` to disable swap for that container.

### Sysctl dedup verification
1. `ls /etc/sysctl.d/*.conf | sort` — see alphabetical load order
2. Check for overlapping parameter names across files
3. The LAST file alphabetically wins for any key
4. Verify active values: `cat /proc/sys/vm/<param>`
5. Consolidate into one file, remove the redundant files, `sysctl --system`

### Firewall restriction pattern (ufw)
```bash
# Delete old "Anywhere" rule by number
sudo ufw delete <N>

# Add restricted rules
sudo ufw allow from 192.168.1.0/24 to any port 8090 proto tcp
sudo ufw allow from 100.64.0.0/10 to any port 8090 proto tcp
```