ultix/questions-v1.md

questions-v1 — ultix-streaming optimization

Answer inline under each A:. Where I have a recommendation it is marked REC; "ok" is a sufficient answer. Version the file (v2) for another round.

Q1. Host audit (required first, blocks host-side numbers)

I cannot ssh from crush (tool policy), so run:

ssh root@pfv-tsys5.knel.net 'bash -s' < ~/projects/ultix/host-audit.sh > ~/projects/ultix/host-audit.out

then just say "audit done". I read the file and finalize §3 of REPORT.md. A:

Q2. CPU upgrade

REC: 2× Xeon X5675 (LGA1366, 6C/12T each, 95W, $25 each used) → 24 threads. Cheaper alt: second E5620 ($10) → 16 threads. Audit confirms the chassis is dual-socket before you buy. A:

Q3. RAM

REC: populate CPU2 DIMM slots to 192G total, give this VM 128G, ballooning off. Which DIMMs to order comes from the audit (current population + speed). A:

Q4. Root growth to 500G

REC: you run qm resize <id> scsi0 +80G, I do the in-guest MBR shuffle (online except a brief swapoff; backups of fstab + partition table first). When? A:

Q5. GPUs

Models + VRAM of the two incoming cards, and when? PSU wattage on the host (sticker)? Old card: passthrough to this VM now, or leave for preprod? Why it matters: no Above-4G-Decoding on this-era BIOS; big-VRAM cards may not map. UEFI-only vBIOS cards would force the OVMF migration. A:

Q6. q35 switch

REC: yes, one offline window, NIC rename expected in guest (tailscale survives). Needed for clean GPU/USB3 passthrough. A:

Q7. Account → slice names

accounts.tsv says: reachableceo, TSGBOD, TSGCOO, TSGCTO, TSGCCO, reachableceo-offstage, COSRCEO-Personal, COSRCEO-Biz, COSWFO. /home currently shows: COS-RCEO, COS-TSG, COS-WFO, ... Which 9 login names are final on THIS host? (I generate one slice + user drop-in per account.) A:

Q8. Per-account memory fences

REC interim (48G): each account MemoryHigh 3G / Max 4.5G. REC post-upgrade (128G): High 10G / Max 12G. CPU: weight 75, no hard quota (burstable). OK? A:

Q9. Desktop

REC: keep KDE, fix the greeter (autologin into a locked session), Sunshine + Moonlight after the GPU lands (NVENC). XFCE only if Sunshine capture on KDE Wayland disappoints. OK to apply the autologin+lock config? A:

Q10. Metrics/pressure wiring

REC: node_exporter as a compose service (house-style, digest-pinned) scraped by your existing mopac-harness prometheus; PSI textfile script for per-slice pressure; gateway polls node_exporter directly in its 30s tick (option A, no new dependency). Keep beszel for the human dashboard. Where does the beszel hub live? A:

Q11. k8s

Control plane: where/what (k3s? existing cluster?)? REC: join AFTER host upgrade, worker-only, low PriorityClass for burst workloads, kubelet eviction thresholds, kubelet+containerd fenced to CPUWeight 20 + MemoryHigh. OK? A:

Q12. Proxmox control scope

REC: dedicated API token (ukrrs-infra@pam harness) scoped to a preprod pool only. Which VMIDs may the harness stand down/snapshot, and which are PROTECTED (this VM certainly)? I hard-code the PROTECTED list into proxmox-ctl.sh. A:

Q13. SDRs

REC: passthrough both PCI USB3 controller cards whole (never per-device), SDR processes pinned to the rt CPU pool. Confirm: both cards → THIS VM, always-on? Any latency budget I should know about? A:

Q14. Day/night windows

REC: OS night profile 22:00-05:00 local; gateway z.ai peak ladder stays 01:00-05:00 CST as configured. Confirm 22:00-05:00 (vs your words "2200 to 0500") and the timezone the guest should key off (it currently sees system TZ). A:

Q15. Agent Zero

Which accounts host it, expected concurrent agents, docker-based? REC: background agents → ukrrs-batch.slice, interactive ones → their account slice. A:

Q16. TCP BBR

REC: load tcp_bbr module + bbr/fq for the long provider streams. If you prefer stock cubic, say so and I drop two lines. A:

Audit update 2026-08-31 (host-audit.out parsed; details in REPORT.md section 8)

• Q1 DONE. Q2 upgraded to URGENT: CPU2 socket confirmed empty; one E5620 serves 24 running VMs. 2× X5675 triples threads. (DMI claims LGA771, a Dell string quirk; E5620 is LGA1366; verify visually before ordering.)
• Q3 refined: 6× 16GB DDR3 already fill all CPU1 slots; order 6 more 16GB.
• Q5 verdict: skip Quadro 4000 passthrough (Fermi: no NVENC, no modern CUDA driver). Still need: new GPU models/VRAM + PSU wattage sticker.
• Q13 wrinkle: only ONE USB3 card visible on the host. Where is the second?
• Q11 wrinkle: VM 500 pfv-k8s-wnode-tsys5 already exists here: join or consolidate?
• IOMMU groups are clean (no ACS override needed). No cpufreq driver exists anywhere, so day/night stays pure cgroup (already the design).

Q17. VM 5111 auto-start

Audit shows onboot unset: after any host reboot your workstation stays DOWN until manually started. OK to set onboot=1 with startup order 10? A:

Q18. Remote-desktop matrix (audit correction: xrdp IS running, sesman too)

Confirmed live: xrdp + xrdp-sesman = your Jump RDP path (my earlier "no xrdp" was a bad probe, my error). Sunshine installed but not running. Two human accounts, both with always-alive KDE (reachableceo 1001, -offstage 1010). REC: keep xrdp for iPad quick-attach (verify /etc/xrdp/sesman.ini KillDisconnected=false so sessions persist); start Sunshine only after the compute GPUs land and use Moonlight for the video/audio editing sessions (NVENC + proper audio); sddm autologin keeps a warm console session for that. Confirm? And which account hosts the media-editing workload? A:

Q11 partial (2026-08-31): consolidation decided

VM 500 pfv-k8s-wnode-tsys5 removed; ultix-streaming will be THE k8s worker on this host. Still open: control plane location/type (k3s?), and timing (rec: join after Friday's CPU/RAM resize, worker-only, kubelet+containerd fenced at CPUWeight 20 + MemoryHigh, low PriorityClass + eviction thresholds per REPORT 5.3). A (control plane + timing):