# HashiCorp Stack - hobbs.farm

## Overview

Production HashiCorp stack providing container orchestration, service discovery, and secrets management across the hobbs.farm infrastructure.

## Cluster Architecture

```
┌─────────────────────────────────────────────────────────────────────┐
│                        hobbs.farm Cluster                           │
├────────────────────────────────┬────────────────────────────────────┤
│     hf-pdocker-01              │     hf-pdocker-02                  │
│     192.168.86.192             │     192.168.86.45                  │
│     (Primary)                  │     (Legacy)                       │
├────────────────────────────────┼────────────────────────────────────┤
│  Consul Server (Leader)        │  Consul Client                     │
│  Nomad Server                  │  Nomad Client                      │
│  Nomad Client                  │  node_class: legacy                │
│  Vault Server                  │  meta: disk_status=failing         │
└────────────────────────────────┴────────────────────────────────────┘
```

## Services

| Service | Version | Port | Primary URL | Notes |
|---------|---------|------|-------------|-------|
| Consul | 1.17.1 | 8500 | http://192.168.86.192:8500 | Service discovery, KV store |
| Nomad | 1.7.3 | 4646 | http://192.168.86.192:4646 | Container orchestration |
| Vault | 1.15.4 | 8200 | http://192.168.86.192:8200 | Secrets management |

## Deployed Jobs

### media-stack (service)
| Service | Port | Health | URL |
|---------|------|--------|-----|
| Jellyfin | 8096 | ✅ | http://192.168.86.192:8096 |
| Sonarr | 8989 | ✅ | http://192.168.86.192:8989 |
| Radarr | 7878 | ✅ | http://192.168.86.192:7878 |
| SABnzbd | 8082 | ✅ | http://192.168.86.192:8082 |
| NZBHydra2 | 5076 | ✅ | http://192.168.86.192:5076 |
| Jellyseerr | 5055 | ✅ | http://192.168.86.192:5055 |

### traefik (system)
| Service | Port | Health | URL |
|---------|------|--------|-----|
| HTTP | 80 | ✅ | Redirects to HTTPS |
| HTTPS | 443 | ✅ | Reverse proxy |
| Dashboard | 8088 | ✅ | http://192.168.86.192:8088 |

## Host Volumes (hf-pdocker-01)

| Volume | Path | Purpose |
|--------|------|---------|
| media | /data/media | Movies, TV, downloads |
| jellyfin-config | /data/configs/jellyfin | Jellyfin configuration |
| sonarr-config | /data/configs/sonarr | Sonarr configuration |
| radarr-config | /data/configs/radarr | Radarr configuration |
| sabnzbd-config | /data/configs/sabnzbd | SABnzbd configuration |
| nzbhydra-config | /data/configs/nzbhydra | NZBHydra2 configuration |
| jellyseerr-config | /data/configs/jellyseerr | Jellyseerr configuration |
| traefik-data | /data/traefik | Traefik certs & config |

## Vault Secrets

```
secret/
├── media/
│   ├── jellyfin
│   ├── sonarr
│   ├── radarr
│   ├── sabnzbd
│   ├── nzbhydra
│   └── jellyseerr
└── traefik/
    └── cloudflare (email, api_token)
```

## Configuration Files

### hf-pdocker-01 (Server)
| Service | Config Path |
|---------|-------------|
| Consul | /etc/consul.d/consul.hcl |
| Nomad | /etc/nomad.d/nomad.hcl, client.hcl |
| Vault | /etc/vault.d/vault.hcl |

### hf-pdocker-02 (Client)
| Service | Config Path |
|---------|-------------|
| Consul | /etc/consul.d/consul.hcl |
| Nomad | /etc/nomad.d/nomad.hcl, client.hcl |

## Operations

### Check Cluster Health
```bash
# Consul cluster
consul members

# Nomad cluster
nomad server members
nomad node status

# Vault status
vault status
```

### Job Management
```bash
# Deploy job
nomad job run <job.hcl>

# Check job status
nomad job status <job-name>

# View allocations
nomad job allocs <job-name>

# View logs
nomad alloc logs <alloc-id> <task-name>

# Stop job
nomad job stop <job-name>
```

### Service Restarts
```bash
# On hf-pdocker-01
systemctl restart consul nomad vault

# On hf-pdocker-02
systemctl restart consul nomad
```

## IaC Repository

All job specifications are stored in Gitea:
- **Repo:** `jeremy/ansible-homelab`
- **Path:** `nomad-jobs/`
  - `media-stack.nomad.hcl`
  - `traefik.nomad.hcl`

## Security Notes

- Vault root token stored in `/tmp/vault-init.json` on hf-pdocker-01 (move to secure location)
- Consul encryption enabled with shared key
- mTLS not configured (internal network only)
- Cloudflare API token in Vault for Let's Encrypt DNS challenge

---

*Last Updated: 2026-02-04*
*Maintained by: Pluto 🪐*