infrastructure-docs/hashicorp-stack.md

HashiCorp Stack - hobbs.farm

Overview

Production HashiCorp stack providing container orchestration, service discovery, and secrets management across the hobbs.farm infrastructure.

Cluster Architecture

┌─────────────────────────────────────────────────────────────────────┐
│                        hobbs.farm Cluster                           │
├────────────────────────────────┬────────────────────────────────────┤
│     hf-pdocker-01              │     hf-pdocker-02                  │
│     192.168.86.192             │     192.168.86.45                  │
│     (Primary)                  │     (Legacy)                       │
├────────────────────────────────┼────────────────────────────────────┤
│  Consul Server (Leader)        │  Consul Client                     │
│  Nomad Server                  │  Nomad Client                      │
│  Nomad Client                  │  node_class: legacy                │
│  Vault Server                  │  meta: disk_status=failing         │
└────────────────────────────────┴────────────────────────────────────┘

Services

Service	Version	Port	Primary URL	Notes
Consul	1.17.1	8500	http://192.168.86.192:8500	Service discovery, KV store
Nomad	1.7.3	4646	http://192.168.86.192:4646	Container orchestration
Vault	1.15.4	8200	http://192.168.86.192:8200	Secrets management

Deployed Jobs

media-stack (service)

Service	Port	Health	URL
Jellyfin	8096	✅	http://192.168.86.192:8096
Sonarr	8989	✅	http://192.168.86.192:8989
Radarr	7878	✅	http://192.168.86.192:7878
SABnzbd	8082	✅	http://192.168.86.192:8082
NZBHydra2	5076	✅	http://192.168.86.192:5076
Jellyseerr	5055	✅	http://192.168.86.192:5055

traefik (system)

Service	Port	Health	URL
HTTP	80	✅	Redirects to HTTPS
HTTPS	443	✅	Reverse proxy
Dashboard	8088	✅	http://192.168.86.192:8088

Host Volumes (hf-pdocker-01)

Volume	Path	Purpose
media	/data/media	Movies, TV, downloads
jellyfin-config	/data/configs/jellyfin	Jellyfin configuration
sonarr-config	/data/configs/sonarr	Sonarr configuration
radarr-config	/data/configs/radarr	Radarr configuration
sabnzbd-config	/data/configs/sabnzbd	SABnzbd configuration
nzbhydra-config	/data/configs/nzbhydra	NZBHydra2 configuration
jellyseerr-config	/data/configs/jellyseerr	Jellyseerr configuration
traefik-data	/data/traefik	Traefik certs & config

Vault Secrets

secret/
├── media/
│   ├── jellyfin
│   ├── sonarr
│   ├── radarr
│   ├── sabnzbd
│   ├── nzbhydra
│   └── jellyseerr
└── traefik/
    └── cloudflare (email, api_token)

Configuration Files

hf-pdocker-01 (Server)

Service	Config Path
Consul	/etc/consul.d/consul.hcl
Nomad	/etc/nomad.d/nomad.hcl, client.hcl
Vault	/etc/vault.d/vault.hcl

hf-pdocker-02 (Client)

Service	Config Path
Consul	/etc/consul.d/consul.hcl
Nomad	/etc/nomad.d/nomad.hcl, client.hcl

Operations

Check Cluster Health

# Consul cluster
consul members

# Nomad cluster
nomad server members
nomad node status

# Vault status
vault status

Job Management

# Deploy job
nomad job run <job.hcl>

# Check job status
nomad job status <job-name>

# View allocations
nomad job allocs <job-name>

# View logs
nomad alloc logs <alloc-id> <task-name>

# Stop job
nomad job stop <job-name>

Service Restarts

# On hf-pdocker-01
systemctl restart consul nomad vault

# On hf-pdocker-02
systemctl restart consul nomad

IaC Repository

All job specifications are stored in Gitea:

• Repo: jeremy/ansible-homelab
• Path: nomad-jobs/
  • media-stack.nomad.hcl
  • traefik.nomad.hcl

Security Notes

• Vault root token stored in /tmp/vault-init.json on hf-pdocker-01 (move to secure location)
• Consul encryption enabled with shared key
• mTLS not configured (internal network only)
• Cloudflare API token in Vault for Let's Encrypt DNS challenge

---

Last Updated: 2026-02-04 Maintained by: Pluto 🪐