Mirrored page

Mirrored from inva-infrastructure — that repository is authoritative for live engineering state; update it first, then refresh this mirror. This page reflects the 2026-07-16 local-offload buildout.

inva-local-01 — Local RTX 3080 AI / NAS Server¶

Physical box (hostname inva-ai-lab) at the local site. WireGuard overlay peer 10.30.0.4. As of 2026-07-16 it is the primary local-offload host under the locked local-offload topology: local LLM inference, embeddings, RAG, the Emma data layer (Postgres + Redis), and the INVA NAS over WireGuard. It is compute + authoritative application data (backed up to its own cold tier); it is not the authoritative identity/secrets host.

Status: OPERATIONAL (2026-07-16)¶

GPU driver installed — NVIDIA driver 595.71.05, CUDA 13.2; nvidia-smi present, RTX 3080 (10 GB VRAM) serving models on-GPU.
Ollama serving at http://10.30.0.4:11434 (overlay): qwen2.5:14b (quality tier), llama3.1:8b (fast/concurrent tier), nomic-embed-text (RAG embeddings). Tuned and benchmarked — see Local AI serving.
Docker data layer live under ~inva/emma/data/: Postgres 16.14 + pgvector 0.8.5, plus a dual-Redis pair (redis-queue, redis-cache), all localhost-bound. See Data layer & RAG.
Cold storage online — sdb 1.8 TB HDD formatted ext4 → /srv/data (fstab nofail) for backups, WAL archive, snapshots, object-store, corpus.
WG self-heal active — residential-NAT link drops self-recover in ~40 s; serving path (outbound cloudflared) is unaffected.

Access (verified)¶

Path	Detail
SSH	`ssh inva-local-01` (alias in `~/.ssh/config` on the engineering VM) → `inva@10.30.0.4` over WireGuard, key `~/.ssh/inva-managed-hosts`, `BatchMode` clean
Reachability	Overlay only — no public exposure, no VPC address. WG management SSH is affected by periodic link drops (self-heal ~40 s); model serving is not (cloudflared dials outbound)
WireGuard	On-device private key (static peer, option 2); public key pinned in `ansible/roles/wg_easy/files/inva-static-peers.conf`; hub re-asserts it via `wg-static-peers.timer`
Ollama	`http://10.30.0.4:11434` (overlay)
Data stack	`~inva/emma/data/` (Docker Compose)
RAG	`~inva/emma/rag/`
Model store	`/data/ollama-models`
sudo	Passwordless for `inva`

Hardware (verified 2026-07-16)¶

Component	Value
CPU	AMD Ryzen 9 3900XT, 12c/24t
RAM	45 GiB usable
GPU	NVIDIA GeForce RTX 3080 (GA102), 10 GB VRAM — driver 595.71.05, CUDA 13.2 (operational)
Disk `sda`	Samsung 870 QVO 1 TB SSD — boot disk; LVM: 300 G root + 300 G `/srv/nas` + unallocated
Disk `sdb`	new 1.8 TB HDD → ext4 `/srv/data` (cold tier: pg-backups, WAL, snapshots, object-store, corpus; fstab `nofail`)
Disk `nvme0n1`	Samsung 512 GB NVMe — LVM `vg-data/data` → `/data` (476 G, hot: PGDATA, ollama models)
OS	Ubuntu 26.04 LTS · Docker 29.1.3 + Compose 2.40.3 (distro-native)

Container runtime & data layer¶

Docker 29.1.3 + Compose 2.40.3. The Emma data stack (~inva/emma/data/) runs:

Container	Image	Config	Bind
`postgres`	Postgres 16.14 + pgvector 0.8.5	PGDATA on NVMe; `shared_buffers=4GB`, `effective_cache_size=24GB`	localhost
`redis-queue`	Redis	1 GB, `noeviction`, AOF (durable queue/outbox)	localhost
`redis-cache`	Redis	2 GB, `allkeys-lru` (ephemeral cache)	localhost

Secrets are injected from GCP Secret Manager via agentops-secret — never inline. Full schema/RAG detail: Data layer & RAG.

Service state (2026-07-16)¶

Service	State	Note
`docker`	active	Runs the Emma data layer (Postgres + dual Redis).
`ollama`	active	Serves qwen2.5:14b / llama3.1:8b / nomic-embed-text on GPU; tuning drop-in applied.
`postgres` (container)	active	16.14 + pgvector 0.8.5; RLS enabled + forced.
`redis-queue` / `redis-cache` (containers)	active	Queue (durable) + cache (LRU).
`smbd`	active	WG-only access enforced by ufw (445 from `10.30.0.0/24`, default-deny).
`nfs-server`	inactive	Per plan (SMB-first).
ZFS	not installed	Blocked on NAS-rated mirror drives + format approval (Part R).
`sshd`	active	`PermitRootLogin prohibit-password`. Residual hardening: key-only auth.

Open items¶

PgBouncer (txn mode) — add when the Emma app connects to Postgres.
Backups — wire pg backups + WAL archive to the /srv/data cold tier.
NAS build — procure 2× NAS-rated drives → SMART long tests → ZFS mirror tank (Part R; pool creation is approval-gated on exact disk IDs).
sshd hardening — PasswordAuthentication no once key access is confirmed redundant-safe.
Optionally pull qwen2.5-coder:7b / qwen2.5:3b via the GGUF-curl path for dev/classify tiers.

Path notes¶

Hub (inva-network-01) SSH: ssh hub → inva@10.20.0.2 via VPC. 10.30.0.1:22 refuses by design (overlay address terminates inside the wg-easy container, which runs no sshd).
Raw-IP SSH (ssh 10.30.0.4) works — IPs are in the ~/.ssh/config Host lines.
Ollama multipart pull corrupts on this residential link; models are landed via a single-stream GGUF curl + ollama create. See Local AI serving.