# Pending Commands

Commands that need to be run on servers. Move to **Done** after confirmation.

---

## Pending

### P1 — This week

#### CT102: Add CrowdSec bouncer for NPM
```bash
# Install nginx-proxy-manager bouncer for crowdsec
# See: https://docs.crowdsec.net/docs/bouncers/nginx-proxy-manager
```
_Why: CrowdSec running but no bouncer — IPS observing but not blocking_

### P2 — After visual comparison
- **Bazarr**: set OpenSubtitles.com credentials, create Russian language profile, assign to Sonarr/Radarr (visit bazarr.ai-impress.com → Settings → Providers)
- **After dashboard comparison**: keep 1-2 from Glance/Dashy/Dashbrr, destroy others (`docker compose down && rm -rf /opt/services/dashy` or dashbrr)

---

## Done

| Date | Command | Result |
|------|---------|--------|
| 2026-05-03 | Live audit of pve server | Completed — all files updated in Obsidian |
| 2026-05-03 | Router DNS updated | 192.168.1.62 → 192.168.1.225 (done by user) |
| 2026-05-03 | CT105 Immich GPU fix | Already fixed (native LXC, dev1/dev2 removed, immich running) |
| 2026-05-03 | CT102 fstrim | 99.39% → 35.81%, issue_discards=1 enabled in lvm.conf |
| 2026-05-03 | CT101 destroyed | pct stop 101 && pct destroy 101 --purge |
| 2026-05-03 | NPM dead proxies removed | id=5,6,8,12,20 deleted; id=10 updated to :8053; id=26 trimmed |
| 2026-05-03 | Stirling-PDF OIDC | Already fixed (SECURITY_ENABLELOGIN=false, no OAuth in compose) |
| 2026-05-03 | docker-socket-proxy → localhost | Recreated with -p 127.0.0.1:2376:2375 |
| 2026-05-03 | rpcbind :111 closed | systemctl disable --now rpcbind rpcbind.socket |
| 2026-05-03 | Tailscale subnet-router | 192.168.1.0/24 advertised + approved in admin console; IP forwarding enabled in /etc/sysctl.d/99-tailscale.conf |
| 2026-05-03 | Promtail for Loki | Added to /opt/monitoring/docker-compose.yml, container running, Docker targets discovered |
| 2026-05-03 | vzdump restore drill | CT102 backup restored as CT999, hostname verified, CT999 destroyed |
| 2026-05-03 | Glance dashboard categories | 7 app categories added: Media/Cloud/Productivity/Security/Tools/Photos/Admin |
| 2026-05-03 | Vaultwarden OIDC removed | SSO lines deleted from compose, container recreated cleanly |
| 2026-05-03 | qBit compose port 6881→50000 | docker-compose updated, container recreated (WebUI port + router still needed) |
| 2026-05-03 | Jellyseerr TZ fix | Europe/Kiev → Europe/London + log rotation added |
| 2026-05-03 | Log rotation all CT102 services | json-file max-size:10m added to 22 services + nextcloud + karakeep + CT111 media |
| 2026-05-03 | Jellyfin webhooks Sonarr/Radarr | API key 121facab.. created; Sonarr/Radarr connections updated; onDownload+onRename=true |
| 2026-05-03 | Karakeep OIDC disabled | AUTH_OIDC_ENABLED=false, 4 Authentik lines removed, container recreated |
| 2026-05-03 | Paperless OIDC cleared | oidc.env emptied (Authentik provider removed), paperless restarted |
| 2026-05-03 | Authentik stopped | docker compose down in /opt/services/authentik/ (was already stopped) |
| 2026-05-03 | qBit port 50000 applied | qBittorrent.conf Session.Port=50000, compose 50000:50000, container recreated |
| 2026-05-03 | Bazarr added CT111 | lscr.io/linuxserver/bazarr:latest, port 6767, Sonarr+Radarr connected, NPM proxy added |
| 2026-05-03 | Recyclarr added CT111 | ghcr.io/recyclarr/recyclarr:latest, config at /opt/media/recyclarr/recyclarr.yml |
| 2026-05-03 | Russian 1080p minFormatScore | Sonarr+Radarr profile 7 updated: minFormatScore=100 (requires Russian audio) |
| 2026-05-03 | Jellyfin metadata language | PreferredMetadataLanguage=ru, MetadataCountryCode=RU via API |
| 2026-05-03 | qBit categories | tv-sonarr/movies-radarr/manual with correct save paths in categories.json |
| 2026-05-03 | Router port forward 50000 | qBittorrent 50000 All → 192.168.1.230:50000 added and enabled |
| 2026-05-03 | Dashy deployed | lissy93/dashy:latest, port 8086, dashy.ai-impress.com, 8 categories with status checks |
| 2026-05-03 | Dashbrr deployed | ghcr.io/autobrr/dashbrr:latest, port 8087, dashbrr.ai-impress.com |
| 2026-05-03 | Dashbrr connected | Sonarr ✅ Radarr ✅ Prowlarr ✅ qBit ✅ (subnet whitelist 172.16.0.0/12 added) |
| 2026-05-03 | qBit UPnP disabled | Connection\UPnP=false in qBittorrent.conf |
| 2026-05-03 | SSL certs for dashy/dashbrr/bazarr | Wildcard *.ai-impress.com (id=2) attached to proxy hosts 34/35/36 |
| 2026-05-03 | NPM password reset | admin@ai-impress.com → Homelab2026! (set via SQLite+bcrypt) |

---

## Notes

- Commands for CT102 Docker services always via: `ssh pve "pct exec 102 -- bash -lc '...'"` or `ssh pve "pct exec 102 -- docker compose -f /path/to/compose.yml ..."`
- After any DNS change: flush on clients and wait for DHCP lease renewal (24h default)
- NPM admin: http://192.168.1.225:81 — login: admin@ai-impress.com / **Homelab2026!**
- Dashbrr: https://dashbrr.ai-impress.com — login: admin / **Homelab2026!**
- fstrim for CT disks: mount /dev/mapper/pve-vm--<ID>--disk--0 /mnt/trim-ctXXX && fstrim -v /mnt/trim-ctXXX && umount (from pve host, container running is OK)
- Tailscale subnet approved in admin: https://login.tailscale.com/admin/machines → pve → Edit route settings
