Skip to content
Spelvin Wiki

Pam (NAS)

Synology DS1517+, on the home network at 192.168.1.16 (SSH alias nas) and also on the tailnet as pam (100.109.83.48). 7 TB volume, 652 GB used.

Docker runs via Synology’s Container Manager (docker lives at /usr/local/bin/docker, not on the default $PATH; the nas SSH user has passwordless sudo scoped to that one binary, not general root).

What’s actually running

Section titled “What’s actually running”

Active — a monitoring stack (Compose project infra, now tracked in docker-infra/monitoring at /volume1/docker/docker-infra/monitoring/docker-compose.yml, deployed automatically on push via Gitea Actions - see that repo’s README. This is the one service directory in docker-infra that deploys to Pam instead of Lana, since Pam has no git access: the workflow pushes the compose file over SSH rather than pulling. The old untracked copy at /volume1/docker/monitoring/infra/ has been renamed aside (infra.superseded-by-vps-infra-git - name predates this repo’s own rename, left as-is since it’s just a retired marker), not deleted, in case anything still points at it):

  • Grafana, running a custom grafana-lunar-outpost image with GF_USERS_DEFAULT_THEME=lunar-outpost set by default. This predates — and wasn’t cross-referenced by — the Lunar-Outpost design system repo’s own “already shipped” table; worth adding it there as a sixth canonical surface.
  • InfluxDB 2, bucket homeassistant, org home — this is where Home Assistant’s metrics land for long-term storage and the Grafana dashboards read from.

Both on the infra_default Docker network, restart: unless-stopped, exposed on the LAN at :3000 (Grafana) and :8086 (InfluxDB).

Stopped, but present — a second constellation of containers, all exited about 5 weeks before this was last checked (uniform timing suggests a NAS reboot or mass stop, not per-project retirement), corresponding to repos in ~/dev on the Mac:

  • solar_* (solar_ha_control, solar_decision_engine, solar_modeling, solar_forecast, solar_extractor, solar_dashboard, solar_timescaledb) — the solar-energy-optimizer project. Has its own TimescaleDB, separate from the InfluxDB above.
  • comfort_air_* (comfort_air_ha_runner, comfort_air_engine, comfort_air_extractor) — the comfort-air-controller project.
  • household-ai-scheduler, household-ai-discord, ollama-embeddings — the household-ai-advisor project, including a Discord bot.

Whether these are meant to be running again or were deliberately stopped is unconfirmed from the outside — worth checking before assuming either way.

Role

Section titled “Role”

Pam is home-automation compute and metrics storage, not a general backup/file target — despite being a NAS, nothing here is being used for bulk storage or as a backup destination for Lana or Krieger. Lana currently has no offsite/off-box backup path at all; if one gets built, Pam (already on the tailnet, already reachable from Lana) is the obvious candidate.

Gaps to fill in

Section titled “Gaps to fill in”
  • Whether the stopped solar_*/comfort_air_*/household-ai-* stacks should be running, and if so, why they aren’t.
  • DSM version: confirmed 7.3.1 (via /etc/VERSION on the NAS). What else (if anything) runs outside Docker — file shares, Synology’s own packages, etc. — is still unconfirmed.
  • Grafana now authenticates via Authentik SSO (GF_AUTH_GENERIC_OAUTH_* env vars in monitoring/docker-compose.yml point at auth.spelvin.dev). A comment in that file says “same pattern as Synology DSM,” implying DSM’s own login has also been switched to Authentik SSO — not independently confirmed on the NAS itself, worth checking directly.
  • The credentials embedded in the infra stack’s container env (Grafana/InfluxDB admin passwords, an InfluxDB API token) turned up in plain text during this audit — worth rotating regardless of whether they’re otherwise exposed anywhere.