7900X Rig Buildout

Settle these first

Three answers change what gets built. Everything else is decided.

USB kit

Two downloads on your Windows machine. Nothing else goes on the stick.

24.04 LTS is the recommendation over the newer 26.04 — it has two more years of NVIDIA and CUDA packaging shaken out, and every guide you'll hit for Ollama, Jellyfin and the Container Toolkit assumes it. Support runs to 2029 either way.

In Rufus: select the ISO, leave GPT / UEFI, write in ISO mode if prompted. Verify the download's SHA256 against the SHA256SUMS file on the Ubuntu releases page first — a corrupt ISO fails deep into the install, not at the start.

Runs from the NUC before the machine exists. Additive and reversible.

Snapshots store only changed blocks, so on a library that barely changes this costs single-digit GB against 10.9 TiB.

Then the NFS export, scoped deliberately narrow:

path      /mnt/Kloud/Media/Jellyfin   # NOT all of /mnt/Kloud/Media
networks  192.168.4.0/24
access    read-write, mapall off

Exporting only the Jellyfin library means the new box can write what it legitimately manages and cannot reach usenet, AppData, or your personal backup folder at all.

Text-menu installer — arrow keys, space to toggle, Enter. No commands.

sudo lvextend -l +100%FREE /dev/ubuntu-vg/ubuntu-lv
sudo resize2fs /dev/ubuntu-vg/ubuntu-lv
df -h /

Two hard gates. Nothing proceeds past a failed one.

sudo apt update && sudo apt upgrade -y
sudo ubuntu-drivers install
sudo reboot
# after reboot
nvidia-smi

curl -fsSL https://get.docker.com | sudo sh
sudo usermod -aG docker $USER      # log out and back in after this

# NVIDIA Container Toolkit — lets containers see the GPU
curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey \
  | sudo gpg --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg
curl -s -L https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list \
  | sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' \
  | sudo tee /etc/apt/sources.list.d/nvidia-container-toolkit.list
sudo apt update && sudo apt install -y nvidia-container-toolkit
sudo nvidia-ctk runtime configure --runtime=docker
sudo systemctl restart docker

# Gate 2 — a container must see the card
docker run --rm --gpus all ubuntu nvidia-smi

Then Portainer, so container management is a browser tab rather than a terminal:

docker volume create portainer_data
docker run -d -p 9443:9443 --name portainer --restart=always \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v portainer_data:/data portainer/portainer-ce:latest

Reach it at https://192.168.4.220:9443 and set the admin password within a few minutes of first start, or it locks itself and needs a restart.

The last thing you do by hand. After this the agent takes over.

# Node 20 LTS — Ubuntu's apt node is too old
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt install -y nodejs git
node -v

# Claude Code
npm install -g @anthropic-ai/claude-code
claude --version

# CIFS client, so the agent can reach the cross-agent dead-drop
sudo apt install -y cifs-utils

Run claude once in a terminal on the box to complete login, then add the machine as an SSH host in the Claude desktop app — that gives you the UI you prefer while the session runs on the server. No GUI is ever installed on the box itself.

First message to the fresh Claude Code session on the box. It carries the context that isn't discoverable from the machine itself.

You are the Claude Code agent on a new Ubuntu Server box in Kirov's home estate.
Read this fully before acting.

MACHINE
  Ryzen 9 7900X + RTX 4070 Ti (12 GB), Ubuntu Server 24.04 LTS, always on.
  IP 192.168.4.220 . Agent name ____________ .
  Role: local AI (Ollama) + Jellyfin. Later: Palworld, Immich ML.
  NO Blender on this box — that lives on the gaming rig.

ALREADY DONE — do not redo
  NVIDIA driver installed, `nvidia-smi` passes on host AND inside a container.
  Docker Engine + NVIDIA Container Toolkit installed. Portainer on :9443.

THE ESTATE
  TrueNAS R730xd  192.168.4.218  storage, Immich, *arr stack. Pool "Kloud".
  NUC             192.168.4.58   websites, Nginx Proxy Manager, DDNS. Agent "nuc".
  Beelink         192.168.4.59   empty, being repurposed for monitoring.
  Gaming rig      192.168.1.114  never a server; powers on and off.

CROSS-AGENT DEAD-DROP
  \\192.168.4.218\Media\AppData\claude-cross  (mount via cifs)
  ONE outbox per agent. Create your own for-<name>.md. NEVER write
  for-nuc.md or for-beelink.md — concurrent SMB writes clobber silently.
  No secrets in that folder; it is broadly readable on the LAN.

YOUR TASKS, IN ORDER
  1. Mount the NAS media over NFS, read-write:
       192.168.4.218:/mnt/Kloud/Media/Jellyfin -> /mnt/jellyfin
     Add to /etc/fstab with _netdev. Verify you can write a test file
     and then delete it.
  2. Deploy Jellyfin (linuxserver image) with runtime nvidia and
     PUID=3000 PGID=3000. NFS maps identity by NUMERIC uid/gid — the
     NAS files are owned by 3000. Any other uid gives permission errors
     that look like a broken export.
  3. Migrate the Jellyfin config: copy the WHOLE directory from
     192.168.4.218:/mnt/Kloud/Media/jellyfin-migration/config
     Do not rebuild from scratch — that folder carries watch history and
     26 user accounts. Then set transcoding to NVENC in the dashboard.
  4. Deploy Ollama with --gpus all, plus Open WebUI.
  5. Report back before any cutover. Do NOT repoint DNS or the proxy
     yourself — the NUC agent owns Nginx Proxy Manager.

RULES
  - Ask before anything destructive. Snapshots exist on the NAS but
    restoring is manual.
  - There is a folder on the Media share named "Peronal Backup  Claude
    dont go here". Never read, list, or touch it. Exclude it from every
    scan.
  - Report outcomes honestly, including partial failures.

Media mount

sudo apt install -y nfs-common
sudo mkdir -p /mnt/jellyfin
# /etc/fstab
192.168.4.218:/mnt/Kloud/Media/Jellyfin  /mnt/jellyfin  nfs  rw,_netdev,noatime  0 0
sudo mount -a && touch /mnt/jellyfin/.wtest && rm /mnt/jellyfin/.wtest

Jellyfin

services:
  jellyfin:
    image: lscr.io/linuxserver/jellyfin:10.11.11
    container_name: jellyfin
    runtime: nvidia
    environment:
      - PUID=3000
      - PGID=3000
      - TZ=America/Phoenix
      - NVIDIA_VISIBLE_DEVICES=all
    volumes:
      - /opt/jellyfin/config:/config
      - /mnt/jellyfin/movies:/data/movies
      - /mnt/jellyfin/tv:/data/tv
      - /mnt/jellyfin/music:/data/music
    ports: ["8096:8096"]
    restart: unless-stopped

Ollama + Open WebUI

docker run -d --gpus all -p 11434:11434 -v ollama:/root/.ollama \
  --name ollama --restart always ollama/ollama
docker exec -it ollama ollama pull llama3.1:8b

docker run -d -p 3000:8080 --add-host=host.docker.internal:host-gateway \
  -v open-webui:/app/backend/data --name open-webui --restart always \
  ghcr.io/open-webui/open-webui:main

12 GB holds an 8B model at Q4 (~6 GB), or 14B at Q4 if you're careful. With no Blender here the model can stay resident — NVENC runs on a separate encoder block and costs a few hundred MB, so inference and transcoding coexist without contention.

Immich ML

Immich itself stays on the NAS with its database and storage. Only the ML service moves — run the immich-machine-learning image with the CUDA tag here, then point the NAS deployment's IMMICH_MACHINE_LEARNING_URL at http://192.168.4.220:3003. Face recognition and CLIP search currently run on 2014 Xeons against a 257 GB library; this is the largest visible improvement in the plan.

Palworld

Image ich777/steamcmd:palworld with USERNAME=anonymous — a personal Steam account fails, Palworld downloads anonymously. Keep the perf flags -useperfthreads -NoAsyncLoadingThread -UseMultithreadForDS, restore the world from the NAS backup, and rebuild the 6-hourly backup as a systemd timer rather than the interactive-login scheduled task the Beelink needed.

Each line is one field, and each reverses on its own.

Websockets and forced SSL are already set on proxy host 8, so SyncPlay and HTTPS carry over untouched — only the forward target changes.

• Beelink becomes empty — Plex is fully retired, Immich and Jellyfin long since moved, Palworld lands here. Give it monitoring (Uptime Kuma): the one job that must live somewhere other than the things it watches. It sat offline recently and nothing told either of us.
• Reinstall it on Linux while it's empty — that removes the Docker Desktop session-binding permanently.
• 5800X, 7700K and 2080 Super stay on the shelf. Every machine powered on is more watts, more patching, more to break at 2am. Don't find jobs for hardware; wait until work doesn't fit.
• Still open, unrelated: 221 completed-but-never-imported files in complete/tv (~50 Kai episodes), and two drives at 52 °C in raidz2-1 — same vdev, which puts that vdev's entire fault tolerance in one hot spot.

Estate reference