# Final Server Architecture (Approved Jul 9, 2026)

## Base Standard
All new netcup servers: RS 4000 G12 (12C/32GB/1TB, ~$44/mo).
Exceptions: Core (existing RS 2000), app1-bu (Hetzner CPX11).

## Server Roles

| Box | Model | ~$/mo | Role | What it runs |
|-----|-------|-------|------|-------------|
| Core | RS 2000 | $24 | Ops hub | Hermes, Caddy, Portal, Docker (Vaultwarden, DocuSeal, Twenty, SearXNG), Prometheus/Grafana, Ollama (fallback), Uptime-Kuma, WireGuard, Tailscale |
| app1 | RS 4000 | $44 | AI/ML | LiteLLM (primary, admin-ai.itpropartner.com), Open WebUI, Ollama (primary), Qdrant, n8n |
| app2 | RS 4000 | $44 | Infrastructure | UNMS/UISP (10 containers), UniFi Controller (Java+MongoDB), Hudu (5 containers), Traccar (Java+26 ports) |
| app3 | RS 4000 | $44 | Web apps | WordPress/Apex, other WP sites (from wphost02/SiteGround) |
| app1-bu | CPX11 | $8 | Warm standby | Stays at Hetzner, StrongSwan/L2TP, watchdog |

## Migration Status

| Source | Target | Status |
|--------|--------|--------|
| ai.itpropartner.com (Hetzner CPX41) | app1 | Pending — admin-ai zero downtime critical |
| n8n (Hetzner CPX11) | app1 | Pending |
| unms.forefrontwireless.com (CPX21) | app2 | Planned |
| unifi (CPX21) | app2 | Planned |
| hudu.itpropartner.com (CPX21) | app2 | Planned |
| fleettracker360 (CPX11) | app2 | Planned |
| wphost02 (CPX21) | app3 | Planned |
| docker host NPM/RustDesk | Discard | Caddy replaces NPM |

## Constraints
- admin-ai zero downtime: provision app1 LiteLLM first, test, switch DNS, 7-day fallback
- Ollama on Core stays as secondary fallback (if app1 goes down)
- n8n on app1 for direct Ollama access
- Docker standard: /root/docker/<name>/, healthchecks, resource limits, .env
- app1-bu stays at Hetzner
- WISP discussion tabled, router API in backlog