hermes-skills/skills/devops/server-architecture-plan/references/migration-plan-target-architecture.md

Infrastructure Migration Plan (Jul 2026)

Target Architecture

Server	Provider	Model	Cost/mo	Role
Core	netcup RS 2000	8C/16G/512GB	~$24 (paid)	Hermes, Docker (Vaultwarden, Docuseal, SearXNG, Twenty), Portal, Prometheus, Uptime-Kuma, Caddy, VPN
app2	netcup RS 4000	12C/32G/1TB	~$44	UNMS/UISP, UniFi Controller, Hudu, Traccar
app3	netcup RS 2000	8C/16G/512GB	~$24	WordPress/Apex, web apps
app1-bu	Hetzner CPX11 (2C/2G)	Staying	Paid	Warm standby for Core. Keep in place.

Migration rules

1. Zero downtime for admin-ai.itpropartner.com — LiteLLM (deepseek-chat proxy for Sho'Nuff) must stay live during migration. Set up new LiteLLM on Core first, test via alternate URL, switch DNS.
2. Admin-ai uses PostgreSQL for model configs — DB dump/restore, not config file.
3. Open WebUI conversations are in SQLite — stop container, copy /app/backend/data/ (1.9 GB), restore on new box.
4. Migration order: AI stack first (most critical), then UNMS/UniFi, then web apps.
5. app1-bu stays warm at Hetzner — do not migrate. It's the safety net.
6. New boxes follow Docker install standard — /root/docker/<service>/, healthchecks, resource limits, internal networks, named volumes, .env chmod 600.
7. SSH key for new boxes: Deploy itpp-infra key during provisioning.
8. New boxes provisioned via netcup SCP (no API for provisioning — use web UI at servercontrolpanel.de).
9. app2 needs RS 4000 — UNMS (10 containers + Java/PostgreSQL/RabbitMQ) + UniFi (Java + MongoDB + MariaDB) + Hudu (5 containers) + Traccar (Java + 26 ports) needs 12C/32G to avoid contention.
10. Billing: Monthly (not annual), Virginia (Manassas) location.

admin-ai migration — critical path

admin-ai.itpropartner.com (LiteLLM on ai box at Hetzner) serves the deepseek-chat model that powers Sho'Nuff. It is the most critical service. Sequential steps:

1. Set up new LiteLLM + PostgreSQL on Core (or Monitor box)
2. Dump old PostgreSQL: docker exec litellm_postgres pg_dump -U litellm litellm_db > litellm-dump.sql
3. Restore on new PostgreSQL
4. Test new proxy: curl http://new-box:4000/v1/models — should show all models
5. Update Hermes config to point at new proxy for testing
6. Switch admin-ai DNS record to new IP
7. Keep old ai box running for 7 days as fallback

Cron after migration

• Core retains: hermes-live-sync, hermes-system-config-sync, hermes-docker-sync, ops-data-collector, shark-scraper, home-router-daily-backup (via WG to 10.77.0.2), vps-threshold-check
• app2 gets: local UNMS/UniFi/etc. cron jobs, node_exporter for Prometheus scraping
• app3 gets: WordPress cron, node_exporter
• app1-bu keeps: hermes-standby-watchdog, hermes-standby-sync

Cost comparison

	Current (Hetzner)	Target (netcup)
Servers	9 + app1-bu	Core + app2 + app3 + app1-bu
Monthly	~$150-160	~$68 (app2 + app3) + Core (paid)
Savings	—	~$82-92/mo

Unchanged services

• Nginx Proxy Manager (stays on docker Hetzner box — remaining services there still need reverse proxy)
• RustDesk (stays on docker Hetzner box)
• StrongSwan Docker (stays on docker Hetzner box)
• RunCloud MariaDB instances on decommissioned Hetzner boxes — not migrated, databases stay with their apps