$ sudo apt install btrfs-progs smartmontools

# 1. Revisar l estat dels discos ABANS de fer-los servir, fins i tot nous
$ sudo smartctl -a /dev/sda | grep -E 'Model|Power_On_Hours|Reallocated'
Device Model:     WDC WD80EFPX-68C4ZN0
  9 Power_On_Hours          0x0032   100   100   000    Old_age   Always  -  4
  5 Reallocated_Sector_Ct   0x0033   100   100   140    Pre-fail  Always  -  0

# 2. Crear el sistema de fitxers en RAID 1 (dades I metadades)
$ sudo mkfs.btrfs -L multimedia -d raid1 -m raid1 /dev/sda /dev/sdb
Label:              multimedia
UUID:               8f3a2c11-4d5e-4a91-b7c2-1e9d0f8a3b45
Number of devices:  2
Data,RAID1:  8.00TiB
Metadata,RAID1: 8.00GiB

# 3. Muntar per UUID, mai per /dev/sdX (05-04)
$ sudo mkdir -p /srv/multimedia
$ blkid /dev/sda | grep -oP 'UUID="\K[^"]+'
8f3a2c11-4d5e-4a91-b7c2-1e9d0f8a3b45

# /etc/fstab
# compress=zstd:3  -> comprimeix el que es comprimible; el video ja
#                     comprimit el detecta i el salta, aixi que no costa res
# noatime          -> no escriure la data d acces a cada lectura:
#                     menys escriptures i mes vida del disc
# nofail           -> SI EL DISC NO HI ES, EL SISTEMA ARRENCA IGUALMENT.
#                     Sense aixo, un disc desconnectat deixa l equip en
#                     mode emergencia, sense xarxa i sense SSH: cal anar-hi
#                     amb teclat i monitor. A casa, imprescindible.
# x-systemd.device-timeout=10 -> no esperar 90 s un disc absent
UUID=8f3a2c11-4d5e-4a91-b7c2-1e9d0f8a3b45  /srv/multimedia  btrfs \
  defaults,compress=zstd:3,noatime,nofail,x-systemd.device-timeout=10  0  0

$ sudo mount -a          # SEMPRE despres de tocar fstab (convencio del curs)
$ findmnt /srv/multimedia
TARGET          SOURCE    FSTYPE OPTIONS
/srv/multimedia /dev/sda  btrfs  rw,noatime,compress=zstd:3,nofail

$ sudo btrfs filesystem usage /srv/multimedia
Overall:
    Device size:                  14.55TiB
    Device allocated:              2.02TiB
    Used:                          2.01TiB
    Free (estimated):              6.26TiB      (min: 6.26TiB)
Data,RAID1: Size:1.01TiB, Used:1.00TiB
   /dev/sda	 1.01TiB
   /dev/sdb	 1.01TiB

# Verifica TOTES les sumes de verificacio i repara el que pot amb l altra copia
$ sudo btrfs scrub start -B /srv/multimedia
scrub done for 8f3a2c11-4d5e-4a91-b7c2-1e9d0f8a3b45
	Total to scrub: 2.01TiB
	Rate: 178.42MiB/s
	Error summary: csum=2
	  Corrected: 2
	  Uncorrectable: 0

# /etc/systemd/system/btrfs-scrub.timer
[Unit]
Description=Depuracio mensual de Btrfs a /srv/multimedia

[Timer]
OnCalendar=Sun *-*-01..07 03:00:00   # primer diumenge de cada mes
Persistent=true
RandomizedDelaySec=1h

[Install]
WantedBy=timers.target

# /etc/systemd/system/btrfs-scrub.service
[Unit]
Description=Depuracio de dades de Btrfs

[Service]
Type=oneshot
ExecStart=/usr/bin/btrfs scrub start -B -c idle -n 5 /srv/multimedia
# -c idle -n 5: prioritat d E/S minima, per no molestar si algu esta
# veient una pel·licula a les 3 de la matinada
Nice=19
IOSchedulingClass=idle

$ sudo install -m 0755 -d /etc/apt/keyrings
$ curl -fsSL https://repo.jellyfin.org/jellyfin_team.gpg.key | \
      sudo gpg --dearmor -o /etc/apt/keyrings/jellyfin.gpg
$ sudo chmod 0644 /etc/apt/keyrings/jellyfin.gpg

$ cat <<EOF | sudo tee /etc/apt/sources.list.d/jellyfin.sources
Types: deb
URIs: https://repo.jellyfin.org/ubuntu
Suites: noble
Components: main
Architectures: amd64
Signed-By: /etc/apt/keyrings/jellyfin.gpg
EOF

$ sudo apt update && sudo apt install jellyfin
$ systemctl is-active jellyfin
active

$ gpg --show-keys /etc/apt/keyrings/jellyfin.gpg | head -2
pub   rsa4096 2018-11-08 [SC]
      04B7DA6B1FE10D5E76D9D5A6F5B2F0D5A8E5D6C3

$ sudo systemctl edit jellyfin

# /etc/systemd/system/jellyfin.service.d/override.conf
[Service]
# --- Aillament del sistema de fitxers ---
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
# Nomes aquestes rutes son escrivibles
ReadWritePaths=/var/lib/jellyfin /var/log/jellyfin /var/cache/jellyfin /etc/jellyfin
# La biblioteca, NOMES LECTURA: Jellyfin no te cap rao per poder
# esborrar les teves pel·licules. Es la restriccio mes important de totes.
ReadOnlyPaths=/srv/multimedia

# --- Privilegis ---
NoNewPrivileges=true
PrivateDevices=false            # false: necessita /dev/dri per a la GPU
DeviceAllow=/dev/dri/renderD128 rw
DeviceAllow=/dev/dri/card0 rw
CapabilityBoundingSet=
AmbientCapabilities=
RestrictSUIDSGID=true

# --- Nucli i memoria ---
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
ProtectProc=invisible
MemoryDenyWriteExecute=false    # .NET fa servir compilacio JIT: no es pot
LockPersonality=true
RestrictRealtime=true
RestrictNamespaces=true

# --- Xarxa ---
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
IPAddressAllow=localhost 192.168.1.0/24 10.8.0.0/24
IPAddressDeny=any

# --- Crides al sistema ---
SystemCallFilter=@system-service
SystemCallFilter=~@privileged @resources @obsolete
SystemCallArchitectures=native

# --- Limits de recursos (cgroups, 07-05) ---
# Evita que una transcodificacio descontrolada bloquegi l equip
CPUQuota=350%
MemoryMax=3G
IOWeight=50

$ sudo systemctl daemon-reload && sudo systemctl restart jellyfin
$ systemd-analyze security jellyfin
→ Overall exposure level for jellyfin.service: 2.4 OK

$ sudo -u jellyfin touch /srv/multimedia/prova
touch: cannot touch '/srv/multimedia/prova': Read-only file system

$ sudo apt install vainfo intel-media-va-driver-non-free

# 1. Existeix el dispositiu de renderitzat?
$ ls -l /dev/dri/
crw-rw---- 1 root video  226,   0 Aug 18 09:02 card0
crw-rw---- 1 root render 226, 128 Aug 18 09:02 renderD128

# 2. Que sap fer?
$ vainfo --display drm --device /dev/dri/renderD128 2>/dev/null | \
      grep -E 'Driver version|VAProfileH264High|VAProfileHEVCMain|VAProfileAV1'
vainfo: Driver version: Intel iHD driver for Intel(R) Gen Graphics - 24.1.0
      VAProfileH264High               : VAEntrypointVLD        (descodifica)
      VAProfileH264High               : VAEntrypointEncSliceLP (codifica)
      VAProfileHEVCMain               : VAEntrypointVLD
      VAProfileHEVCMain10             : VAEntrypointVLD
      VAProfileAV1Profile0            : VAEntrypointVLD

$ sudo usermod -aG render,video jellyfin
$ id jellyfin
uid=996(jellyfin) gid=996(jellyfin) groups=996(jellyfin),44(video),993(render)
$ sudo systemctl restart jellyfin

# Amb una reproduccio en curs que estigui transcodificant
$ ps -eo pcpu,comm | grep ffmpeg
  6.2 ffmpeg

$ sudo intel_gpu_top -s 1000 | head -8
 Freq MHz    IRQ RC6     Power W        IMC MiB/s
 req  act        %       gpu   pkg     rd     wr
 850  842   1284  12    3.21  8.94   412.1  188.4

 ENGINES     BUSY                     MI_SEM MI_WAIT
 Render/3D   4.12% |█                |      0%      0%
 Video       78.44% |███████████████ |      0%      0%
 VideoEnhance 2.10% |                |      0%      0%

/srv/multimedia/
├── pellicules/
│   ├── La Ciutat Cremada (1976)/
│   │   ├── La Ciutat Cremada (1976) - 1080p.mkv
│   │   ├── La Ciutat Cremada (1976).ca.srt
│   │   └── poster.jpg
│   └── Metropolis (1927)/
│       └── Metropolis (1927) - 1080p.mkv
├── series/
│   └── Nom de la Serie (2019)/
│       ├── Season 01/
│       │   ├── Nom de la Serie S01E01.mkv
│       │   └── Nom de la Serie S01E02.mkv
│       └── Season 02/
│           └── Nom de la Serie S02E01.mkv
├── musica/
│   └── Artista/
│       └── Album (2004)/
│           ├── 01 - Primer tema.flac
│           └── 02 - Segon tema.flac
└── fotos/
    └── 2026/
        └── 2026-07 Vacances Pirineus/

# Veure que faria abans de fer-ho (convencio --dry-run del curs)
$ for f in /srv/multimedia/entrada/*.mkv; do
      nou="$(basename "$f" | sed -E 's/\.(1080p|720p|x264|WEB-DL)//gI; s/\./ /g')"
      printf '%s\n  -> %s\n' "$f" "$nou"
  done

$ sudo groupadd -f multimedia
$ sudo usermod -aG multimedia jellyfin
$ sudo usermod -aG multimedia "$USER"
$ sudo chown -R root:multimedia /srv/multimedia
$ sudo find /srv/multimedia -type d -exec chmod 2775 {} +   # SGID: hereta grup
$ sudo find /srv/multimedia -type f -exec chmod 0664 {} +

# /etc/samba/smb.conf (despres de copiar l original a .bak-2026-08-18)
[global]
    workgroup = CASA
    server string = Servidor multimedia
    security = user
    map to guest = never                  # RES de convidats

    # SMB1 esta trencat per disseny (WannaCry es va propagar per aqui).
    # Minim SMB2; SMB3 aporta xifratge.
    server min protocol = SMB2
    client min protocol = SMB2
    server smb encrypt = desired

    # Escoltar NOMES a la LAN i la VPN, mai a totes les interficies
    interfaces = 127.0.0.1 192.168.1.0/24 10.8.0.0/24
    bind interfaces only = yes
    hosts allow = 127.0.0.1 192.168.1.0/24 10.8.0.0/24
    hosts deny = 0.0.0.0/0

    # Sense impressores: elimina superficie d atac i soroll al registre
    load printers = no
    printing = bsd
    printcap name = /dev/null
    disable spoolss = yes

    log level = 1
    log file = /var/log/samba/log.%m
    max log size = 1000

[multimedia]
    path = /srv/multimedia
    comment = Biblioteca familiar
    browseable = yes
    read only = yes                       # per defecte, NOMES LECTURA
    # Nomes aquests usuaris poden escriure
    write list = @multimedia
    valid users = @multimedia
    create mask = 0664
    directory mask = 2775
    force group = multimedia
    vfs objects = recycle                 # paperera: salva d esborrats
    recycle:repository = .paperera
    recycle:keeptree = yes
    recycle:versions = yes

[fotos]
    path = /srv/multimedia/fotos
    valid users = @multimedia
    read only = no
    create mask = 0664
    directory mask = 2775
    force group = multimedia

$ sudo apt install samba
$ testparm -s >/dev/null && echo "configuracio valida"   # el nginx -t de Samba
configuracio valida

# Els usuaris de Samba son INDEPENDENTS dels del sistema, encara que
# el nom coincideixi. Cal crear-los explicitament.
$ sudo smbpasswd -a marta
New SMB password: ********
$ sudo smbpasswd -e marta

$ sudo systemctl restart smbd nmbd
$ smbclient -L //192.168.1.20 -U marta
	Sharename       Type      Comment
	---------       ----      -------
	multimedia      Disk      Biblioteca familiar
	fotos           Disk

$ sudo apt install nfs-kernel-server
$ echo '/srv/multimedia 192.168.1.0/24(ro,sync,no_subtree_check,root_squash)' | \
      sudo tee -a /etc/exports
$ sudo exportfs -ra
$ sudo exportfs -v
/srv/multimedia   192.168.1.0/24(ro,sync,no_subtree_check,root_squash)

$ sudo ufw allow from 192.168.1.0/24 to any app Samba
$ sudo ufw allow from 192.168.1.0/24 to any port 8096 proto tcp comment 'Jellyfin'
$ sudo ufw allow from 192.168.1.0/24 to any port 2049 proto tcp comment 'NFS'
$ sudo ufw status | head -6
Status: active
To                         Action      From
--                         ------      ----
Samba                      ALLOW       192.168.1.0/24
8096/tcp (Jellyfin)        ALLOW       192.168.1.0/24
2049/tcp (NFS)             ALLOW       192.168.1.0/24

# /etc/nginx/sites-available/jellyfin — nomes si decideixes exposar-lo
server {
    listen 443 ssl;
    http2 on;
    server_name multimedia.elmeudomini.example;

    ssl_certificate     /etc/letsencrypt/live/multimedia.elmeudomini.example/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/multimedia.elmeudomini.example/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    add_header Strict-Transport-Security "max-age=63072000" always;
    add_header X-Content-Type-Options "nosniff" always;

    # Limit de taxa contra forca bruta sobre el formulari d acces
    limit_req zone=login burst=5 nodelay;
    client_max_body_size 20M;

    location / {
        proxy_pass http://127.0.0.1:8096;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        # WebSocket: Jellyfin el fa servir per a l estat de reproduccio
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        # Sense memoria intermedia: es video en flux
        proxy_buffering off;
    }
}

# ~/multimedia/compose.yml (fragment il·lustratiu)
services:
  sonarr:
    image: lscr.io/linuxserver/sonarr:latest
    environment:
      - PUID=1000
      - PGID=1002          # grup multimedia
      - TZ=Europe/Madrid
    volumes:
      - ./sonarr-config:/config
      - /srv/multimedia/series:/series
    ports:
      - "127.0.0.1:8989:8989"   # NOMES localhost: s hi arriba per VPN
    restart: unless-stopped

#!/usr/bin/env bash
#
# copia_casa.sh - Copies del servidor multimedia domestic
#
# Estrategia:
#   - Insubstituible (fotos, documents) -> restic fora de casa
#   - Configuracio de Jellyfin          -> restic, diari
#   - Pel·licules i musica              -> instantania Btrfs local
#
set -euo pipefail

readonly SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
source "${SCRIPT_DIR}/lib/comuns.sh"

readonly CASA_MULTIMEDIA="${CASA_MULTIMEDIA:-/srv/multimedia}"
readonly CASA_INSTANTANIES="${CASA_INSTANTANIES:-/srv/multimedia/.instantanies}"
export RESTIC_REPOSITORY="${RESTIC_REPOSITORY:-b2:elmeudomini-multimedia:/}"

umask 077

instantania_local() {
    local nom="${CASA_INSTANTANIES}/$(date +%F)"
    [[ -d "$nom" ]] && { log "la instantania d avui ja existeix"; return 0; }
    # Instantania de nomes lectura: no ocupa espai fins que alguna cosa canvia
    btrfs subvolume snapshot -r "$CASA_MULTIMEDIA" "$nom" \
        || morir 73 "no s ha pogut crear la instantania"
    log "instantania creada: $nom"

    # Retencio: conservar 7 diaries
    local sobrants
    mapfile -t sobrants < <(find "$CASA_INSTANTANIES" -maxdepth 1 -type d -name '20*' \
        | sort -r | tail -n +8)
    local s
    for s in "${sobrants[@]:-}"; do
        [[ -n "$s" ]] || continue
        btrfs subvolume delete "$s" && log "instantania antiga eliminada: $s"
    done
}

copia_externa() {
    requereix_comanda restic
    RESTIC_PASSWORD="$(pass casa/restic)" \
    restic backup \
        "${CASA_MULTIMEDIA}/fotos" \
        "${CASA_MULTIMEDIA}/documents" \
        /var/lib/jellyfin \
        /etc/jellyfin \
        --exclude-caches \
        --exclude '*/metadata/*' \
        --tag casa \
        || morir 74 "restic ha fallat"

    RESTIC_PASSWORD="$(pass casa/restic)" \
    restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --prune
}

verificar() {
    # Una copia no verificada no es una copia (05-08)
    RESTIC_PASSWORD="$(pass casa/restic)" \
    restic check --read-data-subset=2% || morir 74 "la verificacio de restic ha fallat"
    log "verificacio correcta"
}

main() {
    requereix_comanda btrfs
    instantania_local
    copia_externa
    verificar
    log "copia completada"
}

main "$@"

$ sudo btrfs subvolume list /srv/multimedia
ID 258 gen 4412 top level 5 path .instantanies/2026-08-16
ID 259 gen 4488 top level 5 path .instantanies/2026-08-17
ID 260 gen 4501 top level 5 path .instantanies/2026-08-18

# Recuperar alguna cosa esborrada per error: es una simple copia
$ sudo cp -a /srv/multimedia/.instantanies/2026-08-17/fotos/2026-07 /srv/multimedia/fotos/

Cost anual = Potencia mitjana (W) x 8760 h / 1000 x preu del kWh

$ sudo apt install powertop lm-sensors
$ sudo sensors-detect --auto >/dev/null

# Calibrar primer (triga uns minuts i mesura el consum de cada estat)
$ sudo powertop --calibrate
$ sudo powertop --auto-tune       # aplica els ajustos recomanats

$ sudo powertop --time=60 --csv=/tmp/energia.csv >/dev/null
$ grep -A6 'Power est' /tmp/energia.csv | head -8
The battery reports a discharge rate of 12.4 W
Usage       Events/s   Category       Description
  6.2 ms/s     14.1     Process        ffmpeg
  1.1 ms/s      8.4     Process        jellyfin

# /etc/systemd/system/powertop.service
[Unit]
Description=Ajustos d estalvi energetic de PowerTOP
After=multi-user.target

[Service]
Type=oneshot
ExecStart=/usr/sbin/powertop --auto-tune
RemainAfterExit=true

[Install]
WantedBy=multi-user.target

$ sudo apt install hdparm

# -B 127: gestio d energia agressiva pero SENSE aparcar el capcal a cada
#         moment (els valors < 128 permeten l aturada; 254 la desactiva)
# -S 120: aturar despres de 120 x 5 s = 10 minuts d inactivitat
$ sudo hdparm -B 127 -S 120 /dev/sda

# /etc/hdparm.conf — persistent entre reinicis
/dev/disk/by-id/ata-WDC_WD80EFPX-68C4ZN0_WD-CA0J1234 {
    apm = 127
    spindown_time = 120
}

$ sensors
coretemp-isa-0000
Package id 0:  +42.0°C  (high = +100.0°C, crit = +100.0°C)

$ sudo smartctl -A /dev/sda | grep -i temperature
194 Temperature_Celsius     0x0022   118   105   000    Old_age   Always  -  38

# ~/casa-infra/roles/multimedia/defaults/main.yml
---
multimedia_punt_muntatge: /srv/multimedia
multimedia_uuid: 8f3a2c11-4d5e-4a91-b7c2-1e9d0f8a3b45
multimedia_grup: multimedia
multimedia_gid: 1002
multimedia_xarxa_lan: 192.168.1.0/24
multimedia_xarxa_vpn: 10.8.0.0/24
multimedia_usuaris_samba: [marta, luis]
multimedia_accelerar_hw: true
multimedia_dispositiu_gpu: /dev/dri/renderD128
multimedia_hdparm_spindown: 120
multimedia_subdirectoris: [pellicules, series, musica, fotos, documents]

# ~/casa-infra/roles/multimedia/tasks/main.yml
---
- name: Instal·lar paquets base
  ansible.builtin.apt:
    name:
      - btrfs-progs
      - smartmontools
      - samba
      - hdparm
      - powertop
      - restic
    state: present
    update_cache: true
  tags: [paquets]

- name: Paquets d acceleracio per maquinari
  ansible.builtin.apt:
    name: [vainfo, intel-media-va-driver-non-free]
    state: present
  when: multimedia_accelerar_hw | bool
  tags: [gpu]

- name: Clau del diposit de Jellyfin a keyrings
  ansible.builtin.get_url:
    url: https://repo.jellyfin.org/jellyfin_team.gpg.key
    dest: /etc/apt/keyrings/jellyfin.asc
    mode: '0644'
  tags: [paquets]

- name: Diposit de Jellyfin
  ansible.builtin.deb822_repository:
    name: jellyfin
    types: deb
    uris: https://repo.jellyfin.org/ubuntu
    suites: "{{ ansible_distribution_release }}"
    components: main
    architectures: amd64
    signed_by: /etc/apt/keyrings/jellyfin.asc
  register: repo_jellyfin
  tags: [paquets]

- name: Instal·lar Jellyfin
  ansible.builtin.apt:
    name: jellyfin
    state: present
    update_cache: "{{ repo_jellyfin.changed }}"
  tags: [paquets]

# --- Emmagatzematge ---
- name: Comprovar que el sistema de fitxers existeix abans de muntar-lo
  ansible.builtin.command: "blkid -U {{ multimedia_uuid }}"
  register: blk
  changed_when: false
  failed_when: blk.rc != 0

- name: Muntar la biblioteca per UUID amb nofail
  ansible.posix.mount:
    path: "{{ multimedia_punt_muntatge }}"
    src: "UUID={{ multimedia_uuid }}"
    fstype: btrfs
    opts: defaults,compress=zstd:3,noatime,nofail,x-systemd.device-timeout=10
    state: mounted

- name: Grup de la biblioteca
  ansible.builtin.group:
    name: "{{ multimedia_grup }}"
    gid: "{{ multimedia_gid }}"
    state: present

- name: Estructura de directoris amb SGID
  ansible.builtin.file:
    path: "{{ multimedia_punt_muntatge }}/{{ item }}"
    state: directory
    owner: root
    group: "{{ multimedia_grup }}"
    mode: '2775'
  loop: "{{ multimedia_subdirectoris }}"

- name: Afegir jellyfin als grups necessaris
  ansible.builtin.user:
    name: jellyfin
    groups: "{{ [multimedia_grup] + (['render', 'video'] if multimedia_accelerar_hw else []) }}"
    append: true
  notify: Reiniciar jellyfin

- name: Drop-in d enduriment de jellyfin
  ansible.builtin.template:
    src: jellyfin-override.conf.j2
    dest: /etc/systemd/system/jellyfin.service.d/override.conf
    owner: root
    group: root
    mode: '0644'
  notify:
    - Recarregar systemd
    - Reiniciar jellyfin

- name: Configuracio de Samba
  ansible.builtin.template:
    src: smb.conf.j2
    dest: /etc/samba/smb.conf
    owner: root
    group: root
    mode: '0644'
    backup: true
    validate: 'testparm -s %s'    # el nginx -t de Samba (08-01)
  notify: Reiniciar samba

- name: Tallafocs: nomes LAN i VPN
  community.general.ufw:
    rule: allow
    src: "{{ item.0 }}"
    port: "{{ item.1 }}"
    proto: tcp
  loop: "{{ [multimedia_xarxa_lan, multimedia_xarxa_vpn] | product(['445', '8096']) | list }}"
  tags: [firewall]

- name: Temporitzadors de depuracio, SMART i copia
  ansible.builtin.copy:
    src: "{{ item }}"
    dest: "/etc/systemd/system/{{ item }}"
    mode: '0644'
  loop:
    - btrfs-scrub.service
    - btrfs-scrub.timer
    - copia-casa.service
    - copia-casa.timer
  notify: Recarregar systemd

- name: Activar els temporitzadors
  ansible.builtin.systemd:
    name: "{{ item }}"
    enabled: true
    state: started
    daemon_reload: true
  loop: [btrfs-scrub.timer, copia-casa.timer, smartd.service]

# --- Verificacio ---
- name: Verificar que l acceleracio per maquinari es visible
  ansible.builtin.command: "vainfo --display drm --device {{ multimedia_dispositiu_gpu }}"
  register: va
  changed_when: false
  failed_when: "'VAProfileH264High' not in va.stdout"
  when: multimedia_accelerar_hw | bool
  tags: [verificar]

- name: Verificar que Jellyfin respon
  ansible.builtin.uri:
    url: "http://127.0.0.1:8096/health"
    status_code: 200
  retries: 5
  delay: 3
  tags: [verificar]

# Actualitzacions de seguretat desateses (06-06)
$ sudo apt install unattended-upgrades
$ sudo dpkg-reconfigure -plow unattended-upgrades

# /etc/apt/apt.conf.d/50unattended-upgrades
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "05:30";
Unattended-Upgrade::Automatic-Reboot-WithUsers "false";

$ sudo btrfs subvolume snapshot -r /var/lib/jellyfin \
      /srv/multimedia/.instantanies/jellyfin-pre-$(date +%F)

$ sudo systemctl enable --now smartd

# Prova curta setmanal, llarga mensual, i avis per correu
$ sudo tee /etc/smartd.conf <<'EOF'
DEVICESCAN -a -o on -S on -n standby,q \
  -s (S/../.././02|L/../(01|15)/./03) \
  -W 4,45,50 \
  -m root -M exec /usr/share/smartmontools/smartd-runner
EOF
$ sudo systemctl restart smartd

$ sudo smartctl -A /dev/sda | \
      awk '$1 ~ /^(5|187|188|197|198)$/ {printf "%-28s %s\n", $2, $10}'
Reallocated_Sector_Ct        0
Reported_Uncorrect           0
Command_Timeout              0
Current_Pending_Sector       0
Offline_Uncorrectable        0

# El simptoma: errors al journal
$ sudo journalctl -k --since today | grep -iE 'ata[0-9]|I/O error|medium error'
kernel: ata2.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0
kernel: blk_update_request: I/O error, dev sdb, sector 1928374656

$ sudo btrfs device stats /srv/multimedia
[/dev/sda].write_io_errs    0
[/dev/sda].read_io_errs     0
[/dev/sda].corruption_errs  0
[/dev/sdb].write_io_errs    142
[/dev/sdb].read_io_errs     2891
[/dev/sdb].corruption_errs  18

# 1. NO desmuntar ni apagar. Amb RAID 1 el sistema continua funcionant.
#    Primer, comprovar que hi ha copia del que es insubstituible.
$ RESTIC_PASSWORD=$(pass casa/restic) restic snapshots --tag casa | tail -3

# 2. Si el disc ENCARA respon: reemplacament en calent (l ideal).
#    Btrfs copia del disc vell el que pot i del mirall el que no.
$ sudo btrfs replace start -f /dev/sdb /dev/sdc /srv/multimedia
$ sudo btrfs replace status /srv/multimedia
0.8% done, 0 write errs, 0 uncorr. read errs

# 3. Si el disc JA NO respon: muntar en mode degradat i afegir-ne un de nou
$ sudo mount -o degraded,compress=zstd:3 UUID=8f3a2c11-... /srv/multimedia
$ sudo btrfs device add /dev/sdc /srv/multimedia
$ sudo btrfs device remove missing /srv/multimedia
$ sudo btrfs balance start -dconvert=raid1 -mconvert=raid1 /srv/multimedia

# 4. Verificar que s ha restablert la redundancia
$ sudo btrfs filesystem df /srv/multimedia
Data, RAID1: total=1.01TiB, used=1.00TiB
Metadata, RAID1: total=8.00GiB, used=6.12GiB

# 5. Depuracio completa per confirmar que tot esta integre
$ sudo btrfs scrub start -B /srv/multimedia

# 1. Esta transcodificant? El tauler de Jellyfin ho diu, i tambe aixo:
$ ps -eo pid,pcpu,args | grep '[f]fmpeg' | head -1
  8814 191.2 /usr/lib/jellyfin-ffmpeg/ffmpeg -i /srv/multimedia/pellicules/...
    -c:v libx264 -preset veryfast -b:v 3000000 ...

# 2. Per que transcodifica? Analitzar el fitxer
$ ffprobe -v error -show_entries stream=index,codec_type,codec_name,width,height,channels \
      -of csv=p=0 "/srv/multimedia/pellicules/Pellicula (2019)/Pellicula (2019).mkv"
0,video,hevc,3840,2160
1,audio,dts,8
2,subtitle,hdmv_pgs_subtitle

# 3. Que admet el televisor? Al registre de Jellyfin, despres de reproduir:
$ sudo journalctl -u jellyfin --since "10 min ago" | grep -i 'transcod\|reason'
[INF] Transcoding reason: VideoCodecNotSupported, AudioCodecNotSupported,
      SubtitleCodecNotSupported

# 4. Es la xarxa? Wi-Fi del menjador enfront de cable
$ iperf3 -c 192.168.1.45 -t 10 -R
[  5]   0.00-10.00  sec  58.2 MBytes  48.8 Mbits/sec

# --- MESURA 1: activar l acceleracio per maquinari (impacte immediat) ---
$ vainfo --display drm --device /dev/dri/renderD128 | grep -c EncSlice
6
$ sudo usermod -aG render,video jellyfin
$ sudo systemctl restart jellyfin
# I al tauler: Reproduccio > VAAPI, /dev/dri/renderD128,
# marcant HEVC, HEVC 10 bits, VP9 i "codificacio HEVC"

# Verificar l efecte
$ ps -eo pcpu,args | grep '[f]fmpeg' | awk '{print $1}'
5.8
$ sudo intel_gpu_top -s 1000 | grep Video
 Video      74.12% |██████████████   |

# --- MESURA 2: extreure els subtitols a un fitxer extern ---
# Els PGS grafics forcen la transcodificacio de VIDEO encara que el
# codec sigui compatible: cal "cremar-los" sobre la imatge. Els .srt
# s envien a part i el client els dibuixa.
$ ffmpeg -i "Pellicula (2019).mkv" -map 0:s:0 -c:s srt "Pellicula (2019).ca.srt"

# --- MESURA 3: convertir nomes l audio problematic, sense tocar el video ---
# -c:v copy no recodifica el video: son segons, no hores, i sense
# cap perdua de qualitat d imatge.
$ ffmpeg -i entrada.mkv -c:v copy -c:s copy \
      -c:a ac3 -b:a 640k -ac 6 sortida.mkv

# --- MESURA 4: cable Ethernet o PLC fins al menjador ---
$ iperf3 -c 192.168.1.45 -t 10 -R
[  5]   0.00-10.00  sec  1.09 GBytes  938 Mbits/sec

NIVELL 1 - Insubstituible (402 GB): fotos, documents, configuracio
  Copia 1: Btrfs RAID 1 local (l original)
  Copia 2: disc extern USB xifrat, mensual, en un calaix
  Copia 3: restic al nuvol, diaria, xifrada d extrem a extrem
  -> 3 copies, 2 suports, 1 fora de casa. 3-2-1 complet.

NIVELL 2 - Recuperable amb esforc (800 GB): musica
  Copia 1: Btrfs RAID 1 local
  Copia 2: el mateix disc extern USB, mensual
  -> Sense copia al nuvol: 800 GB al mes no compensen 40 h de feina.

NIVELL 3 - Recuperable (4,8 TB): pel·licules
  Copia 1: Btrfs RAID 1 local
  Copia 2: els discos originals a la prestatgeria (ja la tens)
  -> Sense copia addicional. El RAID cobreix la fallada d un disc i els
     originals cobreixen la resta.

# --- Nivell 1: restic al nuvol, diari ---
$ export RESTIC_REPOSITORY="b2:elmeudomini-multimedia:/"
$ restic init                    # una sola vegada

# La frase de pas, a pass (06-05). Si es perd, la copia es
# IL·LEGIBLE: no hi ha recuperacio possible. Va tambe en paper, a casa
# d un familiar, dins d un sobre tancat.
$ pass generate casa/restic 40

# --- Nivells 1 i 2: disc extern USB xifrat, mensual ---
# LUKS (06-05): si perds el disc, les dades no son llegibles
$ sudo cryptsetup luksFormat /dev/sdd1
$ sudo cryptsetup open /dev/sdd1 copia-externa
$ sudo mkfs.btrfs -L copia /dev/mapper/copia-externa

# Copia mensual. --delete es fa servir AMB CURA: si l origen esta
# desmuntat, rsync esborraria el desti sencer. La comprovacio previa
# no es opcional.
$ mountpoint -q /srv/multimedia || { echo "origen no muntat; avortant"; exit 1; }
$ sudo rsync -aHAX --delete --info=progress2 \
      /srv/multimedia/{fotos,documents,musica}/ /mnt/copia/
$ sudo umount /mnt/copia && sudo cryptsetup close copia-externa

# Automatic, setmanal
$ restic check --read-data-subset=5%

# Manual, trimestral: restaurar de debo un fitxer i OBRIR-LO
$ restic restore latest --include '/srv/multimedia/fotos/2019' --target /tmp/prova
$ sha256sum /tmp/prova/srv/multimedia/fotos/2019/IMG_4412.jpg \
            /srv/multimedia/fotos/2019/IMG_4412.jpg
a3f1...  /tmp/prova/srv/multimedia/fotos/2019/IMG_4412.jpg
a3f1...  /srv/multimedia/fotos/2019/IMG_4412.jpg

#!/usr/bin/env bash
#
# revisio_casa.sh - Revisio de salut del servidor multimedia domestic
#
# Codis de sortida:
#   0 = correcte   1 = avis   2 = critic
#
# Pensat per executar-se des d un temporitzador diari, amb silenci si tot
# va be: nomes un estat != 0 produeix notificacio.
#
set -euo pipefail

readonly SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
source "${SCRIPT_DIR}/lib/comuns.sh"

readonly CASA_MULTIMEDIA="${CASA_MULTIMEDIA:-/srv/multimedia}"
readonly CASA_DISCS="${CASA_DISCS:-/dev/sda /dev/sdb}"
readonly CASA_LLINDAR_ESPAI="${CASA_LLINDAR_ESPAI:-85}"
readonly CASA_LLINDAR_TEMP="${CASA_LLINDAR_TEMP:-45}"
readonly CASA_LLINDAR_COPIA_H="${CASA_LLINDAR_COPIA_H:-36}"
readonly CASA_LLINDAR_SCRUB_D="${CASA_LLINDAR_SCRUB_D:-45}"

umask 027
estat_global=0

registrar() {
    local nivell="$1" msg="$2"
    case "$nivell" in
        ok)     log "OK      $msg" ;;
        avis)   error "AVIS    $msg"; (( estat_global < 1 )) && estat_global=1 ;;
        critic) error "CRITIC  $msg"; estat_global=2 ;;
    esac
    return 0
}

comprovar_muntatge() {
    if ! mountpoint -q "$CASA_MULTIMEDIA"; then
        registrar critic "$CASA_MULTIMEDIA NO esta muntat"
        return 0
    fi
    registrar ok "biblioteca muntada"

    # Amb 'nofail', un disc absent NO impedeix arrencar: cal comprovar
    # explicitament que hi son els dos dispositius.
    local n
    n="$(btrfs filesystem show "$CASA_MULTIMEDIA" | grep -c '^\s*devid')"
    if (( n < 2 )); then
        registrar critic "nomes $n dispositiu(s): el RAID 1 esta DEGRADAT"
    else
        registrar ok "RAID 1 amb $n dispositius"
    fi
}

comprovar_espai() {
    mountpoint -q "$CASA_MULTIMEDIA" || return 0
    # 'df' menteix amb Btrfs en RAID: es fa servir la sortida propia de btrfs
    local lliure_b total_b usat_pct
    lliure_b="$(btrfs filesystem usage -b "$CASA_MULTIMEDIA" | \
        awk '/Free \(estimated\)/{gsub(/[^0-9]/,"",$3); print $3}')"
    total_b="$(btrfs filesystem usage -b "$CASA_MULTIMEDIA" | \
        awk '/Device size/{gsub(/[^0-9]/,"",$3); print $3/2}')"
    usat_pct=$(( 100 - (lliure_b * 100 / total_b) ))

    if (( usat_pct >= 95 )); then
        registrar critic "biblioteca al ${usat_pct}% ($(formatar_bytes "$lliure_b") lliures)"
    elif (( usat_pct >= CASA_LLINDAR_ESPAI )); then
        registrar avis "biblioteca al ${usat_pct}%"
    else
        registrar ok "espai al ${usat_pct}% ($(formatar_bytes "$lliure_b") lliures)"
    fi
}

comprovar_errors_btrfs() {
    mountpoint -q "$CASA_MULTIMEDIA" || return 0
    local total
    total="$(btrfs device stats "$CASA_MULTIMEDIA" | awk '{s+=$2} END {print s+0}')"
    if (( total > 0 )); then
        registrar critic "btrfs acumula $total errors d E/S o corrupcio"
        btrfs device stats "$CASA_MULTIMEDIA" | awk '$2>0 {print "         " $0}' >&2
    else
        registrar ok "sense errors d E/S ni corrupcio"
    fi
}

comprovar_scrub() {
    mountpoint -q "$CASA_MULTIMEDIA" || return 0
    local data dies
    data="$(btrfs scrub status "$CASA_MULTIMEDIA" | \
        awk -F': ' '/Scrub started/{print $2}')" || true
    if [[ -z "${data:-}" ]]; then
        registrar avis "no consta cap depuracio executada"
        return 0
    fi
    dies=$(( ( $(date +%s) - $(date -d "$data" +%s) ) / 86400 ))
    if (( dies > CASA_LLINDAR_SCRUB_D )); then
        registrar avis "ultima depuracio fa $dies dies"
    else
        registrar ok "ultima depuracio fa $dies dies"
    fi
}

comprovar_discs() {
    requereix_comanda smartctl
    local d
    for d in $CASA_DISCS; do
        [[ -b "$d" ]] || { registrar critic "$d no existeix"; continue; }

        # -n standby: NO despertar un disc aturat nomes per mirar-lo
        local sortida
        sortida="$(smartctl -A -H -n standby "$d" 2>/dev/null)" || true
        if grep -q 'STANDBY' <<<"$sortida"; then
            registrar ok "$d en repos (no es desperta)"
            continue
        fi

        # Els atributs que prediuen fallades, no el veredicte global
        local realloc pendents illegibles temp
        realloc="$(awk '$1==5   {print $10+0}' <<<"$sortida")"
        pendents="$(awk '$1==197 {print $10+0}' <<<"$sortida")"
        illegibles="$(awk '$1==198 {print $10+0}' <<<"$sortida")"
        temp="$(awk '$1==194 {print $10+0}' <<<"$sortida")"

        if (( ${illegibles:-0} > 0 || ${pendents:-0} > 0 )); then
            registrar critic "$d: $pendents pendents, $illegibles illegibles: SUBSTITUIR"
        elif (( ${realloc:-0} > 0 )); then
            registrar avis "$d: $realloc sectors reassignats: vigilar"
        else
            registrar ok "$d sense sectors malmesos"
        fi

        if (( ${temp:-0} >= 50 )); then
            registrar critic "$d a ${temp}C"
        elif (( ${temp:-0} >= CASA_LLINDAR_TEMP )); then
            registrar avis "$d a ${temp}C (ideal < 45)"
        fi
    done
}

comprovar_serveis() {
    local s
    for s in jellyfin smbd smartd; do
        systemctl is-active --quiet "$s" \
            && registrar ok "$s actiu" \
            || registrar critic "$s NO esta actiu"
    done

    # Que respongui, no nomes que el proces existeixi
    if curl -sf -m 5 -o /dev/null http://127.0.0.1:8096/health; then
        registrar ok "jellyfin respon"
    else
        registrar critic "jellyfin no respon al 8096"
    fi
}

comprovar_copies() {
    local marca=/var/lib/copia-casa/ultima-correcta
    if [[ ! -f "$marca" ]]; then
        registrar critic "no hi ha constancia de cap copia correcta"
        return 0
    fi
    local hores
    hores=$(( ( $(date +%s) - $(stat -c %Y "$marca") ) / 3600 ))
    if (( hores > CASA_LLINDAR_COPIA_H * 2 )); then
        registrar critic "ultima copia correcta fa ${hores} h"
    elif (( hores > CASA_LLINDAR_COPIA_H )); then
        registrar avis "ultima copia correcta fa ${hores} h"
    else
        registrar ok "ultima copia correcta fa ${hores} h"
    fi
}

comprovar_acceleracio() {
    [[ -e /dev/dri/renderD128 ]] || { registrar avis "sense GPU accessible"; return 0; }
    if vainfo --display drm --device /dev/dri/renderD128 2>/dev/null | \
            grep -q VAEntrypointEncSlice; then
        registrar ok "acceleracio per maquinari disponible"
    else
        registrar avis "la GPU no exposa codificacio per maquinari"
    fi
}

main() {
    requereix_comanda btrfs
    requereix_comanda curl

    comprovar_muntatge
    comprovar_espai
    comprovar_errors_btrfs
    comprovar_scrub
    comprovar_discs
    comprovar_serveis
    comprovar_copies
    comprovar_acceleracio

    case "$estat_global" in
        0) log "servidor multimedia correcte" ;;
        1) error "revisio amb AVISOS" ;;
        2) error "revisio en estat CRITIC" ;;
    esac
    return "$estat_global"
}

main "$@"

$ shellcheck ~/scripts/revisio_casa.sh && echo "sense avisos"
sense avisos

$ ~/scripts/revisio_casa.sh; echo "estat: $?"
[2026-08-18 08:00:03] OK      biblioteca muntada
[2026-08-18 08:00:03] OK      RAID 1 amb 2 dispositius
[2026-08-18 08:00:03] OK      espai al 28% (6,3 TiB lliures)
[2026-08-18 08:00:04] OK      sense errors d E/S ni corrupcio
[2026-08-18 08:00:04] OK      ultima depuracio fa 12 dies
[2026-08-18 08:00:04] OK      /dev/sda en repos (no es desperta)
[2026-08-18 08:00:04] OK      /dev/sdb en repos (no es desperta)
[2026-08-18 08:00:05] OK      jellyfin actiu
[2026-08-18 08:00:05] OK      smbd actiu
[2026-08-18 08:00:05] OK      smartd actiu
[2026-08-18 08:00:05] OK      jellyfin respon
[2026-08-18 08:00:05] OK      ultima copia correcta fa 6 h
[2026-08-18 08:00:06] OK      acceleracio per maquinari disponible
[2026-08-18 08:00:06] servidor multimedia correcte
estat: 0

# /etc/systemd/system/revisio-casa.timer
[Unit]
Description=Revisio diaria del servidor multimedia

[Timer]
OnCalendar=*-*-* 08:00:00
Persistent=true

[Install]
WantedBy=timers.target

# /etc/systemd/system/revisio-casa.service
[Unit]
Description=Revisio de salut del servidor multimedia
# Notificar NOMES si falla: silenci si tot va be
OnFailure=notificar-casa@%n.service

[Service]
Type=oneshot
User=operador
ExecStart=/home/operador/scripts/revisio_casa.sh