Add Claude Code AI memory files

AI context/memory from Claude Code sessions covering all
infrastructure: JARVIS, NovaCPX, DO sites, Proxmox, FusionPBX,
MediaStack, and project feedback/preferences.

ai-memory/project_mediastack.md

@@ -0,0 +1,69 @@
+---
+name: project-mediastack
+description: MediaStack VM on PVE1 — Sonarr/Radarr/Prowlarr/qBittorrent behind WireGuard VPN through CT110→DO
+metadata: 
+  node_type: memory
+  type: project
+  originSessionId: b1e93a6a-f101-4ea4-aafb-9cb7e2958821
+---
+
+## VM Details (updated 2026-06-24)
+- **VM ID:** 103 | **Name:** MediaStack-35 | **IP:** 10.48.200.35
+- **Hypervisor:** PVE1 (10.48.200.90)
+- **Disk:** 50GB on **GoFlex** storage (moved off SynologyProx 2026-06-24 due to I/O errors)
+- **OS:** Ubuntu 24.04 (noble cloud image)
+- **QEMU guest agent:** installed and running (installed 2026-06-24)
+- **SSH:** PVE1 key → `ssh -o StrictHostKeyChecking=no -i /root/.ssh/id_rsa root@10.48.200.35`
+- **GitHub:** `myronblair/mediastack` cloned at `/opt/mediastack`
+
+## Services, Ports & Credentials
+| Service | Port | Login | API Key |
+|---------|------|-------|---------|
+| qBittorrent | :8080 | admin / Joker1974!!! | — |
+| Sonarr | :8989 | — | `b43e04350a594846b4ee95261c29e9e0` |
+| Radarr | :7878 | — | `53c4268360444feeae5f98c0cc24e0e3` |
+| Prowlarr | :9696 | — | `9d0ce6c5660743b5bf1c7951efc62252` |
+
+All services run as root (NFS ACL requires root for writes).
+
+## VPN Architecture (updated 2026-06-24)
+
+### wg0 — Internet kill-switch (primary VPN)
+- **Interface:** `wg0` | **VPN IP:** `10.200.0.4/24`
+- **Endpoint:** CT110 at `10.48.200.67:51821` → DO server (165.22.1.228) → internet
+- **Exit IP:** `165.22.1.228` (DO server, verified 2026-06-24)
+- **Kill-switch:** iptables rules — REJECT all non-wg0 non-fwmark traffic; LAN 10.48.200.0/24 always allowed
+- **Config:** `/etc/wireguard/wg0.conf` — fwmark hardcoded as `51820` (not dynamic, avoids PostDown race)
+- **Auto-start:** `systemctl enable wg-quick@wg0` (enabled 2026-06-24)
+- **DNS:** `10.48.200.90` (PVE1 dnsmasq)
+- **MediaStack pubkey:** `CaG79S1fJeJDlYCMhHz8BrDfizBq+OiGnO5VzFIk3gE=`
+- **CT110 pubkey:** `RXxDgIAaie4n0BxBA48rlmt9BJyp2GEktENeQDlc4hA=`
+
+### wg1 — Jellyfin media access (NOT internet VPN)
+- MediaStack is WireGuard server on `wg1` (port 51820, 10.200.0.1/24)
+- Jellyfin (10.48.200.33) connects as peer (10.200.0.3)
+- Used for NFS media file access only
+
+## Media Storage
+- Downloads: `/mnt/nas/video/downloads` (Synology NAS NFS)
+- Movies: `/mnt/nas/video/movies` | TV: `/mnt/nas/video/tv`
+- Old paths `/media/movies` and `/media/tv` are NFS mounts from NAS (Jellyfin backward compat)
+- Jellyfin fstab: `10.48.200.35:/media/movies /mnt/mediastack/movies nfs defaults,_netdev 0 0`
+
+## Indexer — IPTorrents
+- Cookie auth in Prowlarr: `uid=2237410; pass=JzLP2niTWxBJAZIU3yvtLbJzD55kdLeB`
+- Cookies expire — if indexer fails, log into iptorrents.com in browser, copy uid+pass cookies
+
+## JARVIS Agent
+- Agent ID: `MediaStack_2c00b1b8` | Config: `/opt/jarvis-agent/config.json`
+- Registration key: `f846a9aaf7ce9a61742c63c87c4186052a71d2a580c65518` | `ssl_verify: false`
+
+## PBS Backup
+- Nightly at 21:00 → SynologyProx storage
+- Backs up VM regardless of which storage the disk lives on
+
+## Known Issues
+- **wg-quick down/up over SSH kills the connection** — PostDown briefly removes LAN ACCEPT before REJECT; SSH reply is dropped. Always use VM console for wg0 cycling, or use `nohup` background.
+- **NFS write failures** = services not running as root
+- **Radarr "0 active indexers"** = blocked in DB; fix: `sqlite3 /var/lib/radarr/radarr.db "DELETE FROM IndexerStatus WHERE ProviderId=1;"`
+- **Stale NFS file handle on Jellyfin** = lazy unmount + remount on Jellyfin VM