Appendix A — Glossary

TL;DR: Look up unfamiliar terms here. Each entry links to the chapters that explain how you use them.

You can search this page for a word, abbreviation, or command as you encounter it.

How to use this appendix#

Follow a term’s chapter links for the setup instructions. You can return here whenever another unfamiliar term comes up.

ashift#

ashift tells ZFS the size of the blocks it should use when aligning disk writes. The setting is chosen when a disk group is created, so your AI operator checks the drives before choosing it.

Used in: Storage and accounts, Field kit

AUTH_SYS, RPCSEC_GSS, and AUTH_GSS#

These are ways NFS identifies a connecting user. AUTH_SYS trusts the user numbers supplied by the client computer; Kerberos modes verify a login credential. A compromised client can therefore misuse AUTH_SYS even when the server blocks remote root access.

Used in: Storage and accounts

fsync, file locking, and atomic rename#

fsync asks storage to finish saving a write. File locking coordinates programs using the same file, and an atomic rename replaces a filename in one operation. Applications such as databases depend on these behaviors, which is one reason a network folder cannot always replace a local disk.

Used in: Storage and accounts, Services

home.arpa, .local, and mDNS#

home.arpa is a domain reserved for names inside a home network. Names ending in .local use a different discovery system, mDNS, where devices answer on the local network. Mixing the two can make names work on one computer and fail on another.

Used in: Start here, Network and power, Services, Field kit

tmux terminal multiplexer#

tmux keeps a terminal session running when your SSH connection drops. You can reconnect to the same session later; a server reboot still ends it.

Used in: Admin computer, Server setup, Operations, Field kit

Access-control list (ACL; POSIX ACL; Windows ACL; security.NTACL)#

An ACL lists who can access a file or folder and what they can do there. Linux and Windows store these permissions differently; Samba translates between them when Linux shares files with Windows or macOS.

Used in: Storage and accounts, Services, Field kit

ACME and DNS-01#

ACME automatically obtains and renews certificates; DNS-01 proves domain control by placing a temporary DNS record.

Used in: Network and power, Services

Active vs enabled#

Active means a service runs now; enabled means it is configured to start later, usually during boot.

Used in: Server setup, Services, Operations

AI operator permissions and approval settings#

Approval mode decides when tools pause for confirmation; a sandbox decides what those tools can actually reach.

Used in: Your AI operator, Admin computer, Field kit

AI operator roles#

Your AI operator may inspect a system, make a change, or review work. Those jobs can use different accounts so that, for example, a review session can read configuration without changing it.

Used in: Your AI operator, Admin computer, Storage and accounts, Services

AI operator#

Your AI operator is the AI application you work with to configure and troubleshoot your home services. It can use tools to read files, run commands, and make changes within the access you give it.

Used in: Start here, Your AI operator, Admin computer, Field kit

AHCI#

AHCI is a standard controller mode that lets the operating system interact directly with ordinary SATA drives.

Used in: Server setup, Storage and accounts

API, token, and scope#

An API lets one program ask another program to do something. An API token is a credential used for those requests; its scope controls which requests it permits.

Used in: Your AI operator, Admin computer, Services, Field kit

Append-only, immutability, WORM, and object lock#

Append-only storage lets a backup job add new copies while blocking changes to older ones. Immutable or WORM storage can protect those copies from deletion for a set period. WORM stands for “write once, read many.”

Used in: Storage and accounts, Operations, Field kit

Application consistency and quiescing#

An application-consistent backup captures files that belong together at the same usable point in time. Quiescing means briefly pausing or coordinating writes to make that possible; some applications provide their own backup command instead.

Used in: Storage and accounts, Services, Operations, Field kit

Atomic install, sealed release, and TOCTOU#

An atomic installation replaces a configuration as one complete operation. A sealed release is the reviewed copy protected from further editing. These address a timing problem called TOCTOU: a file can change after it has been checked but before an administrator installs it.

Used in: Your AI operator, Admin computer, Storage and accounts, Services, Field kit

Authentication vs authorization#

Authentication asks “who are you?”; authorization asks “what may you do?”

Used in: Your AI operator, Network and power, Storage and accounts, Services

Automatic security updates and unattended-upgrades#

unattended-upgrades can install Ubuntu security patches without a manual command each time. Restarting the server is a separate setting, covered in Server setup.

Used in: Server setup, Operations

Backup retention, forget, and prune#

A backup retention policy chooses how many daily, weekly, or monthly copies to keep. In Restic, forget removes selected backup entries and prune frees storage that no remaining backup uses.

Used in: Storage and accounts, Operations

Backup, snapshot, replica, synchronization, and hot remote storage#

A backup keeps recoverable copies from earlier times. A snapshot records one point in time, often on the same disks; a replica is another copy; synchronization keeps locations alike. A deletion can spread through synchronization, and a snapshot on a failed disk can disappear with the original.

Used in: Start here, Storage and accounts, Operations, Field kit

Bare metal, virtual machine (VM), and hypervisor#

Bare metal runs directly on hardware; a VM is a software-created computer running under a hypervisor.

Used in: Server setup, Services, Operations

Bind mount, named volume, and tmpfs#

Containers can receive an explicit host path, Docker-managed persistent storage, or temporary memory-backed storage.

Used in: Server setup, Services

Blast radius, failure domain, and single point of failure (SPOF)#

These terms describe what fails together and how much else one failure or mistake can harm.

Used in: Start here, Your AI operator, Network and power, Storage and accounts, Operations

Block device, raw disk, and durable disk ID#

Linux represents disks and partitions as block devices. Names such as /dev/sdb can change after a reboot; a drive serial number or other persistent identifier helps your AI operator recognize the intended disk.

Used in: Server setup, Storage and accounts, Field kit

Boot chain: BIOS, UEFI, EFI system partition, Secure Boot, and bootloader#

The boot chain is the sequence that takes a powered-off computer from firmware to a running operating system.

Used in: Server setup, Operations, Field kit

Break-glass identity#

This is an emergency administrator account you can use when the normal sign-in service fails. Its credential belongs in your password manager and recovery instructions.

Used in: Your AI operator, Admin computer, Network and power, Services

Caddy, reverse proxy, and ingress#

A reverse proxy receives a web request and forwards it to the appropriate application. Caddy and Traefik are examples. In Kubernetes, ingress configuration describes how incoming web requests reach applications.

Used in: Services, Operations

Carrier-grade NAT (CGNAT) and double NAT#

CGNAT or double NAT places another translating router upstream, often preventing ordinary inbound port forwarding.

Used in: Network and power, Field kit

Cattle vs pet#

These informal terms contrast computers you can rebuild from saved configuration with computers whose setup depends on undocumented manual changes. The useful question is whether your records and backups let you replace the machine.

Used in: Server setup, Operations

Certificate authority (CA), public-key infrastructure (PKI), certificate, and TLS#

A TLS certificate lets your browser check the identity of a website before establishing an encrypted connection. A certificate authority signs certificates that browsers trust; PKI is the wider system for issuing and managing them.

Used in: Start here, Network and power, Services

Checksum, hash, digest, and SHA-256#

A digest is a short fingerprint of bytes; SHA-256 is one common algorithm used to make it.

Used in: Admin computer, Server setup, Storage and accounts, Services, Field kit

CMR vs SMR#

CMR and SMR are hard-drive recording methods with different sustained-write and rewrite behavior.

Used in: Storage and accounts, Field kit

Cold boot, reboot, and AC-power return#

A reboot restarts a running computer. A cold boot starts it from a powered-off state. The power-return setting determines whether it starts by itself when electricity comes back after an outage.

Used in: Admin computer, Server setup, Network and power, Operations

Cold spare#

A cold spare is a tested replacement disk stored offline until a specific failure needs it.

Used in: Storage and accounts

Prepared administrator procedure#

This guide uses a prepared administrator procedure when a change needs your elevated access. Your AI operator gathers the commands, explains their effect, and provides a way to undo the change so you can review and run the procedure together.

Used in: Start here, Your AI operator, Admin computer, Server setup, Network and power, Storage and accounts, Services, Field kit

Container authority: rootful, rootless, Docker socket, and docker group#

Control of a rootful Docker daemon is usually control of the host, even when exposed through a socket or group membership.

Used in: Server setup, Services, Operations

Container bridge network#

A bridge network is a private software network joining containers on one host, usually with NAT for outbound traffic.

Used in: Services

Container, image, Compose service, and Compose project#

A container runs an application from a packaged image. A Docker Compose file describes how to run it, including its settings, folders, and network connections. Related applications in that file form a Compose project.

Used in: Start here, Services, Operations

Conversation limits and saved handoffs#

An AI application may shorten an older conversation to fit new work. A saved handoff tells the next session what changed and what remains unfinished; the GitHub records preserve the underlying configuration and history.

Used in: Your AI operator, Admin computer, Operations, Field kit

Control plane, data plane, and management plane#

The control plane decides configuration, the data plane carries ordinary work, and the management plane exposes administrative controls.

Used in: Start here, Admin computer, Network and power, Services, Operations

Copy-on-write (CoW)#

Copy-on-write preserves old blocks and writes changes elsewhere, making fast snapshots possible.

Used in: Storage and accounts

Credential, secret, key, token, and credential reference#

These prove identity, unlock data, or authorize operations; a reference records where recovery material belongs without exposing its value.

Used in: Your AI operator, Admin computer, Network and power, Storage and accounts, Services, Field kit

Independent AI review#

An independent review asks a second AI operator to assess the proposed work before seeing the first review. Both receive the same relevant records. You can then compare their concerns and ask for checks that resolve disagreements.

Used in: Your AI operator, Admin computer, Field kit

Daemon, service, systemd unit, timer, drop-in, and target#

A daemon is a program that runs in the background. On Ubuntu, systemd starts and supervises services using unit files. A timer schedules work, a drop-in adds settings to an existing unit, and a target groups units that start together.

Used in: Server setup, Services, Operations

Dataset, storage pool, and vdev#

A ZFS pool combines storage from one or more disk groups called vdevs. A dataset is a separately managed filesystem within that pool, with its own settings for matters such as snapshots and space limits.

Used in: Start here, Storage and accounts, Field kit

Deduplication#

Deduplication stores identical data blocks only once, at a potentially substantial memory and metadata cost.

Used in: Storage and accounts

Default deny and fail closed#

Default deny means access is blocked until a rule allows it. Fail closed means an operation stops when a required check cannot be completed—for example, an application stays stopped when its data drive is missing.

Used in: Your AI operator, Server setup, Network and power, Storage and accounts, Services

Dependency graph and dependency closure#

A dependency map shows what a service needs to work. A dependency closure is the complete set of files or components involved, including items loaded indirectly. This matters when a configuration file includes other files that also affect its behavior.

Used in: Start here, Admin computer, Network and power, Services, Field kit

Desired state, observed state, and last-known-good state#

Desired state is the setup you intend to have. Observed state is what inspection finds now. Last-known-good state is the most recent setup you tested successfully.

Used in: Your AI operator, Admin computer, Operations, Field kit

Destructive authorization#

This is your approval for a particular operation that erases or replaces data, such as formatting a named drive. It applies to that operation and target, rather than giving the AI operator ongoing permission to erase things.

Used in: Storage and accounts, Field kit

DHCP, lease, pool, and reservation#

DHCP assigns network settings; a reservation gives known hardware a stable address from one authoritative service.

Used in: Start here, Server setup, Network and power, Field kit

Direct-IP and direct-Ethernet recovery path#

Connecting by IP address avoids a dependency on DNS. Direct Ethernet recovery goes further: a cable and separately configured addresses let your admin computer reach a server without the router. These recovery addresses are separate from the normal home-network addresses.

Used in: Start here, Server setup, Network and power, Field kit

DNS, resolver, upstream resolver, A record, AAAA record, and reverse record#

DNS translates names; A records return IPv4, AAAA records return IPv6, and reverse records map addresses back to names.

Used in: Start here, Network and power, Operations, Field kit

Dynamic DNS (DDNS)#

Dynamic DNS updates a public name when a residential public address changes.

Used in: Network and power

Egress vs ingress#

Ingress is traffic entering a computer or network; egress is traffic leaving it. Firewall settings can control both directions.

Used in: Your AI operator, Admin computer, Network and power, Services

Encryption at rest, full-disk encryption, dataset encryption, and FileVault#

Encryption protects stored bytes with a key, but may trade theft protection against unattended reboot and recovery.

Used in: Admin computer, Server setup, Storage and accounts, Field kit

EUI, WWN, UUID, and GUID#

These durable identifiers name hardware, filesystems, or pools more reliably than transient device names.

Used in: Server setup, Storage and accounts, Field kit

Exposure class#

An exposure class says who can reach a service and which path is used for administration.

Used in: Start here, Network and power, Services, Field kit

ext4#

ext4 is the Linux filesystem used for the operating-system SSD in this guide. ZFS manages the separate data drives. Server setup explains the choice and how to size the OS disk.

Used in: Server setup, Storage and accounts

Extended attribute (xattr)#

An extended attribute stores small metadata attached to a file beyond its name, contents, owner, group, and basic mode bits.

Used in: Server setup, Storage and accounts, Operations, Field kit

File ownership, Unix mode, 0600, chmod, and chown#

Unix owner, group, and mode bits control basic file access; chmod and chown change them.

Used in: Admin computer, Storage and accounts, Services

Filesystem, partition, volume, mount, and mountpoint#

A partition is a section of a disk. A filesystem organizes files in that space, while a volume is a storage unit that may span or subdivide disks. Mounting makes a filesystem available at a folder called its mountpoint.

Used in: Server setup, Storage and accounts, Services

Firewall, stateful firewall, source-constrained rule, and UFW#

A firewall controls traffic; a stateful, source-constrained rule admits only intended sources and their expected replies.

Used in: Server setup, Network and power, Services, Operations

Firmware, BIOS, and baseboard management controller (BMC)#

Firmware runs below the operating system; a BMC adds powerful hardware-level management and power control.

Used in: Server setup, Network and power, Operations

Forced SSH command#

A forced SSH command makes one key run a fixed server-side program instead of receiving an arbitrary shell.

Used in: Your AI operator, Admin computer, Server setup

FreeIPA, LDAP, Active Directory (AD/AD DS), and Kerberos#

These systems centralize identities and authentication, but add DNS, time, backup, and recovery dependencies.

Used in: Start here, Storage and accounts, Services

Git repository, working tree, diff, commit, remote, push, and revert#

Git keeps a history of configuration and text records. A working tree is the copy you edit on your admin computer; a diff shows changes, a commit saves a version, and a push sends commits to your private GitHub repository. Reverting creates a new commit that reverses a previous change; applying that configuration to a running server is a separate step.

Used in: Start here, Admin computer, Server setup, Field kit

Graceful shutdown, quiescing, and load shedding#

A graceful shutdown gives applications time to save and close their work. Load shedding shuts down less important equipment first so the UPS can power essential equipment longer.

Used in: Network and power, Storage and accounts, Services, Operations

Grant, authority, and enforcement point#

A grant gives an account permission to perform an action. The operating system or service checks that permission when the account tries to act. Written instructions to your AI operator do not themselves enforce access limits.

Used in: Your AI operator, Admin computer, Network and power, Storage and accounts, Services, Operations, Field kit

Group Policy#

Group Policy centrally configures Windows users and computers joined to Active Directory.

Used in: Storage and accounts

Hard link#

A hard link is another filename for the same underlying file and cannot cross filesystem boundaries.

Used in: Services

Hardware burn-in#

Burn-in checks new or reused equipment under sustained load before you depend on it. It can reveal problems with memory, cooling, disks, or power that a quick boot would miss.

Used in: Server setup, Network and power

HBA, JBOD, hardware RAID, and fake RAID#

HBA/JBOD paths expose individual disks; hardware or fake RAID combines or hides them behind a controller volume.

Used in: Server setup, Network and power, Storage and accounts

Headroom, quota, and reservation#

Headroom is spare capacity, a quota caps use, and a reservation guarantees capacity to one dataset or workload.

Used in: Storage and accounts, Services, Field kit

Health check, readiness check, liveness check, and startup check#

These answer different questions: started, ready for traffic, still functioning, or still within normal startup.

Used in: Services, Operations

Heartbeat, dead-man check, black-box monitoring, and white-box monitoring#

A heartbeat is a regular “still running” signal; a dead-man check alerts when an expected signal fails to arrive. A black-box check tries the service as a user would, while a white-box check reads internal measurements such as disk space or error counts.

Used in: Network and power, Operations, Field kit

High availability (HA), quorum, and single point of failure (SPOF)#

High availability means a service can keep working through specified failures. A single point of failure is a component whose loss still stops it. Cluster systems often use a voting majority, called quorum, to decide which changes they may make.

Used in: Storage and accounts, Operations

Host networking and network namespace#

A network namespace gives a workload its own network view; host networking shares the machine's interfaces, addresses, and ports.

Used in: Services, Operations

Host-key fingerprint#

An SSH host-key fingerprint identifies the server, not the person connecting to it.

Used in: Admin computer, Server setup, Network and power, Field kit

Hot remote storage#

Hot remote storage stays directly usable elsewhere; it is not automatically a backup.

Used in: Storage and accounts

I/O and IOPS#

I/O is data moving into or out of storage; IOPS measures how many separate input/output operations happen each second.

Used in: Storage and accounts, Services

Identity provider (IdP), single sign-on (SSO), OpenID Connect (OIDC), multi-factor authentication (MFA), and passkey#

An identity provider lets one account authenticate to multiple services; OIDC is a common web-login protocol, MFA adds another factor, and a passkey is a phishing-resistant credential.

Used in: Start here, Your AI operator, Admin computer, Network and power, Storage and accounts, Services

Identity: UID, GID, POSIX principal, and service account#

A UID identifies a Unix user, a GID identifies a group, and files store those numbers rather than the friendly names shown on screen.

Used in: Start here, Server setup, Storage and accounts, Services, Field kit

Image tag vs image digest#

A container-image tag is a movable human-readable label; a digest identifies immutable image content.

Used in: Services, Operations, Field kit

Incident grouping, deduplication, inhibition, and silence#

These mechanisms combine repeated alerts, suppress predictable child symptoms, or temporarily mute known maintenance noise.

Used in: Network and power, Operations, Field kit

Interface, network interface card (NIC), and MAC address#

A network interface is the operating-system view of a network port; a NIC is the hardware, and its MAC address is a link-layer identifier.

Used in: Server setup, Network and power, Field kit

IOMMU#

An IOMMU controls how hardware devices access memory, supporting safer virtualization and device assignment.

Used in: Server setup, Services

IP address, subnet, prefix, route, and default gateway#

An IP address identifies a network interface, a subnet or prefix describes a local address range, and a route tells traffic where to go.

Used in: Server setup, Network and power, Field kit

IPv4, IPv6, and RFC 1918 private addressing#

IPv4 and IPv6 are two Internet addressing systems; RFC 1918 defines familiar private IPv4 ranges used inside homes.

Used in: Admin computer, Server setup, Network and power, Services, Field kit

Journal, filesystem journaling, and journalctl#

A filesystem journal helps recover consistent metadata after a crash; the systemd journal stores structured service and boot logs.

Used in: Server setup, Operations

Just in time (JIT)#

Just-in-time design adds a component, record, or permission when a real consumer needs it, not merely because it may be useful someday.

Used in: Start here, Network and power, Storage and accounts, Services, Field kit

k3s embedded etcd and quorum#

etcd stores Kubernetes control-plane state; quorum means a majority of its members must agree.

Used in: Operations

Kerberos, keytab, and service principal#

Kerberos issues time-limited tickets proving identities; a service principal names a service, and a keytab stores its machine credential.

Used in: Storage and accounts, Services

Key expiry, rotation, and revocation#

Expiry ends a credential automatically, rotation replaces it, and revocation invalidates it deliberately.

Used in: Your AI operator, Admin computer, Network and power, Services, Field kit

Keyboard-video-mouse console (KVM), PiKVM, BMC, and out-of-band management#

A KVM lets you see a computer’s screen and use its keyboard and mouse remotely, including before the operating system starts. PiKVM is one option; a BMC is similar management hardware built into some servers. One PiKVM with a compatible switch can serve your admin computer and several servers, one active console at a time.

Used in: Network and power, Operations, Field kit

Kubernetes and k3s: nodes, Pods, and controllers#

Kubernetes runs applications across computers called nodes; k3s is a compact Kubernetes distribution. Server nodes coordinate the cluster, while worker nodes run applications. A Pod groups running containers, and a controller repeatedly adjusts them to match the saved configuration—a process called reconciliation.

Used in: Start here, Services, Operations

Kubernetes CNI and NetworkPolicy#

A CNI plugin provides networking between applications in a Kubernetes cluster. NetworkPolicy describes allowed connections; the chosen networking plugin must support and enforce it.

Used in: Operations

Kubernetes security: namespace, RBAC, service account, Secret, admission, and Pod Security Standards#

Namespaces organize Kubernetes resources. RBAC controls access, service accounts identify applications, and Secrets hold credentials or similar values. Admission checks can reject application configurations that violate the cluster’s rules, including its Pod Security Standards.

Used in: Operations

LAN vs WAN#

The LAN is the local home network; the WAN side connects the router toward the provider and Internet.

Used in: Start here, Server setup, Network and power, Field kit

Least privilege#

Least privilege means giving an account only the access needed for its job. For example, a monitoring account may need to read disk health without being able to format a disk.

Used in: Your AI operator, Admin computer, Server setup, Network and power, Storage and accounts, Services

Lights-out operation#

Lights-out operation means routine work and ordinary failures can be handled without visiting the equipment.

Used in: Start here, Admin computer, Network and power, Operations

Linux distribution, LTS, APT repository, PPA, package pin, and release channel#

A distribution is a packaged Linux operating system, such as Ubuntu. LTS releases receive long-term support. APT installs software from repositories; a PPA is an additional Ubuntu software source. Version pins and release channels control which versions you receive.

Used in: Server setup, Services, Operations, Field kit

Listener, port, socket, and protocol#

A listener is a program waiting for connections. Its port number helps direct a connection to the right program, and the protocol defines how they communicate. A socket is a communication endpoint, either on the network or within a computer.

Used in: Server setup, Network and power, Services, Operations

Log rotation and persistent logs#

Persistent logs survive reboot; rotation bounds the disk space and history they consume.

Used in: Admin computer, Server setup, Services, Operations

Logical Volume Manager (LVM)#

LVM adds flexible logical storage between physical disks or partitions and filesystems.

Used in: Server setup, Storage and accounts

Loopback (127.0.0.1 and ::1)#

Loopback is networking that remains inside one machine.

Used in: Services

Mac vs MAC address#

A Mac is an Apple computer; a MAC address is a network-interface identifier.

Used in: Admin computer, Server setup, Network and power, Field kit

Maintenance window and change freeze#

A maintenance window is an agreed time for work that may interrupt services. A change freeze postpones nonessential changes, often while diagnosing a problem or preparing to be away.

Used in: Server setup, Network and power, Storage and accounts, Services, Operations, Field kit

Manifest, desired state, source of truth, and authoritative copy#

A manifest is a file describing the setup you want. The source of truth is the agreed place to find the maintained version—for this guide’s configuration and records, your private GitHub repository.

Used in: Admin computer, Network and power, Storage and accounts, Services, Operations

Migration, cutover, and soak period#

A migration moves a service or its data. Cutover is when you start using the replacement, and a soak period is time spent checking that it works under normal use before removing the old setup.

Used in: Storage and accounts, Services, Operations

Mirror#

A mirror stores equivalent copies of each block on multiple disks within one vdev.

Used in: Start here, Storage and accounts

Redacted records and private identifiers#

A redacted record replaces private identifiers with labels such as server-a. A separate protected list lets you match those labels to the actual equipment. Your AI operator can use the redacted record when its task does not require the private details.

Used in: Admin computer, Storage and accounts, Field kit

AI capability, usage limits, and billing#

Your AI operator runs on an underlying AI model. Its capability, reasoning setting, and the amount of material it processes affect speed and cost. Subscriptions have usage limits; API access is generally billed by measured use. Check the provider’s current terms before estimating a job.

Used in: Your AI operator, Admin computer, Field kit

Mount ordering: _netdev, nofail, RequiresMountsFor=, Requires=, and After=#

These Linux settings control when storage and services start. They can make an application wait for its required filesystem; separate checks may also be needed to stop it if the mounted storage later disappears. The storage chapter explains the missing-mount problem.

Used in: Server setup, Storage and accounts, Services

Multicast and service discovery#

Multicast lets devices announce or discover services among nearby peers without knowing each address first.

Used in: Network and power, Services

NAT, port forwarding, UPnP, NAT-PMP, and PCP#

NAT translates addresses, port forwarding maps inbound traffic deliberately, and UPnP/NAT-PMP/PCP can create mappings automatically.

Used in: Network and power, Services

NetBIOS name, SID, passdb, tdbsam, and group mapping#

These are parts of Samba's Windows-facing identity state beyond ordinary Unix usernames.

Used in: Storage and accounts, Field kit

Netplan#

Netplan is Ubuntu’s system for describing network settings in configuration files. It passes those settings to the software that manages the network interfaces.

Used in: Server setup, Field kit

Network protocol cheat sheet: DNS, DHCP, HTTP(S), SSH, NFS, SMB, and SNMP#

DNS looks up names; DHCP supplies network settings; HTTP and HTTPS carry web requests; SSH provides remote terminal access; NFS and SMB share files; SNMP reports equipment status. Each serves a different purpose, so allowing one through a firewall does not enable the others.

Used in: Admin computer, Server setup, Network and power, Storage and accounts, Services, Field kit

Network UPS Tools (NUT)#

NUT reads UPS status and coordinates orderly shutdown among machines sharing protected power.

Used in: Network and power, Operations

Network-attached storage (NAS)#

A NAS is a machine or appliance whose main job is serving storage over a network.

Used in: Storage and accounts, Field kit

NFS root squashing and no_root_squash#

Root squashing maps remote UID 0 to an unprivileged anonymous identity instead of server root.

Used in: Your AI operator, Server setup, Storage and accounts, Services

NFS vs SMB and Samba#

NFS usually serves trusted Unix hosts/apps; SMB serves people using Windows and macOS, commonly through Samba.

Used in: Start here, Server setup, Storage and accounts, Services

NVMe, SATA, SAS, HDD, SSD, and USB storage#

HDD and SSD describe media; NVMe, SATA, SAS, and USB describe common device or transport paths.

Used in: Server setup, Network and power, Storage and accounts, Field kit

Object storage, bucket, object lock, and immutability#

Object storage keeps named blobs in buckets, while object lock can prevent even an administrator from deleting protected backup versions before a deadline.

Used in: Storage and accounts, Operations

Off-host vs off-site backup#

Off-host means the copy is on another machine; off-site means the copy is outside the same physical disaster zone.

Used in: Start here, Storage and accounts, Operations

OpenZFS and ZFS#

OpenZFS is the current open-source implementation of ZFS, a storage system that combines volume management, a checksumming filesystem, snapshots, and replication.

Used in: Server setup, Storage and accounts, Operations

Orchestration#

Orchestration coordinates deployment, placement, restart, networking, and lifecycle for many workloads according to declared state.

Used in: Start here, Services, Operations

Overlay network, virtual private network (VPN), and WireGuard#

An overlay VPN builds an encrypted private network over existing networks; WireGuard is a common encrypted tunnel protocol beneath products such as Tailscale.

Used in: Your AI operator, Admin computer, Network and power, Services, Field kit

Package and dependency update strategy#

This is the plan for updating applications and the software they rely on. In this guide, security patches run automatically where configured, while larger upgrades get a scheduled change and a check of the services afterward.

Used in: Your AI operator, Server setup, Services, Operations

Parity and RAIDZ#

Parity stores enough mathematical information to reconstruct missing data after a limited number of disk failures; RAIDZ is ZFS's parity-vdev family.

Used in: Storage and accounts, Operations

Persistent state, bulk data, and scratch space#

Persistent state must survive rebuilds, bulk data is large user or media content, and scratch space is disposable working data.

Used in: Storage and accounts, Services, Operations

Pi-hole and DNS sinkhole#

Pi-hole is a network DNS resolver that blocks selected names before clients connect to advertising, tracking, or unwanted endpoints.

Used in: Network and power, Services, Operations

Plex direct play, direct stream, transcode, and hardware acceleration#

Direct play sends media unchanged, direct stream repackages compatible streams, and transcoding converts audio or video, often using a GPU or media engine.

Used in: Services, Operations

Portable Operating System Interface (POSIX)#

POSIX is a family of standards describing common Unix-like operating-system behavior, including files, permissions, processes, users, and shell interfaces.

Used in: Server setup, Storage and accounts, Services

Power distribution unit (PDU)#

A PDU provides power outlets for rack equipment. Some measure consumption or let you switch outlets remotely.

Used in: Network and power, Operations, Field kit

Prompt injection#

Prompt injection places instructions in material your AI operator is reading, such as a web page or log, to divert it from your request. Restricted accounts limit the damage if it follows those instructions.

Used in: Your AI operator, Admin computer, Operations

Quorum#

Quorum is the number of members that must agree before a cluster can make a decision, usually a majority. A three-member voting group can lose one member and still have that majority.

Used in: Services, Operations

Quota#

A quota is a limit on a consumable resource such as storage, requests, tokens, bandwidth, or model usage.

Used in: Start here, Your AI operator, Admin computer, Operations

Rack unit (U), rack depth, and equipment envelope#

A rack unit measures equipment height, while the full physical envelope also includes depth, rail range, cable bend, airflow, weight, and service clearance.

Used in: Network and power, Field kit

RAID levels: stripe, mirror, RAID5/6/10, and RAIDZ#

RAID layouts trade capacity, performance, and tolerance of disk failures, but none replaces a backup.

Used in: Storage and accounts, Operations

Read-only access vs unprivileged access#

Read-only access prevents changes through that particular connection. An unprivileged account lacks administrator access but can still modify files it owns. The two describe different limits.

Used in: Your AI operator, Admin computer, Server setup, Operations

Recovery point objective (RPO) and recovery time objective (RTO)#

RPO is how much recent data loss is acceptable; RTO is how long the service may remain unavailable.

Used in: Start here, Storage and accounts, Services, Operations

Redundancy vs replica#

Redundancy keeps a function available after a component fails; a replica is another copy, which helps only when it is independent and usable.

Used in: Start here, Network and power, Storage and accounts, Services, Operations

Restic, backup repository, snapshot, and restore#

Restic encrypts and deduplicates files into a backup repository, where each backup snapshot is an indexed view that can later be restored.

Used in: Storage and accounts, Operations, Field kit

Role-based access control (RBAC)#

RBAC grants permissions to roles and assigns people or service identities to those roles instead of managing every permission individually.

Used in: Your AI operator, Admin computer, Services, Operations

Rollback, revert, and fix forward#

Rollback restores the prior working state, revert applies a new inverse change, and fix forward introduces another change intended to repair the current state.

Used in: Your AI operator, Services, Operations, Field kit

Root, sudo, privilege, and privilege escalation#

Root is the Linux administrator account. sudo lets an authorized account run a command with additional permissions, often as root. Privilege escalation is a way of gaining access beyond the account’s starting permissions.

Used in: Your AI operator, Admin computer, Server setup, Operations, Field kit

Route, subnet router, and jump host#

A route chooses the next path for network traffic, a subnet router advertises reachability to another network, and a jump host is an intermediate login point for administration.

Used in: Admin computer, Network and power, Operations, Field kit

Runbook, decision record, change journal, and session transcript#

A runbook says how to operate a system, while decision records, change journals, and transcripts preserve why it exists and what actually happened.

Used in: Start here, Your AI operator, Admin computer, Operations, Field kit

Samba and Server Message Block (SMB)#

SMB is a network file-sharing protocol used heavily by Windows and macOS; Samba is the common open-source server and identity implementation on Linux.

Used in: Storage and accounts, Services, Operations

Sector size, 512e, 4Kn, and alignment#

Sector size is the drive's basic addressable block; 512e emulates 512-byte sectors over 4 KiB media, while 4Kn exposes 4 KiB sectors directly.

Used in: Server setup, Storage and accounts, Field kit

Self-Monitoring, Analysis and Reporting Technology (SMART)#

SMART exposes drive health counters and self-tests that can warn about some failures, but a passing result is not a guarantee.

Used in: Server setup, Storage and accounts, Operations, Field kit

Semantic diff#

A semantic diff explains what a configuration change does. For example, it identifies that a firewall edit opens a service to the Internet, rather than only displaying the changed lines.

Used in: Your AI operator, Admin computer, Services, Operations

Service identity and service account#

A service account is an account used by a program. It gives the program its own permissions and credentials, separate from your personal login.

Used in: Your AI operator, Server setup, Storage and accounts, Services, Operations

Service tiers and criticality#

Service tiers group applications by how urgently you need them back after a failure. The groups help you decide the order of recovery and how much downtime is acceptable.

Used in: Start here, Your AI operator, Services, Operations

Snapshot#

A snapshot is a point-in-time view of data that is usually fast and space-efficient but commonly shares the original storage's failure domain.

Used in: Server setup, Storage and accounts, Operations

Split DNS and MagicDNS#

Split DNS sends selected name queries to different resolvers; MagicDNS supplies convenient Tailscale names for devices in a tailnet.

Used in: Admin computer, Network and power, Services, Operations

SSH key, authorized key, host key, known hosts, and restrictions#

A client key authenticates a user, a host key authenticates the server, and restrictions can confine what a particular authorized key is allowed to do.

Used in: Your AI operator, Admin computer, Server setup, Operations, Field kit

Stateful vs stateless service#

A stateless service can be recreated from configuration and external inputs; a stateful service owns data or identity that must be preserved and coordinated.

Used in: Services, Operations

Subordinate UID/GID ranges (subuid, subgid) and user namespaces#

User namespaces map identities inside a container to different, usually unprivileged, numeric IDs on the host using subordinate UID and GID ranges.

Used in: Server setup, Storage and accounts, Services

Tailscale, tailnet, node, tag, ACL/grant, exit node, and subnet router#

Tailscale builds an identity-aware WireGuard overlay called a tailnet; tags, policy, exit nodes, and subnet routers control device roles and traffic paths.

Used in: Your AI operator, Admin computer, Network and power, Services, Field kit

TCP, UDP, and port mapping#

TCP provides ordered connections, UDP sends independent datagrams, and port mapping translates an address-and-port tuple across a boundary such as NAT or a container host.

Used in: Admin computer, Server setup, Network and power, Services, Operations

Topology and dependency map#

Topology describes how components connect; a dependency map shows what each capability needs in order to function or recover.

Used in: Start here, Your AI operator, Network and power, Services, Operations, Field kit

Transactional change#

A transactional change either completes as a coherent unit or leaves the system in a known prior state instead of an ambiguous halfway condition.

Used in: Your AI operator, Admin computer, Server setup, Operations, Field kit

Uninterruptible power supply (UPS), watts, volt-amperes (VA), and runtime#

A UPS supplies temporary battery power; watts measure real load, VA reflects apparent load, and runtime estimates how long the battery can sustain that load.

Used in: Network and power, Operations, Field kit

Configuration checks#

A validator checks whether a file follows the expected format. A check with the actual program then confirms that the program accepts the configuration. A working-service check is still needed after installation.

Used in: Your AI operator, Admin computer, Services, Operations, Field kit

Version pin and release channel#

A version pin selects one known artifact version, while a release channel follows a moving stream such as stable, beta, or nightly.

Used in: Your AI operator, Server setup, Services, Operations

Virtual LAN (VLAN), network segmentation, and SSID#

A VLAN separates a wired network into logical groups, such as household devices and cameras. An SSID is the name of a Wi-Fi network, which can place connecting devices into one of those groups. Router and firewall settings control traffic between the groups.

Used in: Network and power, Services, Operations, Field kit

Wildcard certificate#

A wildcard TLS certificate covers many one-level hostnames under a domain, such as *.example.net, using one certificate and private key.

Used in: Admin computer, Network and power, Services, Operations

Windows security identifier (SID)#

A SID is Windows's stable machine-readable identifier for a user, group, computer, or other security principal.

Used in: Storage and accounts, Operations

YAML, JSON, and CSV#

YAML and JSON are formats for configuration and other structured data. CSV stores rows and columns, like a simple spreadsheet. Programs read these formats according to strict syntax rules, so a file that looks plausible may still contain an error.

Used in: Your AI operator, Admin computer, Services, Operations, Field kit

ZFS L2ARC, SLOG, and special vdev#

L2ARC provides extra read cache. A SLOG holds the log used for certain writes that must be confirmed as safely stored. A special vdev stores selected filesystem information or small blocks and becomes part of the pool’s required storage. These are optional additions to assess for a measured need.

Used in: Storage and accounts

ZFS resilver vs scrub#

A resilver reconstructs data onto a replacement or rejoined ZFS device; a scrub reads and verifies allocated data across the pool.

Used in: Storage and accounts, Operations

ZFS: pool, vdev, dataset, zvol, ARC, snapshot, scrub, resilver, and send/receive#

ZFS manages disks and files together. Pools contain disk groups called vdevs; datasets hold files, and zvols provide virtual disks. ARC caches reads in memory. Snapshots preserve earlier views, scrubs check stored data, resilvering rebuilds disk redundancy, and send/receive copies ZFS snapshots to another location.

Used in: Server setup, Storage and accounts, Operations, Field kit