Add RomM LXC 134 docs (strong, 192.168.8.249, roms.hubris.network)

containers/134-romm.md

@@ -0,0 +1,82 @@
+# 134 — `romm`
+
+Self-hosted ROM manager ([RomM](https://romm.app)). Browse, search, and play
+your retro game library from the browser. Runs on Docker Compose with a
+MariaDB sidecar.
+
+## At a glance
+
+- **Hostname:** `romm`
+- **IP:** `192.168.8.249/28` (static, vmbr1 on strong)
+- **Privilege:** privileged
+- **Resources:** 1 core / 2 GiB RAM / 16 GiB rootfs (Debian 13, ludo-lvm)
+- **Mounts:** `/mnt/media_local` → `/mnt/library`
+- **Public hostname:** `roms.hubris.network`
+
+## Service / port map
+
+| Service | Listen | Notes |
+|---------|--------|-------|
+| RomM    | `192.168.8.249:80` | HTTP (Caddy terminates TLS) |
+| MariaDB | internal only       | Sidecar in the same compose stack |
+
+## Compose
+
+Located at `/opt/romm/docker-compose.yml`. Key points:
+
+- Image: `rommapp/romm:latest`
+- DB sidecar: `mariadb:latest` with healthcheck
+- ROM library: `/mnt/library/roms` → `/romm/library` (writable)
+- Resources (covers, etc.): Docker named volume `romm_resources` → `/romm/resources`
+- Saves/states: `/opt/romm/assets` → `/romm/assets`
+- Config: `/opt/romm/config` → `/romm/config`
+- Auth key: auto-generated, stored in `/opt/romm/.env`
+
+Environment (`/opt/romm/.env`):
+- `DB_ROOT_PASSWD` / `DB_PASSWD` — MariaDB credentials
+- `DB_USER=romm-user` / `DB_NAME=romm`
+- `ROMM_AUTH_SECRET_KEY` — auto-generated
+
+## ROM library structure
+
+RomM expects `/mnt/library/roms/<platform>/<game>/<rom>`. Create platform
+directories as needed:
+
+```
+/mnt/media_local/roms/
+├── gba/
+│   └── Pokemon - Emerald/
+│       └── Pokemon Emerald.gba
+├── snes/
+│   └── Super Mario World/
+│       └── Super Mario World.sfc
+└── psx/
+    └── Final Fantasy VII/
+        └── Final Fantasy VII.bin
+```
+
+## Media permissions
+
+The `/mnt/media_local/roms` directory is owned `root:media` with mode `2775`
+(setgid). New files inherit the `media` GID (10000). The LXC is privileged so
+no idmap block is needed — in-container UID/GID matches the host. Docker
+containers within the LXC run as-is (read-only mount).
+
+## Related
+
+- [Strong host](../hosts/strong.md)
+- [Caddy (121)](121-caddy.md) — `roms.hubris.network → 192.168.8.249:80`
+- [DNS (107)](107-dns.md) — `roms.hubris.network A 192.168.8.175`
+- [Media permissions](../infrastructure/media-permissions.md)
+- [RomM docs](https://docs.romm.app)
+
+## Changelog
+
+### 2026-07-05 — provisioned
+
+LXC 134 created on strong (Debian 13, privileged, `192.168.8.249/28`).
+Docker + Compose installed. RomM stack deployed at `/opt/romm/`.
+Created `/mnt/media_local/roms` with setgid `media:GID=10000` mode `2775`.
+Caddy `roms.hubris.network` → `192.168.8.249:80`.
+DNS `roms A 192.168.8.175` added to Technitium.
+Hubris /32 route for `.249` added to `50-strong-route`.

containers/index.md

@@ -19,7 +19,8 @@ Most containers live on [`hubris`](../hosts/hubris.md). Some have been
 | 128 | [trmnl](128-trmnl.md)                   | hubris  | 192.168.8.211 | unpriv | 1 | 768 MiB | 8 GiB  | —                     | `trmnl.hubris.network`                | running  |
 | 129 | [house](129-house.md)                   | **strong** | 192.168.8.244 | unpriv | 2 | 3 GiB  | 8 GiB  | —                     | `house.hubris.network`                | running  |
 | 130 | [grimmory](130-grimmory.md)             | **strong** | 192.168.8.247 | priv | 1 | 2 GiB  | 16 GiB | `/mnt/media_local` (via mp0) | `books.hubris.network`         | running  |
-| 132 | [rclone](132-rclone.md)                 | hubris  | 192.168.8.214 | priv | 1 | 1 GiB  | 8 GiB  | `/mnt/library` (**ro**) | — (LAN-only UI `:5572`)             | running  |
+|| 132 | [rclone](132-rclone.md)                 | hubris  | 192.168.8.214 | priv | 1 | 1 GiB  | 8 GiB  | `/mnt/library` (**ro**) | — (LAN-only UI `:5572`)             | running  |
+|| 134 | [romm](134-romm.md)                     | **strong** | 192.168.8.249 | priv | 1 | 2 GiB  | 16 GiB | `/mnt/media_local` (via mp0) | `roms.hubris.network`          | running  |
 
 ## Recently destroyed (kept for archaeology)
 

inventory.yaml

@@ -353,6 +353,21 @@ hosts:
     notes:
     - Seanime anime media server for online streaming + local library scanning
     - Created 2026-07-05. Binary at /opt/seanime/bin/seanime, systemd service.
+  romm:
+    kind: lxc
+    pve_id: 134
+    host: strong
+    os: linux
+    role: rom-manager
+    lan_ip: 192.168.8.249
+    public_host: roms.hubris.network
+    mounts:
+    - /mnt/media_local
+    notes:
+    - Docker host for RomM (romm.app) self-hosted ROM manager. Created 2026-07-05.
+    - MariaDB sidecar at /opt/romm/docker-compose.yml.
+    - ROMs on ludo-lvm media volume at /mnt/media_local/roms.
+    - 1 core / 2 GiB RAM / 16 GiB rootfs (ludo-lvm).
   # 123 (claudio-bot) — destroyed 2026-06-04, replaced by Hermes Agent
   # 126 (plato) — destroyed 2026-06-28, notes workspace decommissioned
   zimaos: