# Helium archive-node deployment

This directory contains the non-secret manifests for the dedicated helium
archive node. Install the files into these separate compose projects:

- `~/Repositories/compose/qbittorrent-helium/compose.yaml`
- `~/Repositories/compose/syncthing-helium/compose.yaml`
- `~/Repositories/compose/ArchiveControl-archive/{compose.yaml,client.toml}`

The qBittorrent API and Syncthing GUI/API bind only to loopback. Syncthing
transport/discovery ports are published normally. qBittorrent data and
Syncthing route folders both live under `/media/Data2`; the Archive Control
container therefore mounts `/media/Data2` once at `/data/storage` so archive
placements can hardlink rather than make a full copy.

`/media/Data2/Downloading` already contains unrelated files. The fresh qB
instance must not import or manage them; only Archive Control-created torrents
are managed.

Before the first client start, run the repository preflight on the target host
(replace container names if that host uses different compose project names):

```sh
python3 scripts/preflight-deployment.py \
  --client-config ~/Repositories/compose/ArchiveControl-archive/client.toml \
  --client-container archive-control-helium-archive-client-1 \
  --syncthing-container helium-syncthing-syncthing-1 \
  --qbittorrent-container helium-qbittorrent-qbittorrent-1
```

It is read-only: it checks the configured API roots resolve to the same host
paths as the client roots, that both data roots share one client bind mount for
hardlinks, secret-file permissions, filesystem capabilities, and the local qB
and Syncthing APIs. It does not send the control token or modify any container.