Expose Lyra NVIDIA metrics to Beszel #191

New issue

Closed

opened 2026-08-24 22:14:25 +01:00 by nimmo · 2 comments

nimmo commented

2026-08-24 22:14:25 +01:00

Owner

Context

Lyra Beszel reports host and container metrics but no RTX 4070 data. The agent startup log says nvidia-smi found no valid GPU data, stopping even though Jellyfin CUDA/NVENC playback is working.

Root cause

The upstream NixOS Beszel unit puts nvidia-smi on PATH but evaluates with PrivateDevices=true, PrivateUsers=true, and no NVIDIA device allow-list. The service cannot access the GPU device nodes.

Acceptance criteria

Scope relaxed device sandboxing to NVIDIA-enabled Beszel hosts only.
Retain a closed device policy and allow only required NVIDIA character devices.
Add video and render supplementary groups without losing Docker monitoring access.
Confirm non-NVIDIA hosts retain upstream hardening.
Pass nix flake check.
After user-run just test, confirm Beszel redetects the RTX 4070 and reports GPU metrics.

## Context Lyra Beszel reports host and container metrics but no RTX 4070 data. The agent startup log says `nvidia-smi found no valid GPU data, stopping` even though Jellyfin CUDA/NVENC playback is working. ## Root cause The upstream NixOS Beszel unit puts `nvidia-smi` on PATH but evaluates with `PrivateDevices=true`, `PrivateUsers=true`, and no NVIDIA device allow-list. The service cannot access the GPU device nodes. ## Acceptance criteria - Scope relaxed device sandboxing to NVIDIA-enabled Beszel hosts only. - Retain a closed device policy and allow only required NVIDIA character devices. - Add video and render supplementary groups without losing Docker monitoring access. - Confirm non-NVIDIA hosts retain upstream hardening. - Pass `nix flake check`. - After user-run `just test`, confirm Beszel redetects the RTX 4070 and reports GPU metrics.

nimmo added this to the Lyra Service Stack NixOS Migration milestone

2026-08-24 22:14:25 +01:00

nimmo added the

host:lyra

phase:validation

project:lyra-service-stack-migration

labels

2026-08-24 22:14:25 +01:00

nimmo commented

2026-08-24 22:17:59 +01:00

Author

Owner

Implemented the configuration fix on fix/issue-191-beszel-nvidia-metrics.

NVIDIA hosts disable the Beszel unit's private device and user namespaces.
DevicePolicy=closed remains in force.
The allow-list is limited to /dev/nvidiactl and /dev/nvidia0, as required by the Beszel nvidia-smi collector.
video and render are appended without losing Lyra's existing docker supplementary group.
Non-NVIDIA hosts retain the upstream PrivateDevices=true and PrivateUsers=true hardening.

Evaluated Lyra policy: closed device policy, the two NVIDIA nodes, and groups docker, video, render. Evaluated Vega policy remains unchanged. Full nix flake check passes.

Remaining canary: user-run just test, followed by confirming the restarted agent no longer logs nvidia-smi found no valid GPU data and that the RTX 4070 appears in Beszel.

Implemented the configuration fix on `fix/issue-191-beszel-nvidia-metrics`. - NVIDIA hosts disable the Beszel unit's private device and user namespaces. - `DevicePolicy=closed` remains in force. - The allow-list is limited to `/dev/nvidiactl` and `/dev/nvidia0`, as required by the Beszel `nvidia-smi` collector. - `video` and `render` are appended without losing Lyra's existing `docker` supplementary group. - Non-NVIDIA hosts retain the upstream `PrivateDevices=true` and `PrivateUsers=true` hardening. Evaluated Lyra policy: closed device policy, the two NVIDIA nodes, and groups `docker`, `video`, `render`. Evaluated Vega policy remains unchanged. Full `nix flake check` passes. Remaining canary: user-run `just test`, followed by confirming the restarted agent no longer logs `nvidia-smi found no valid GPU data` and that the RTX 4070 appears in Beszel.

nimmo commented

2026-08-26 20:58:16 +01:00

Author

Owner

Data is visible, closing.

nimmo closed this issue

2026-08-26 20:58:16 +01:00