fixed ttypos

Master.conf

@@ -161,6 +161,59 @@ DAILY_SYNC_SHARES=(
     /mnt/user/Tv_Shows
 )
 
+# ━━━ Personal Encrypted Shares ━━━
+# Personal shares synced to the remote server for offsite backup.
+# These are independent of the failover container stack — data backup only.
+# Each user syncs their own personal share to the other server.
+#
+# ── ZFS ENCRYPTION SETUP (unRAID 7) ─────────────────────────────────────────────────────────
+# Encrypting your personal share means the remote admin can see the share exists
+# and its file sizes but cannot read any content without your passphrase or keyfile.
+# ZFS encrypts at the dataset level — rsync copies encrypted blocks as-is.
+# The remote server never needs your key.
+#
+# Setup steps on HOST1:
+#   1. In unRAID UI → go to your ZFS pool (Main tab → pool name)
+#   2. Click the pool to expand it
+#   3. Click "+ Dataset" to create a new dataset
+#   4. Name it: e.g. Gmer4Lfe-Personal
+#   5. Enable Encryption → set your passphrase (or keyfile path)
+#      ⚠️  Write your passphrase down — if lost, data is unrecoverable
+#   6. Go to Settings → Shares → Add Share
+#   7. Set the share path to your new encrypted dataset
+#   8. Set Use cache: Only (keeps data on ZFS pool, not array)
+#
+# Auto-unlock on boot (optional — keyfile approach):
+#   1. Create a keyfile: dd if=/dev/urandom bs=32 count=1 | base64 > /root/.zfs-keys/personal.key
+#   2. Store keyfile on HOST1 only — never sync it to HOST2
+#   3. Set the dataset to use keyfile instead of passphrase
+#   4. Add to /etc/rc.local or a startup script:
+#      zfs load-key -L file:///root/.zfs-keys/personal.key poolname/Gmer4Lfe-Personal
+#      zfs mount poolname/Gmer4Lfe-Personal
+#   Manual unlock alternative (most secure):
+#      zfs load-key poolname/Gmer4Lfe-Personal   (prompts for passphrase)
+#      zfs mount poolname/Gmer4Lfe-Personal
+#
+# Verify encryption is active before syncing:
+#   zfs get encryption poolname/Gmer4Lfe-Personal
+#   Should show: encryption  aes-256-gcm  (or similar)
+#
+# Once set up — add the share to PERSONAL_SYNC_SHARES below.
+# rsync copies encrypted blocks to remote — remote admin cannot decrypt without your key.
+# ─────────────────────────────────────────────────────────────────────────────────────────────
+
+# HOST1 personal shares synced to HOST2 for offsite backup
+# These sync via daily_sync.sh or on their own schedule
+# Encrypted datasets sync as encrypted — remote cannot read content
+HOST1_PERSONAL_SHARES=(
+    # /mnt/user/Gmer4Lfe-Personal     # uncomment after creating encrypted dataset
+)
+
+# HOST2 personal shares synced to HOST1 for offsite backup
+HOST2_PERSONAL_SHARES=(
+    # /mnt/user/Jayred365-Personal    # uncomment after creating encrypted dataset
+)
+
 # ━━━ Rsync Profile System ━━━
 # Profiles allow per-share rsync behaviour without touching script logic.
 # The profile key is matched automatically by the basename of the directory
@@ -822,19 +875,31 @@ MEDIA_MAINTENANCE_JOBS=(
 # ==============================================================================================
 # ── TRANSCODES ────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
-# ⚠️ One mount only in Emby container: /mnt/ram-transcode → /ext-ram-transcode
-#    Do NOT add a static SSD path — Emby will use it independently of the symlink.
-#    The symlink IS your emergency lever — flip it manually if needed:
-#    ln -sfn /mnt/cache/Temp_Storage/Emby/Transcodes /mnt/ram-transcode
+# Session-based storage allocator using filesystem symlink indirection.
+# ffmpeg resolves the symlink ONCE at session start — existing sessions are never affected.
+# Only new sessions care about where the symlink currently points.
+#
+# How it works:
+#   ramdisk_setup.sh      — run once at array start, creates tmpfs and sets symlink
+#   transcode_management.sh — every 3 min, runs cleanup then manager in correct order
+#   transcode_cleanup.sh  — called by transcode_management.sh — removes old inactive files
+#   transcode_manager.sh  — called by transcode_management.sh — manages symlink direction
+#
+# ⚠️ Docker mount warning:
+#   Mount must use shared propagation so symlink flips are visible inside the container.
+#   In unRAID Extra Parameters — do NOT use standard path mapping for this mount:
+#     --mount type=bind,source=/mnt/ram-transcode,target=/ext-ram-transcode,bind-propagation=shared
+#   Standard bind mounts use rprivate — Docker locks the inode on first symlink flip
+#   and new sessions land on SSD permanently for that container run.
 
     RAMDISK_PATH="/mnt/ramdisk_transcodes"  # tmpfs mount point created at array start
-    RAMDISK_SIZE="8G"                        # ceiling — tmpfs only uses RAM actually needed
+    RAMDISK_SIZE="10G"                       # ceiling — tmpfs only uses RAM actually needed
     TRANSCODE_LINK="/mnt/ram-transcode"      # symlink Emby points at — location never changes
     TRANSCODE_SSD="/mnt/cache/Temp_Storage/Emby/Transcodes/" # SSD fallback location
 
 # Usage thresholds in GB — hysteresis gap between WARN and LOW prevents flip-flop
-    RAMDISK_WARN_GB=6.8     # flip symlink to SSD at or above this usage
-    RAMDISK_LOW_GB=5.5      # flip symlink back to ramdisk when usage drops here
+    RAMDISK_WARN_GB=8.8     # flip symlink to SSD at or above this usage
+    RAMDISK_LOW_GB=6.5      # flip symlink back to ramdisk when usage drops here
     RAMDISK_SSD_MIN_GB=20   # minimum free GB on SSD required before allowing flip to SSD
 
 # Cleanup age thresholds — files must be older than these AND not open by any process
@@ -863,6 +928,12 @@ MEDIA_MAINTENANCE_JOBS=(
     TRANSCODE_CHECK_EMBY=true
     TRANSCODE_EMBY_CONTAINER="Emby"  # exact Docker container name — case sensitive
 
+# Daily transcode statistics log — read by weekly_health_digest.sh
+# Tracks peak usage, flip count, session ratio, files cleaned per day
+# Bounded to TRANSCODE_LOG_RETENTION days — auto-purges old entries
+    TRANSCODE_DAILY_LOG="/boot/config/transcode_daily.db"
+    TRANSCODE_LOG_RETENTION=90
+
 # ==============================================================================================
 # ── MONITORS ──────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================