Description
## Overview
Migrate the Hydra and NimsForest management stacks from Hetzner Cloud to a self-hosted Raspberry Pi 5 fleet running Incus/LXC containers.
## Current Hetzner Infrastructure
### Hydra stack (19 servers, mostly CX23 2c/4GB)
hydracluster, hydrarelease, hydraguard, hydraexperiencelibrary, hydratransfer, hydrapipeline, hydraorganization, hydravenues, hydradistrict, hydraneck (4c/8GB), hydrahead, hydranps (ARM), hydrastreamingmonitor, hydraneckwebrtc, hydraheadwebstream (ARM), hydraapplepipeline, hydraunrealengine-server, mirror-a, hydraperforce
### NimsForest stack (10 servers, mostly CX23 2c/4GB)
land-nimsforest-one, docker-registry, neoremote (4c/8GB), land-shared-one, land-executxr-one, land-experiencenet-one, land-xrvalley-one, land-thenaturalbeautyclub-one, land-riseof-one, land-callyouragentai-one
## Target Pi Fleet
| Node | RAM | NVMe | Location |
|------|-----|------|----------|
| pi-node-001 | 8GB | 1x 256GB | Primary / entry point |
| pi-node-002 | 4GB | 2x 256GB | Redundant worker, location A |
| pi-node-003 | 4GB | 2x 256GB | Redundant worker, location B |
| Total | 16GB | ~1TB | Geo-distributed |
## Required Work Before Migration
1. ARM64 builds - Both repos only build linux/amd64. Add GOARCH=arm64 to Makefiles and CI.
2. Auto-updater arch awareness - hydrarelease must publish and download correct arch.
3. IPv6 in LXC - NimsForest requires IPv6 (fatals without it). Configure on Incus bridge.
4. TLS strategy - Run services behind host reverse proxy or use privileged containers.
## Services to Keep on Hetzner
- hydraneckwebrtc, hydraheadwebstream (WebRTC latency)
- hydraperforce (storage)
- neoremote (dev box)
- hydraunrealengine-server (GPU)
## Migration Order
1. hydracluster, hydrarelease, hydraorganization, hydravenues, hydradistrict
2. land-nimsforest-one, land-shared-one
3. Remaining hydra services
4. Per-tenant lands