AIT Brainlab Base (brainlab-base)

The central knowledge base, equipment inventory, service documentation, and infrastructure repository for AIT Brainlab (Asian Institute of Technology).

---

📌 Repository Organization

┌─────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│                                       AIT BRAINLAB ARCHITECTURE                                         │
└─────────────────────────────────────────────────────────────────────────────────────────────────────────┘
                                                     │
         ┌───────────────────────────┬───────────────┴───────────────┬───────────────────────────┐
         ▼                           ▼                               ▼                           ▼
┌─────────────────┐         ┌─────────────────┐             ┌─────────────────┐         ┌─────────────────┐
│  CORE MGMT      │         │ INFRASTRUCTURE  │             │    SERVICES     │         │ RUNBOOKS & DOCS │
│ [`mgmt/`](mgmt/)│         │ [`infra/`](infra)│             │[`services/`](...)│       │ [`docs/`](docs/)│
├─────────────────┤         ├─────────────────┤             ├─────────────────┤         ├─────────────────┤
│ • ait-brainlab- │         │ • On-Prem Server│             │ • JupyterHub    │         │ • Onboarding    │
│   mgmt ($5/mo)  │         │ • NVIDIA GPUs   │             │ • MLflow Server │         │ • Offboarding   │
│ • Cloud DNS     │         │ • TrueNAS NFS   │             │ • Traefik Proxy │         │ • Debugging     │
│ • NetBird Mesh  │         │ • Research GPUs │             │ • Web Demo APIs │         │ • Admin Roles   │
│ • lldap Directory│        │ • Proxy Routing │             │ • User Images   │         │                 │
└─────────────────┘         └─────────────────┘             └─────────────────┘         └─────────────────┘

---

📚 Core Navigation

1. 🛡️ Core Management Plane (mgmt/)

The decoupled, permanent control plane running under GCP project ait-brainlab-mgmt (~$0.45 to $7.45/month):

• Master Task Checklist: 8-phase roadmap (Phases 1–6 Verified: IAM, DNS, Secrets, VM Engine, Identity, NetBird VPN).
• Migration Plan: Step-by-step zero-downtime transition SOP.
• Modular Terraform IaC: 6 independent modules (iam/, dns/, secrets/, vm/, identity/, vpn/) backed by GCS remote state (gs://ait-brainlab-mgmt-tfstate).

2. 🛠️ Infrastructure Domain (infra/)

• infra/onprem/: Ubuntu 22.04 installation, NVIDIA GPU drivers, TrueNAS NFS mounting (/mnt/HDD/home), and Docker engine.
• infra/cloud/: Research compute templates (Spot GPU VMs, GCS buckets) and Google Cloud research credit guides ($5k Faculty / $1k PhD).
• infra/network/: NetBird mesh VPN setup, CSIM proxy configuration (192.41.170.23:3128), and DNS topology.

3. 🚀 Services Domain (services/)

• services/jupyterhub/: Multi-user GPU JupyterLab container environment (nlp, cv, default Dockerfiles) and systemd configuration.
• services/identity/: Lightweight LDAP (lldap) directory, Google OAuth2 Single Sign-On, and Linux SSSD mapping.
• services/mlflow/: MLflow tracking server setup on tokyo.cs.ait.ac.th:5000 with TrueNAS artifact storage.
• services/api/: Traefik edge reverse proxy routing and deployed FastAPI & AI demonstration applications.

4. 📋 Operational Runbooks (docs/)

• User Onboarding: Step-by-step SOP for new researchers and students.
• Member Offboarding: Data archiving and access revocation SOP.
• SysAdmin Troubleshooting: Incident runbook for CUDA, NFS, Proxy, and container failures.
• Roles & Handover: Matrix of responsibilities for Infrastructure Admins and Service Admins.

5. 📦 Archived Assets (archive/)

Historical configurations, legacy Docker images, screenshots, and older notebooks preserved for reference.

---

🔒 Security & Safe Operating Protocols

• No Hardcoded Secrets: Never commit passwords, private keys, or API tokens to version control.
• Proxy Aware: Outbound traffic on CSIM network requires http://192.41.170.23:3128.
• Persistent User Data: Always stored on TrueNAS at /mnt/HDD/home/{username}/work.