Isolated sovereign compute
A physically separate enclave with a hardware one-way data diode. Multi-tenant hosting on Proxmox SDN gives each tenant its own VNet. Zero-trust management behind FIDO2 keys.
Integrated blueprint · revision 2
Compute that balances the grid
and heats the greenhouse.
This blueprint combines sovereign multi-tenant compute, curtailable hydro-cooled mining that soaks up surplus solar, and hydronic heat recovery. It has been re-engineered after a 30-item design review. All three build phases have a test-gated playbook.
0kW peak facility
0load sheddable in <50 ms
0BTU/h recovered (hydro)
0gaps found & fixed
01 Architecture at a glance
Three electrical tiers feed two heat paths. Only T1 is protected by the UPS units. T2 and T3 are the levers the EMS can pull.
Microgrid balancing
Mining is an "economic battery". It absorbs PV the battery can't take, ramps down in proportion to SOC, and trips through a hardwired chain with no software in the path.
Thermal cogeneration
A 135 °F glycol primary loop and titanium plate HX deliver 125 °F to greenhouses, district loops or double-wall DHW preheat. Results are reported as metered ERF.
02 Gap audit: what v1 got wrong and how v2 fixes it
Each finding shows the original claim, why it fails, and the change made. These are design-review findings, not stamped engineering. A licensed PE must sign off before construction.
03 Compute & network segmentation
Live policy simulation. Each packet is checked against the default-deny rule set. Red bursts are denied lateral moves.
Cluster topology
- Proxmox node A: R750, multi-tenant (always on, T1)
- Proxmox node B: GPU server, deferrable (T2, parks below 50% SOC)
- QDevice: third quorum vote, so the cluster survives node B parking
- Sovereign enclave: R650, not clustered, own switch, data-diode export only
Storage (OpenZFS)
- Fast tier: NVMe mirrored vdevs on HBA, for VM disks and databases
- Bulk tier: 12× 18 TB as 2× 6-wide RAID-Z2, for telemetry, backups and snapshots
- Enclave ledger: local ZFS mirror on the R650, never on shared storage
- 3-2-1: immutable snapshots plus encrypted offsite
zfs send
Election-related scope
The enclave supports audit evidence only: hash verification of published artifacts and support for risk-limiting-audit math. It never tabulates. Certified voting systems remain the official record under EAC VVSG and state law. Voter identity, biometric data and ballot selections are refused. A named human approves every workload placement, never an automated approver.
04 Hardware bill of materials & rack elevation
| Device | Role | Configuration | Form | Power | Tier |
|---|
05 Power: tiered buses & fail-safe load shedding
Click a scenario. The contactor is energize-to-run: if any link in the coil chain opens, the mining bus drops, whether or not software is running.
Pick a scenario to see the trip sequence.
Circuit schedule (208Y/120 V 3φ service)
| Circuit | Breaker | Continuous (80%) | Load |
|---|---|---|---|
| T1 Feed A → UPS A | 208 V 20 A 2P | 16 A · 3.3 kW | 1.88 kW |
| T1 Feed B → UPS B | 208 V 20 A 2P | 16 A · 3.3 kW | 1.88 kW (redundant) |
| T2 GPU | 208 V 20 A 2P | 16 A · 3.3 kW | 3.0 kW |
| T3 Mining sub-panel | 208 V 60 A 3P | 48 A · √3×208×48 ≈ 17.3 kW | 11.0 kW |
Code & standards checklist
- NEC 645 (IT rooms, EPO), 690 (PV), 705 (interconnection), 706 (ESS), 710 (stand-alone)
- NFPA 855 + UL 9540/9540A for the BESS
- IEEE 1547 / UL 1741 inverters and a utility interconnection agreement
- Licensed PE stamp, AHJ permit and inspection before energizing
24-hour dispatch simulator
PVT1+T2 baseminingBESS SOC80 / 65 / 40 % thresholds
06 Hydronic heat recovery
Q [BTU/h] = P [W] × 3.412 · GPM = Q ÷ (k × ΔT °F), with k ≈ 500 for water and ≈ 480 for 30% propylene glycol.
| Tier | Liquid-cooled power | Heat | Flow @ ΔT 20 °F (30% PG) | Plate HX |
|---|---|---|---|---|
| Edge node | 6.8 kW | 23,203 BTU/h | 2.42 GPM | 10 kW single-pass |
| This facility (hydro fleet) | 11.0 kW × 95% | 35,656 BTU/h | 3.71 GPM | 15 kW |
| Mid-scale | 16.2 kW | 55,277 BTU/h | 5.76 GPM | 25 kW dual-pass |
| Commercial module | 55.0 kW | 187,668 BTU/h | 19.55 GPM | 75 kW plate-and-frame |
Northern climates
Radiant floors, greenhouse soil beds and district loops. Use 35% PG (≈0 °F) and check concentration with a refractometer every year.
Florida & Caribbean
DHW preheat from 65 °F to 120 °F through a double-wall vented HX. Downstream storage at ≥140 °F for Legionella control. Pools and aquaculture loops also work.
Heat rejection
The Belimo 3-way valve fails toward the dry cooler. Any loss of heat demand sends heat outdoors, never back to the chips.
07 Automation: three layers of protection
- Hardwired: BESS SOC contact, thermal switch and EMS permissive in series with the contactor coil. Acts in under 50 ms.
- On-device (ESPHome): over-temperature, low-flow and sensor-fault interlocks. Works with HA or MQTT offline.
- Supervisory (Home Assistant): proportional curtailment, GPU parking, heat routing and alerts.
Loading…08 Community, governance & risk
Public compute
Spare capacity on the multi-tenant cluster is offered free to schools, emergency services and registered non-profits. Each gets its own SDN VNet and quota.
Utility offset
Metered heat replaces fossil heating in public buildings and municipal greenhouses. Savings are published as ERF and therms displaced.
3-of-5 multisig treasury
Native Bitcoin P2WSH/Taproot multisig on hardware signers in different locations, with a time-locked recovery path. Keyholders: Municipal Infrastructure Director, Lead System Architect, Co-op Board Member, Independent Auditor and Microgrid Engineering Lead.
| Risk | Severity | Impact | Mitigation |
|---|
Roadmap
Status comes from the evidence tracker below. A phase shows complete only when every acceptance test and gate sign-off has been recorded.
09 Execution playbook: all phases
The 52-week program covers 12 work packages, 20 acceptance tests and 3 sign-off gates, plus the files each phase needs. Tick tests as you complete them and add the evidence link. Progress is saved in this browser only. Use Export to share it or archive it with the commissioning file.