A specification for scaling Biohazard's compute, storage and AI workloads past one workstation: an always-on control plane for Antimony and Signet, workstations and render nodes that are allowed to crash, a storage tier that can feed them, and a cost model built from what SXRS actually spent on the farm.
During SXRS the agent, Houdini, Nuke, Blender, ComfyUI and every render shared one Ryzen 9 7900X with 93 GB of RAM and a 24 GB RTX 3090. When a cook filled memory, the kernel's OOM killer took whatever it picked: once another session's Blender render, and in one overloaded hour the agent's own gateway went down. This handbook splits that machine into planes that fail independently. The control plane hosts the agent and its memory and does no DCC work. Execution machines run the DCCs and may crash without stopping anyone else. A storage tier feeds them, and the farm absorbs bursts.
| Phase | Scope | Parts, USD |
|---|---|---|
| 0 | Repair NAS: 3 × 18 TB disks, mirrored boot pair, restore 10 GbE link | 1,807.32 |
| 1 | Control plane (3 × MS-01, Proxmox HA) and redundant 25/100 GbE fabric | 21,196.88 |
| 2 | NVMe render storage tier, 15.36 TB mirrored, 100 GbE | 23,201.02 |
| 3 | Agent workstation, MID tier (TR 9970X, 256 GB, RTX PRO 5000 72 GB) | 26,753.75 |
| 4 | Two GPU render nodes (RTX PRO 5000 72 GB, 4U) | 35,688.42 |
| Starter build, phases 0–4 | 108,647.39 | |
| 5 | After pilot: GPU nodes 3–4; one refurb CPU node (quote: £12,895 + $1,079.96) | 35,688.42 + |
Excluded: tax, shipping, assembly, UPS, electrical work, software, Proxmox subscription. Fabric is counted once (phase 1). Several prices are spot retail during a DDR5 shortage and should be re-quoted (2.3.4).
Data pool DEGRADED: a second 12 TB member is FAULTED with 62 read errors. Boot SSD shows 295 write errors. Replace disks one resilver at a time before adding any load.
The system has four planes joined by one data fabric (figure 2.1-1). The control plane holds the agent gateway, Signet memory and the render manager on three small hosts that fail over between each other. The execution plane holds every machine that runs a DCC. The data plane holds the storage the work is read from and written to. The burst plane is Fox Renderfarm, reached over the internet and released only through a price gate.
A request reaches the agent gateway on CP-1. The agent recalls the shot's rules from Signet, publishes an immutable scene version to the NVMe tier, and submits a job to the render manager, which leases a GPU on a worker. The worker stages the scene to local NVMe, runs the DCC and writes frames back to the tier. When the queue exceeds owned capacity, the agent prices test frames on Fox and asks before releasing the range. If CP-1 dies, its VMs restart on CP-2 from the last one-minute replica, and running frames on the workers carry on.
A DCC process may run on any machine except a control host. A crash takes down at most one worker, and the manager requeues that worker's frames.
| Plane | Holds | On failure |
|---|---|---|
| Control | Agent gateway, Signet, render manager, chat bridges | VM restarts on a peer, 1–3 min |
| Execution | Houdini, Nuke, Blender, ComfyUI, LLM inference | One machine lost, frames requeued |
| Data | Published scenes, caches, renders, archive | Renders pause, last hourly snapshot on NAS |
| Burst | Fox Renderfarm, priced per job | Work stays on owned nodes |
Starter build draw is about 3 kW: two GPU nodes 1.2 kW, workstation 0.95 kW, control 0.24 kW, switches 0.24 kW, storage. All figures are planning estimates, not meter readings.
The control plane is three identical Minisforum MS-01 hosts in a Proxmox VE cluster. Each host stores its VMs on a local ZFS mirror, and each VM is replicated to both peers every minute. If a host fails, Proxmox fences it and restarts its VMs on a survivor. The documented typical failover time is about two minutes. Planned maintenance uses live migration, which moves a running VM with no interruption.
Kubernetes fails over seamlessly when it runs several identical stateless copies of a service. The agent gateway and Signet are not that. Signet writes one SQLite database, which allows a single writer, so only one copy can run. For a single-copy service on a lost node, Kubernetes waits for the node to go NotReady, then waits out the default 300 s eviction toleration, and then may wait up to 6 min to force-detach the volume before the pod can start elsewhere (figure 2.2-1). It also needs the same replicated storage layer Proxmox needs. The result is slower recovery with more to operate.
Kubernetes earns its place later in the execution plane, as a pool of stateless GPU services such as ComfyUI workers or model servers, where many identical copies are the point.
CP-1 runs one 8 vCPU / 16 GiB VM with the agent gateway, the Signet daemon and a CPU embedding worker, plus a 4 GiB VM for the render manager. Signet's SQLite file, WAL and SHM stay together on the VM's own disk. They are never placed on NFS or SMB. Both onboard SFP+ ports run at 10 GbE, one to each data switch. Both 2.5 GbE ports carry corosync, one to each management switch, so a single cable or switch never breaks quorum. Heavy AI inference stays on the GPU fleet. The control hosts carry no GPUs and no passthrough, which keeps live migration possible.
Replication is asynchronous. A crash loses at most the writes since the last successful replica, nominally one minute. Independent SQLite online backups go to the NAS and offsite, because replicas are not backups.
| Item | Qty | USD |
|---|---|---|
| Minisforum MS-01, i9-13900H, 32 GB, 1 TB boot | 3 | 3,885.00 |
| Samsung PM9A3 960 GB M.2 22110, PLP (ZFS mirror) | 6 | 11,633.94 |
| Control plane total | 15,518.94 | |
| Estimated draw | 240 W | |
| Proxmox subscription | not priced |
The PLP drives are 75% of this cost at CDW's $1,938.99 list price. Re-quote them, or use another PLP M.2 22110 model, before ordering.
Never disable fencing to make a failover test pass. Two hosts running the same SQLite writer will corrupt Signet.
A workstation in this system is an execution machine that the agent drives with several DCC sessions open at once, and that an artist can also sit at. Three tiers were priced from live listings on 4 November 2026 (table 2.3-1). The hard requirement comes from SXRS: a city frame needs 28–33 GB, which does not fit a 24 GB 3090 and leaves no margin on a 32 GB RTX 5090. Every tier therefore carries at least 48 GB of VRAM.
| Parameter | Star-killer | Mid | Budget |
|---|---|---|---|
| CPU | TR PRO 9995WX, 96 C | TR 9970X, 32 C | Ryzen 9 5900XT, 16 C |
| Memory | 1 TB DDR5-6400 ECC ($53,382.99) | 256 GB DDR5-5600 ECC ($11,790.99) | 128 GB DDR4-3200 ($916.99) |
| GPU | 3 × RTX PRO 6000 Max-Q 96 GB | RTX PRO 5000 72 GB | RTX A6000 48 GB, refurbished |
| GPU, Blender 5.2.0 OptiX median | 15,505 each | 10,956 | 4,641 |
| CPU, Blender 5.2.0 median | 2,640 | 1,377 | 412 |
| Wall draw, estimated | 1,650–1,850 W, 240 V | 800–950 W | 550–650 W |
| Unlocks | Three isolated 96 GB jobs; full sim, comp and model stack at once | The city scene with room to spare; parallel DCCs | The city scene; little else at the same time |
| Main limit | 96 GB per device, no NVLink pooling | One GPU shared by render and AI | Older CPU, non-ECC, below a 3090 in speed |
| Parts total | $123,859.84 | $26,753.75 | $6,827.84 |
MID is the agent workstation (WS-1). One 72 GB card holds the city scene with margin, 32 cores and 256 GB carry several DCC sessions, and the board keeps a slot and the power supply sized for a second GPU. Reference: the current 3090 scores 5,087 on the same benchmark, so the MID card renders about 2.15 times faster before counting the end of out-of-core spill.
The cheapest fix for the scene-size problem alone is the same $4,799.99 refurbished A6000 installed in the existing 7900X workstation. It renders slightly slower than the 3090 but fits the scene. It does not separate the agent from the work.
DDR5 is in shortage. Memory is 43% of the star-killer and 44% of MID. Exxact configured a comparable star-killer (9995WX, 1 TB, 3 × PRO 6000 Max-Q, rack chassis, three-year support) at $101,068, which is less than the retail parts. Get integrator quotes (Exxact, Puget, BOXX) before buying above the MID tier.
A render node is a 4U rack server with one RTX PRO 5000 Blackwell 72 GB, a Ryzen 9 9950X on a Supermicro server board with ECC, 128 GB of RAM, two mirrored NVMe drives for the scene cache and a dual 25 GbE NIC (figure 2.4-1). One GPU per node keeps a failure to one card's worth of work and fits a single 1000 W supply. Buy two, pilot them on the heaviest real frame, then add two more.
The manager hands the node a chunk of frames. The node copies the published scene to its local NVMe mirror, keeps it resident across the chunk, renders, and writes frames back over 25 GbE. Loading the scene once per chunk instead of once per frame is the largest throughput lever (table 2.4-1). A node runs one GPU job at a time. ComfyUI and model jobs take the whole card through the same lease, never alongside a render.
| Dispatch | 1 node | 2 nodes | 4 nodes |
|---|---|---|---|
| Scene resident, render only | 155 | 310 | 620 |
| 10-frame chunks, one 60 s load each | 123 | 246 | 493 |
| Reload every frame | 43 | 87 | 173 |
Basis: 50 s/frame + 60 s load on a 3090, scaled by the Open Data ratio 10,956 / 5,087 = 2.15. Unverified until the pilot renders a real city frame.
| RTX PRO 5000 Blackwell 72 GB | 8,999.99 |
| 4 × 32 GB DDR5 ECC UDIMM | 5,847.96 |
| 9950X, H13SAE-MF, cooler | 1,303.31 |
| 2 × 990 PRO 2 TB, CX-4 Lx, RM1000x | 1,289.95 |
| Sliger CX4170a 4U, fans, rails | 403.00 |
| Per node / two / four | 17,844.21 / 35,688.42 / 71,376.84 |
Two 32 GB cards are not a 64 GB pool. Each device must hold the whole scene. Blender can spill to host RAM, at a large speed cost.
Rejected: RTX 5090 (32 GB, no margin) and PRO 5500 84 GB (no firm price or lead time yet). Alternative if a job needs more than 72 GB: PRO 6000 96 GB, $16,513.99, 600 W.
CPU nodes are for work GPUs do not do well: Houdini sims, Mantra and Karma CPU, Nuke renders, and scenes larger than any card. They are a poor way to buy Cycles throughput. On Blender 5.2.0 medians, matching one RTX PRO 5000 takes about ten new single-socket EPYC 9355P nodes, six dual EPYC 7713 or three dual EPYC 9555 (figure 2.5-1). A 16- or 64-node CPU render array is therefore the wrong first purchase.
Size owned compute to daily iteration and the farm to the deadline peak. SXRS's peak CPU day (20 Oct) was 504 node-hours on Fox's 48-thread nodes. Finishing that in 24 hours takes about 21 such nodes. The whole project's CPU work, 714 node-hours, billed $516.25. At $0.72 per node-hour on Fox against about $0.11 per hour in electricity alone for an 850 W refurb node, an owned CPU farm cannot pay for itself at this volume. Sixteen refurb nodes also need a 57 A feed and dedicated cooling, and sixty-four exceed the 50 kW site limit of Xcel's Schedule C.
Buy one CPU node, after the GPU pilot, for sims and Nuke that are slow to farm out. The quote target is CTO Servers' 1U dual EPYC 7763 with 512 GB DDR4, listed at £12,895. That price is advisory, not a confirmed quote: the seller is in the UK and requires a quotation. Add two NVMe drives and a 25 GbE NIC for $1,079.96. The alternative is a new single EPYC 9355P with 512 GB DDR5, $39,664.39 in parts, of which $31,392 is RAM at spot retail.
| Fleet | kW | Rate C, winter energy | Rate SG, all-in |
|---|---|---|---|
| 1 refurb CPU node | 0.85 | $77.80 | $154.35 |
| 16 refurb CPU nodes | 13.6 | $1,244.86 | $883.15 |
| 64 refurb CPU nodes | 54.4 | not eligible | $3,215.31 |
| 64 new 9355P nodes | 35.2 | $3,221.98 | $2,117.82 |
Rate C winter $0.12713/kWh, summer $0.16878. Cooling excluded; at PUE 1.4, 64 refurb nodes reach about $4,459/month on SG.
Cycles scores do not predict Houdini sims, Mantra or Nuke. Benchmark the studio's own sim and comp script on the pilot node before buying a second.
The current TrueNAS server was inspected read-only on 4 November 2026. It is a Ryzen 5 3600 with 64 GB of non-ECC RAM, one 10-wide RAIDZ2 vdev of 12 TB disks, TrueNAS SCALE 24.04.0, and SMB only. Its ARC hit rate is 99.76%, mostly metadata. It cannot feed render nodes: the active port on its 10GBASE-T card negotiates 1 GbE, and the card sits in a PCIe 2.0 x4 slot. At 1 GbE, one node needs four minutes to pull a 30 GB scene, and eight nodes need 32 minutes.
A separate NVMe server becomes the render tier. It holds active projects only, at most about 12.3 TB of live data and snapshots. Linux nodes mount it read-only over NFSv4.1, artists use SMB3, and render outputs land in separate datasets. The repaired HDD NAS becomes the archive and the hourly snapshot target. Nextcloud stays the sync and client-delivery layer and is never mounted as render storage. Option 1, upgrading the existing box to the same platform, costs $28,276.60 in total but keeps Nextcloud, apps and render serving in one failure domain.
A special vdev or L2ARC on the HDD pool does not speed up the first read of a freshly published scene, and losing a special vdev can lose the pool. Hot data goes on its own mirrored flash pool.
| Nodes loading together | Today, 1 GbE | Option 1 | Option 2 |
|---|---|---|---|
| 1 | 4 min | 12 s | 12 s |
| 2 | 8 min | 20 s | 12 s |
| 4 | 16 min | 40 s | 24 s |
| 8 | 32 min | 80 s | 48 s |
Planning arithmetic at 2.5 GB/s per client; today's column assumes the whole 0.125 GB/s link and no artists. Not measured.
| 4 × Solidigm D7-P5520 7.68 TB U.2 | 15,800.00 |
| EPYC 7302P, H12SSL-i, 256 GB DDR4 ECC | 5,089.48 |
| ConnectX-5 100 GbE, U.2 carriers, cooling | 1,045.80 |
| Define 7 XL, RM850e, boot pair, 25G NIC for NAS, DACs | 1,265.74 |
| Render tier, fabric excluded | 23,201.02 |
| NAS repair: 3 × IronWolf Pro 18 TB, 2 × boot SSD | 1,807.32 |
Replace one disk at a time and let each resilver finish. A second failure during resilver on this pool leaves no parity margin.
Two MikroTik CRS518-16XS-2XQ switches carry data. Each has 16 SFP28 ports at 25 GbE and two QSFP28 ports at 100 GbE. The 100 GbE pair joins A to B. Two CRS326 switches carry management and corosync. Every node has two links, one to each switch, bonded active-backup, so either switch can be powered off without stopping work. The SFP28 cages accept 10 GbE with the same DACs, so no second 10 GbE switch is needed.
| Item | Qty | USD |
|---|---|---|
| MikroTik CRS518-16XS-2XQ-RM | 2 | 3,190.00 |
| MikroTik CRS326-24G-2S+RM | 2 | 418.00 |
| XQ+DA0001 100G DAC, 1 m | 2 | 78.00 |
| XS+DA0003 25G DAC, 3 m | 28 | 1,092.00 |
| ConnectX-4 Lx 2 × 25G (workstation, storage) | 3 | 899.94 |
| Fabric total | 5,677.94 |
| GPU nodes, 25G | 4 |
| CPU nodes, 25G | 2 |
| Workstation, 25G | 1 |
| Storage, 25G | 2 |
| Control hosts, 10G | 3 |
| Mgmt uplinks, 10G | 2 |
| Used / spare | 14 / 2 |
3 m DACs reach only within the rack. Workstations in another room need optics and fibre, not priced.
Every SXRS task on the Fox account was read through the free API: 99 billable layers under 73 root jobs, including eight jobs in the recycle bin that ordinary listings omit. SXRS billed $1,234.69 for 14,687 completed frame records and 1,098.37 observed node-hours. Nearly all of it (99.98%) fell between 17 and 23 October (figure 2.8-1).
A Fox GPU node-hour cost $1.87. Fox's GPU nodes are mostly RTX 5090 class (Open Data 16,072), so one hour of an owned RTX PRO 5000 (10,956) replaces 0.68 Fox hours, worth $1.27. Electricity for a 600 W node at Rate C winter is $0.08 per hour, leaving $1.20 per busy hour. A $17,844.21 node breaks even after about 14,900 busy hours: 1.7 years at 24/7, 3.4 years at half utilisation, 6.8 years at a quarter (figure 2.8-2). SXRS's GPU work would have kept four owned nodes busy for 141 hours each.
| Measure | GPU (75) | CPU (64) |
|---|---|---|
| Billed | $718.44 | $516.25 |
| Observed node-hours | 384.3 | 714.1 |
| Effective $/node-hour | 1.87 | 0.72 |
| Completed frames | 4,173 | 10,514 |
| Peak day, node-hours | 326 (18 Oct) | 504 (20 Oct) |
| Stopped for low balance | 5 layers, $199.49 | |
| Hosted AI generation (fal) | $1,045.53 | |
Four GPU jobs ran on 2-GPU nodes and most report no model, so the 5090 equivalence is an assumption. The fal figure is usage from the 23 Oct advance reconciliation.
On render cost alone, four owned nodes ($71,377) equal about 99 SXRS-sized GPU farm bills. The case for owning rests on 2.8.3.
Five SXRS layers stopped mid-range when the Fox balance went negative. Keep the balance above the projection plus 30% before any release.
Hardware scales freely, and licences do not. Blender has no per-node cost. Houdini Indie allows three Indie seats and three free Engine Indie machines per entity, and only for entities under $100K in revenue. A four-node Indie farm already exceeds that. Nuke charges per render worker. The render manager starts as Flamenco, which is free, because Deadline 10 has been in maintenance mode since 7 November 2025.
| Software | Terms | Effect at 4 GPU + 2 CPU workers |
|---|---|---|
| Blender / Cycles | GPL, no per-node fee | $0 |
| Houdini Indie | $299/yr; entity revenue ≤ $100K; 3 Indie + 3 Engine Indie | Exceeds 3 farm machines |
| Houdini FX (commercial) | $3,505/yr rental or $4,495 + $2,740/yr AUP; bundles 5 Karma | Artist seats only |
| Houdini Engine (commercial) | $525/yr workstation; floating $795/yr, 25-pack $16,500/yr | Needed to cook .hip on workers |
| Karma (husk on exported USD) | 5 bundled with FX; extra $195/yr each | 6 workers: 1 extra, $195/yr |
| Nuke render (nuke_r) | $462/yr per render worker | 2 CPU workers: $924/yr |
| Flamenco | GPL, free; Blender native, custom job types for others | $0, integration work |
| OpenCue | Apache-2.0, free | Later, at larger scale |
| Deadline 10 | Free, maintenance mode since Nov 2025 | Not selected |
Husk jobs with Python callbacks that load Houdini libraries can check out Engine or FX licences even from plain USD. Qualify each job type before budgeting it as Karma-only.
Antimony becomes the studio's operating layer. Antimony is the agent, Signet is its memory, and the render manager is its hands on the farm. Artists and producers ask in chat. The agent turns each request into versioned scenes, leased GPU time, farm jobs with price gates, and delivered files. On SXRS the agent did this from inside the same machine it was loading. Here, every step crosses a network boundary on purpose (figure 2.10-1).
Each worker runs a small agent-facing service that opens DCC sessions (Houdini, Nuke, Blender, ComfyUI), runs scripts in them and reports back. The agent reaches workers only through the manager's lease, so two sessions never land on the same GPU. GPU, RAM and disk are booked through the lease system. On SXRS that booking was done with ad-hoc claims and memory caps, and the caps still lost jobs to the OOM killer. The agent keeps its existing farm discipline: price every pass from test frames, keep a cost guard running, never overwrite a pass someone is comping, and never let a full-range render run on an artist's machine.
Any number of agent sessions can run on the control plane at once. They share Signet, coordinate through leases, and survive a worker crash because none of them lives on a worker.
| Event | Effect |
|---|---|
| Houdini takes down WS-1 | WS-1 reboots; agent and other workers unaffected |
| GPU node dies mid-chunk | Manager requeues the chunk on another node |
| CP-1 power loss | Agent back on CP-2 in 1–3 min; renders continue |
| Data switch A fails | Bonds fail over to B; no interruption |
| NVMe tier offline | New chunks wait; staged chunks finish; archive intact |
| Fox balance low | Agent asks for a top-up before release |
| Through phase | Cumulative USD |
|---|---|
| 0 · NAS repair | 1,807.32 |
| 1 · control + fabric | 23,004.20 |
| 2 · NVMe tier | 46,205.22 |
| 3 · MID workstation | 72,958.97 |
| 4 · two GPU nodes | 108,647.39 |
| 5 · GPU nodes 3–4 | 144,335.81 |
Every throughput, wattage and fit statement here is a planning estimate until the acceptance checklists in 2.2, 2.4 and 2.6 have run on delivered hardware.
Full bills of materials, with every row's retailer, availability and observation date, are in the research files. Each file lists its own numbered sources.