a13labs.infra/ansible/host_vars/gpu-01.lab.alexpires.me.yml

hostname: gpu-01.lab.alexpires.me
ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}"

network_interface: enp7s0

# Users
login_users:
  - username: "{{ ansible_user }}"
    comment: "Managed by Ansible"
    sudoer: true
    sudoer_root_only: true
    sudoer_no_password: true
    pubkey: "{{ lookup('file', 'keys/ansible_user.pub') }}"
    password_disabled: true
  - username: operator
    comment: "Managed by Ansible"
    sudoer: true
    pubkey: "{{ lookup('file', 'keys/operator.pub') }}"
    password_expiration: false

# SSH Connection and security
sshd_port: 22
ssh_allowed_networks:
  - "10.5.5.5/32" # Wireguard VPN (Laptop)
  - "10.19.4.0/24" # local network
sshd_admin_net: "10.19.4.0/24" # local network
sshd_allow_groups: "{{ ansible_user }} users"
sshd_permit_root_login: "no"
sshd_password_authentication: "no"
sshd_allow_tcp_forwarding: "yes"

# Due to an issue increase the number of max auth tries
sshd_max_auth_tries: 10

packages_blocklist: []

# Firewall ports
ufw_enable: true
fw_allowed_ports:
  - { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop)
  - { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network
  - { rule: "allow", port: "11434", proto: "tcp", from: "10.19.4.0/24" } # Ollama (local network)
  - { rule: "allow", port: "11434", proto: "tcp", from: "10.5.5.5/32" } # Ollama (Laptop)
  - { rule: "allow", port: "8880", proto: "tcp", from: "10.19.4.0/24" } # Kokoro-FastAPI (local network)
  - { rule: "allow", port: "8880", proto: "tcp", from: "10.5.5.5/32" } # Kokoro-FastAPI (Laptop)
  - { rule: "allow", port: "8188", proto: "tcp", from: "10.19.4.0/24" } # ComfyUI (local network)
  - { rule: "allow", port: "8999", proto: "tcp", from: "10.19.4.0/24" } # ComfyUI - SimpleHttpServer (local network)
  - { rule: "allow", port: "8012", proto: "tcp", from: "10.19.4.0/24" } # Qwen2 (local network)
  - { rule: "allow", port: "8012", proto: "tcp", from: "10.5.5.5/32" } # Qwen2 (Laptop)
  - { rule: "allow", port: "9091", proto: "tcp", from: "10.19.4.0/24" } # Prometheus (local network)
  - { rule: "allow", port: "9091", proto: "tcp", from: "10.5.5.5/32" } # Prometheus (Laptop)
ufw_outgoing_traffic:
  - 22 # SSH
  - 53 # DNS
  - 80 # HTTP
  - 123 # NTP
  - 443 # HTTPS
  - 853 # DNS over TLS
  - 139 # Samba
  - 445 # Samba

ufw_default_forward_policy: "ACCEPT"
fw_loopback_traffic_deny: false

ipv4_sysctl_settings:
  net.ipv4.ip_forward: 1

disable_ipv6: true

# geoip will override hosts_allow and hosts_deny (so it's disabled - CIS hardening)
custom_hosts_acls: true

# This fixes polkit issues with sudoers file (CIS hardening)
hide_pid: 0

# CIS by default changes compilers permissions, Nvidia KMod needs to be build
compilers:

# aide
install_aide: false

# Unattended upgrades
unattended_reboot: true
unattended_reboot_time: "04:30"

# Duo Security
duo_users: ["*", "!provision", "!comfyui", "!kokoro", "!ollama"]
duo_api_hostname: api-7cda1654.duosecurity.com

# podman services settings
ollama_home: "/mnt/data/ollama"
llama_home: "/mnt/data/llamacpp"
podman_user_pubkey: "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAHHOPBR9p9kq5Cqzpe4cr3jHnweaYrHPXv5sXNzt+sCXP54uc5rWUBhxW2OQVvQzJ47dEVhEKi4WSC7LcuKS2G5AQDzWXNiasHvYIYQU3F/EknVCZnsiXYqXphYkJA6rJCNRnISZCIC1mocq6PB7J08ONdRFCvjfUBuVRT8BNGXNmQ/zQ=="

# ComfyUI settings
comfyui_home: "/mnt/data/comfyui"
comfyui_user_pubkey: "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAHHOPBR9p9kq5Cqzpe4cr3jHnweaYrHPXv5sXNzt+sCXP54uc5rWUBhxW2OQVvQzJ47dEVhEKi4WSC7LcuKS2G5AQDzWXNiasHvYIYQU3F/EknVCZnsiXYqXphYkJA6rJCNRnISZCIC1mocq6PB7J08ONdRFCvjfUBuVRT8BNGXNmQ/zQ=="

# Kokoro FastAPI settings (we don't set home because it is not expected to use a lot a disk space)
kokoro_user_pubkey: "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAHHOPBR9p9kq5Cqzpe4cr3jHnweaYrHPXv5sXNzt+sCXP54uc5rWUBhxW2OQVvQzJ47dEVhEKi4WSC7LcuKS2G5AQDzWXNiasHvYIYQU3F/EknVCZnsiXYqXphYkJA6rJCNRnISZCIC1mocq6PB7J08ONdRFCvjfUBuVRT8BNGXNmQ/zQ=="

# Let's Encrypt / Certbot
cloudns_auth_id: "{{ lookup('env', 'CLOUDNS_AUTH_ID') }}"
cloudns_auth_password: "{{ lookup('env', 'CLOUDNS_PASSWORD') }}"
cloudns_nameserver: "109.201.133.111"
certbot_email: c.alexandre.pires@alexpires.me
certbot_domains:
  - "gpu-01.lab.alexpires.me"

certbot_cockpit_domain: "gpu-01.lab.alexpires.me"
ollama_models:
  # Thinking models
  - gpt-oss:latest
  - gemma4:e4b
  - qwen3.5:9b
  - qwen3.5:4b
  # Non-thinking models
  - ministral-3:3b
  - ministral-3:8b
  - ministral-3:14b
  - granite4.1:3b
  - granite4.1:8b
  - deepseek-r1:latest
  - qwen2.5-coder:3b
  # Embedding models
  - embeddinggemma:latest
  - nomic-embed-text:latest
  # Whisper models
  - dimavz/whisper-tiny:latest
ollama_model_files:
  - file: "ollama/gpt-oss-latest-32k.modelfile"
    name: "gpt-oss-32k:latest"
  - file: "ollama/gemma4-e4b-32k.modelfile"
    name: "gemma4-e4b-32k:latest"
  - file: "ollama/qwen3.5-9b-32k.modelfile"
    name: "qwen3.5-9b-32k:latest"
  - file: "ollama/qwen3.5-9b-64k.modelfile"
    name: "qwen3.5-9b-64k:latest"
  - file: "ollama/qwen3.5-4b-32k.modelfile"
    name: "qwen3.5-4b-32k:latest"
  - file: "ollama/qwen3.5-4b-64k.modelfile"
    name: "qwen3.5-4b-64k:latest"
llama_models:
  # TODO: replace revision values with pinned commit SHAs for strict reproducibility.
  - name: "gpt-oss-20b-q4-0"
    model_id: "unsloth/gpt-oss-20b-GGUF"
    quant: "Q4_0"
    revision: "main"
  - name: "gemma-4-26b-a4b-ud-iq4-xs"
    model_id: "unsloth/gemma-4-26B-A4B-it-GGUF"
    quant: "UD-IQ4_XS"
    revision: "main"
  - name: "gemma-4-31b-iq4-xs"
    model_id: "unsloth/gemma-4-31B-it-GGUF"
    quant: "IQ4_XS"
    revision: "main"
  - name: "qwen3-6-35b-a3b-mtp-ud-iq4-xs"
    model_id: "unsloth/Qwen3.6-35B-A3B-MTP-GGUF"
    quant: "UD-IQ4_XS"
    revision: "main"
  - name: "qwen3-5-27b-mtp-iq4-xs"
    model_id: "unsloth/Qwen3.5-27B-MTP-GGUF"
    quant: "IQ4_XS"
    revision: "main"
  - name: "qwen3-5-35b-a3b-ud-iq4-xs"
    model_id: "unsloth/Qwen3.5-35B-A3B-GGUF"
    quant: "UD-IQ4_XS"
    revision: "main"
  - name: "ministral-3-14b-instruct-iq4-xs"
    model_id: "unsloth/Ministral-3-14B-Instruct-2512-GGUF"
    quant: "IQ4_XS"
    revision: "main"
  - name: "granite-4-1-30b-iq4-xs"
    model_id: "unsloth/granite-4.1-30b-GGUF"
    quant: "IQ4_XS"
    revision: "main"
  - name: "qwen3-5-9b-iq4-xs"
    model_id: "unsloth/Qwen3.5-9B-GGUF"
    quant: "IQ4_XS"
    revision: "main"
  - name: "qwen3-6-35b-a3b-claude47-distilled-iq4-xs"
    model_id: "lordx64/Qwen3.6-35B-A3B-Claude-4.7-Opus-Reasoning-Distilled-IQ4_XS-GGUF"
    quant: "IQ4_XS"
    revision: "main"
  - name: "devstral-small-2-24b-instruct-iq4-xs"
    model_id: "unsloth/Devstral-Small-2-24B-Instruct-2512-GGUF"
    quant: "IQ4_XS"
    revision: "main"

# Optional global model preset options applied under [*] in models.ini.
# Keys map to llama.cpp CLI args without leading dashes, short args, or LLAMA_ARG_* env names.
llama_preset_global:
  c: 131072
  n-gpu-layers: all