a13labs.infra/ansible/host_vars/vh-01.lab.alexpires.me.yml

hostname: vh-01.lab.alexpires.me
ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}"

# Users
login_users:
  - username: "{{ ansible_user }}"
    comment: "Managed by Ansible"
    sudoer: true
    sudoer_root_only: true
    sudoer_no_password: true
    pubkey: "{{ lookup('file', 'keys/ansible_user.pub') }}"
    password_disabled: true
  - username: operator
    comment: "Managed by Ansible"
    sudoer: true
    pubkey: "{{ lookup('file', 'keys/operator.pub') }}"
    shell: "/bin/zsh"
    password_expiration: false

# SSH Connection and security
sshd_port: 22
ssh_allowed_networks:
  - "10.5.5.5/32" # Wireguard VPN (Laptop)
  - "10.19.4.0/24" # local network
sshd_admin_net: "10.19.4.0/24" # local network
sshd_allow_groups: "{{ ansible_user }} users"
sshd_permit_root_login: "no"
sshd_password_authentication: "no"
sshd_allow_tcp_forwarding: "yes"

# Due to an issue increase the number of max auth tries
sshd_max_auth_tries: 10

# Firewall ports
ufw_enable: true
fw_allowed_ports:
  - { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop)
  - { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network
  - { rule: "allow", port: "9090", proto: "tcp" }

ufw_outgoing_traffic:
  - 22 # SSH
  - 53 # DNS
  - 80 # HTTP
  - 123 # NTP
  - 443 # HTTPS
  - 853 # DNS over TLS

ufw_default_forward_policy: "ACCEPT"

ipv4_sysctl_settings:
  net.ipv4.ip_forward: 1

disable_ipv6: true

# geoip will override hosts_allow and hosts_deny (so it's disabled - CIS hardening)
custom_hosts_acls: true

# This fixes polkit issues with sudoers file (CIS hardening)
hide_pid: 0

# aide
install_aide: false

# Unattended upgrades
unattended_reboot: true
unattended_reboot_time: "04:30"

# Duo Security
duo_users: ["*", "!provision"]
duo_api_hostname: api-7cda1654.duosecurity.com

# VMs reserved CPU (for gaming and AI)
virt_vm_reserved_cpu: "1-5,7-11"
virt_raw_block_devices:
  - "nvme0n1"
  - "nvme0n1p1"
  - "nvme0n1p2"

virt_extra_grub_args: >
  i915.modeset=1 i915.enable_gvt=1 i915.enable_fbc=0
  initcall_blacklist=simpledrm_platform_driver_init
  rd.driver.blacklist=nouveau modprobe.blacklist=nouveau

virt_vfio_ids:
  - 10de:2482 # NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
  - 10de:228b # NVIDIA Corporation GA106 High Definition Audio Controller
  - 10de:2504 # NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate]
  - 10de:228e # NVIDIA Corporation GA106 High Definition Audio Controller
  - 1b73:1100 # Fresco Logic FL1100 USB 3.0 Host Controller

virt_blacklist:
  - noveau
  - snd_hda_codec_hdmi
  - i2c_nvidia_gpu
  - mxm_wmi

virt_machines:
  - name: windows-11
    title: "Microsoft Windows 11"
    uuid: "51d5d091-67cb-4113-bd8e-817e7317e1b4"
    autostart: true
    memory: 25165824
    cores: 4
    threads: 2
    physical_cpus: "2-8,3-9,4-10,5-11"
    reserved_cpus: "0,6"
    enable_hyperv: true
    cdrom: true
    console: false
    audio: true
    secure_boot: true
    tpm: true
    tablet: true
    disk_file: "windows-11.qcow2"
    mac_address: "52:54:00:cd:dd:2d"
    block_devs:
      - block_dev: "/dev/nvme0n1"
        target_dev: "sdb"
    host_devs:
      # Intel MDev device for GVT-g
      - type: "mdev"
        source:
          uuid: "5abeb24f-d6f4-4666-b495-303f15b05723"
        address:
          {
            type: "pci",
            domain: "0x0000",
            bus: "0x07",
            slot: "0x00",
            function: "0x0",
          }
      # Fresco Logic FL1100 USB 3.0 Host Controller
      - type: "pci"
        source:
          address:
            domain: "0x0000"
            bus: "0x06"
            slot: "0x00"
            function: "0x0"
        address:
          {
            type: "pci",
            domain: "0x0000",
            bus: "0x10",
            slot: "0x00",
            function: "0x0",
          }
      # NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
      - type: "pci"
        source:
          address:
            domain: "0x0000"
            bus: "0x01"
            slot: "0x00"
            function: "0x0"
        address:
          {
            type: "pci",
            domain: "0x0000",
            bus: "0x0b",
            slot: "0x00",
            function: "0x0",
          }
      # NVIDIA Corporation GA106 High Definition Audio Controller
      - type: "pci"
        source:
          address:
            domain: "0x0000"
            bus: "0x01"
            slot: "0x00"
            function: "0x1"
        address:
          {
            type: "pci",
            domain: "0x0000",
            bus: "0x0f",
            slot: "0x00",
            function: "0x0",
          }

  - name: fedora-headless
    title: "Fedora CUDA headless"
    uuid: "55feda16-51ae-446e-9c83-4c0eee1e5e00"
    autostart: true
    memory: 33554432
    cores: 1
    threads: 2
    physical_cpus: "1-7"
    reserved_cpus: "0,6"
    cdrom: false
    console: true
    audio: false
    secure_boot: false
    tpm: true
    disk_file: "fedora-headless.qcow2"
    mac_address: "52:54:00:ae:f3:d0"
    block_devs:
      - block_dev: "/dev/nvme0n1"
        target_dev: "sdb"
    host_devs:
      # NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate]
      - type: "pci"
        source:
          address:
            domain: "0x0000"
            bus: "0x03"
            slot: "0x00"
            function: "0x0"
        address:
          {
            type: "pci",
            domain: "0x0000",
            bus: "0x09",
            slot: "0x00",
            function: "0x0",
          }
      # NVIDIA Corporation GA106 High Definition Audio Controller
      - type: "pci"
        source:
          address:
            domain: "0x0000"
            bus: "0x03"
            slot: "0x00"
            function: "0x1"
        address:
          {
            type: "pci",
            domain: "0x0000",
            bus: "0x0a",
            slot: "0x00",
            function: "0x0",
          }

cloudns_auth_id: "{{ lookup('env', 'CLOUDNS_AUTH_ID') }}"
cloudns_auth_password: "{{ lookup('env', 'CLOUDNS_PASSWORD') }}"
cloudns_nameserver: "109.201.133.111"
certbot_email: c.alexandre.pires@alexpires.me
certbot_domains:
  - "vh-01.lab.alexpires.me"