Add GPU monitoring services and configurations

- Create systemd service templates for llama_exporter, nvidia_exporter, and podman.
- Add Prometheus configuration template for GPU metrics scraping.
- Introduce variables for GPU monitoring role in main.yml.
- Implement tasks for syncing llama models, including user setup and package installation.
- Update podman tasks to ensure proper sudo access and lingering for the podman user.
- Modify inventory to include gpu_monitoring group.
- Add Terraform modules for deploying Vaultwarden, including ingress and service configurations.
- Create Grafana dashboard for real-time GPU monitoring metrics.
- Update secrets and environment files to include Vaultwarden admin token.

ansible/roles/gpu_monitoring/templates/amdgpu_exporter.service.j2

@@ -0,0 +1,30 @@
+[Unit]
+Description=AMD GPU Sysfs Metrics Exporter
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User={{ amd_exporter_user }}
+Group={{ amd_exporter_user }}
+WorkingDirectory={{ amd_exporter_install_dir }}
+Environment="AMD_EXPORTER_PORT={{ amd_exporter_port }}"
+Environment="AMD_EXPORTER_BIND=0.0.0.0"
+Environment="PATH={{ amd_exporter_venv_bin }}:/usr/bin:/bin"
+ExecStart={{ amd_exporter_venv_bin }}/python3 {{ amd_exporter_script_path }}
+Restart=always
+RestartSec=10
+TimeoutStopSec=10
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=amdgpu_exporter
+
+# Security hardening
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths={{ amd_exporter_install_dir }} /var/log
+NoNewPrivileges=true
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/gpu_monitoring/templates/llama_exporter.service.j2

@@ -0,0 +1,35 @@
+[Unit]
+Description=LLM Inference Metrics Exporter (llama.cpp + Ollama)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User={{ llama_exporter_user }}
+Group={{ llama_exporter_user }}
+WorkingDirectory={{ llama_exporter_install_dir }}
+Environment="LLAMA_EXPORTER_PORT={{ llama_exporter_port }}"
+Environment="LLAMA_EXPORTER_BIND=0.0.0.0"
+Environment="LLAMA_EXPORTER_INTERVAL={{ llama_exporter_scrape_interval }}"
+Environment="LLAMA_EXPORTER_TIMEOUT={{ llama_exporter_scrape_timeout }}"
+{% if llama_exporter_targets and llama_exporter_targets != "" %}
+Environment="LLAMA_TARGETS={{ llama_exporter_targets | to_json }}"
+{% endif %}
+Environment="PATH={{ llama_exporter_venv_bin }}:/usr/bin:/bin"
+ExecStart={{ llama_exporter_venv_bin }}/python3 {{ llama_exporter_script_path }}
+Restart=always
+RestartSec=10
+TimeoutStopSec=10
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=llama_exporter
+
+# Security hardening
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths={{ llama_exporter_install_dir }} /var/log
+NoNewPrivileges=true
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/gpu_monitoring/templates/nvidia_exporter.service.j2

@@ -0,0 +1,34 @@
+# nvidia_gpu_exporter - Prometheus exporter for NVIDIA GPUs via NVML
+#
+# Exposes GPU metrics at /metrics port {{ nvidia_exporter_port }}
+
+[Unit]
+Description=NVIDIA GPU Prometheus Exporter
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User={{ nvidia_exporter_user }}
+Group={{ nvidia_exporter_user }}
+WorkingDirectory={{ nvidia_exporter_install_dir }}
+Environment="PYTHONUNBUFFERED=1"
+ExecStart={{ nvidia_exporter_venv_path }}/bin/python3 {{ nvidia_exporter_script_path }}
+Restart=on-failure
+RestartSec=5
+TimeoutStopSec=10
+StandardOutput=journal
+StandardError=journal
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+ReadOnlyPaths=/sys
+PrivateTmp=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/gpu_monitoring/templates/podman.service.j2

@@ -0,0 +1,17 @@
+[Unit]
+Description=Podman service for {{ item.name }}
+After=local-fs.target network-online.target
+
+[Service]
+Type=oneshot
+User={{ prometheus_user }}
+Group={{ prometheus_group }}
+RemainAfterExit=true
+ExecStart={{ podman_binary | default('/usr/bin/podman') }} start {{ item.name }}
+ExecStop={{ podman_binary | default('/usr/bin/podman') }} stop {{ item.name }}
+
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/gpu_monitoring/templates/prometheus.yml.j2

@@ -0,0 +1,30 @@
+global:
+  scrape_interval: {{ prometheus_scrape_interval }}
+  evaluation_interval: {{ prometheus_evaluation_interval }}
+  scrape_timeout: {{ prometheus_scrape_timeout }}
+
+scrape_configs:
+  - job_name: prometheus
+    static_configs:
+      - targets: ["localhost:{{ prometheus_container_port }}"]
+
+  - job_name: nvidia-gpu
+    metrics_path: /metrics
+    static_configs:
+      - targets: ["{{ prometheus_host_gateway }}:{{ nvidia_exporter_port }}"]
+        labels:
+          datacenter: "{{ inventory_hostname }}"
+
+  - job_name: amdgpu_exporter
+    metrics_path: /metrics
+    static_configs:
+      - targets: ["{{ prometheus_host_gateway }}:{{ amd_exporter_port }}"]
+        labels:
+          datacenter: "{{ inventory_hostname }}"
+
+  - job_name: llama_exporter
+    metrics_path: /metrics
+    static_configs:
+      - targets: ["{{ prometheus_host_gateway }}:{{ llama_exporter_port }}"]
+        labels:
+          datacenter: "{{ inventory_hostname }}"