Add GPU monitoring services and configurations

- Create systemd service templates for llama_exporter, nvidia_exporter, and podman.
- Add Prometheus configuration template for GPU metrics scraping.
- Introduce variables for GPU monitoring role in main.yml.
- Implement tasks for syncing llama models, including user setup and package installation.
- Update podman tasks to ensure proper sudo access and lingering for the podman user.
- Modify inventory to include gpu_monitoring group.
- Add Terraform modules for deploying Vaultwarden, including ingress and service configurations.
- Create Grafana dashboard for real-time GPU monitoring metrics.
- Update secrets and environment files to include Vaultwarden admin token.

terraform/apps/dev-01/apps.tf

@@ -92,3 +92,13 @@ module "searxng" {
   tag               = "2026.5.2-aefc3c316"
   secret_key        = var.searxng_secret_key
 }
+
+module "vaultwarden" {
+  source = "../../modules/apps/vaultwarden"
+
+  persistent_folder = local.vaultwarden_folder
+  fqdn              = local.vaultwarden_fqdn
+  issuer            = local.vaultwarden_issuer
+  tag               = "1.33.4"
+  admin_token       = var.vaultwarden_admin_token
+}

terraform/apps/dev-01/config.tf

@@ -121,6 +121,11 @@ locals {
           name    = "ci-01"
           type    = "A"
           content = "10.19.4.207"
+        },
+        {
+          name    = "vaultwarden"
+          type    = "CNAME"
+          content = "dev-01.${local.lab_domain}."
         }
       ]
     }
@@ -170,7 +175,7 @@ locals {
     enabled = true
     mac     = "04:7c:16:d6:63:66"
     ip      = "10.19.4.106"
-    port    = "11434"
+    port    = "11435"
     scheme  = "http"
   }
 
@@ -249,6 +254,11 @@ locals {
   searxng_folder = "/mnt/md0/searxng"
   searxng_fqdn   = "search.${local.lab_domain}"
   searxng_issuer = "letsencrypt-prod"
+
+  # vaultwarden
+  vaultwarden_folder = "/mnt/md0/vaultwarden"
+  vaultwarden_fqdn   = "vaultwarden.${local.lab_domain}"
+  vaultwarden_issuer = "internal-ca"
 }
 
 data "terraform_remote_state" "scaleway" {

terraform/apps/dev-01/secrets.tf

@@ -33,3 +33,9 @@ variable "searxng_secret_key" {
   type        = string
   sensitive   = true
 }
+
+variable "vaultwarden_admin_token" {
+  description = "The admin token for VaultWarden"
+  type        = string
+  sensitive   = true
+}

terraform/apps/dev-01/sectool.env

@@ -7,3 +7,4 @@ TF_VAR_scaleway_project_id=$SCALEWAY_PROJECT_ID
 TF_VAR_telegram_bot_token=$TELEGRAM_BOT_TOKEN
 TF_VAR_webui_secret_key=$WEBUI_SECRET_KEY
 TF_VAR_searxng_secret_key=$SEARXNG_SECRET_KEY
+TF_VAR_vaultwarden_admin_token=$VAULTWARDEN_ADMIN_TOKEN

terraform/apps/prod-01/apps.tf

@@ -157,3 +157,13 @@ module "auth_exporter" {
   source            = "../../modules/utils/auth-exporter"
   persistent_folder = "${local.persistent_folder}/monitoring"
 }
+
+module "vaultwarden" {
+  source = "../../modules/apps/vaultwarden"
+
+  persistent_folder = local.vaultwarden_folder
+  fqdn              = local.vaultwarden_fqdn
+  issuer            = local.internal_issuer
+  tag               = "1.33.4"
+  admin_token       = var.vaultwarden_admin_token
+}

terraform/apps/prod-01/config.tf

@@ -210,6 +210,11 @@ locals {
   # telegram_chat_id = "-950480346" # alexpires.me group
   telegram_message = file("${path.module}/resources/telegram.tpl")
 
+  # vaultwarden
+  vaultwarden_folder = "${local.persistent_folder}/vaultwarden"
+  vaultwarden_fqdn   = "vaultwarden.${local.primary_domain}"
+  internal_issuer    = "internal-ca"
+
   # get secrets from remote state
   backup_bucket_name        = data.terraform_remote_state.scaleway.outputs.backup_bucket_name
   backup_app_api_secret_key = data.terraform_remote_state.scaleway.outputs.backup_app_api_secret_key

terraform/apps/prod-01/secrets.tf

@@ -134,3 +134,9 @@ variable "telegram_bot_token" {
   type        = string
   sensitive   = true
 }
+
+variable "vaultwarden_admin_token" {
+  description = "The admin token for VaultWarden"
+  type        = string
+  sensitive   = true
+}

terraform/apps/prod-01/sectool.env

@@ -33,3 +33,4 @@ TF_VAR_wireguard_1_public_key=$WIREGUARD_1_PUBLIC_KEY
 TF_VAR_wireguard_1_pre_shared_key=$WIREGUARD_1_PRE_SHARED_KEY
 TF_VAR_nginx_token_bearer=$NGINX_TOKEN_BEARER
 TF_VAR_telegram_bot_token=$TELEGRAM_BOT_TOKEN
+TF_VAR_vaultwarden_admin_token=$VAULTWARDEN_ADMIN_TOKEN