Add GPU monitoring services and configurations

- Create systemd service templates for llama_exporter, nvidia_exporter, and podman.
- Add Prometheus configuration template for GPU metrics scraping.
- Introduce variables for GPU monitoring role in main.yml.
- Implement tasks for syncing llama models, including user setup and package installation.
- Update podman tasks to ensure proper sudo access and lingering for the podman user.
- Modify inventory to include gpu_monitoring group.
- Add Terraform modules for deploying Vaultwarden, including ingress and service configurations.
- Create Grafana dashboard for real-time GPU monitoring metrics.
- Update secrets and environment files to include Vaultwarden admin token.

terraform/modules/apps/vaultwarden/config.tf

@@ -0,0 +1,6 @@
+locals {
+  app_folder = var.persistent_folder
+  app_version = var.tag
+  app_fqdn    = var.fqdn
+  db_path     = var.db_folder != "" ? var.db_folder : local.app_folder
+}

terraform/modules/apps/vaultwarden/ingress.tf

@@ -0,0 +1,39 @@
+resource "kubernetes_ingress_v1" "vaultwarden" {
+  metadata {
+    name      = "ingress"
+    namespace = kubernetes_namespace.vaultwarden.metadata[0].name
+
+    annotations = {
+      "kubernetes.io/ingress.class"              = "public"
+      "cert-manager.io/cluster-issuer"           = var.issuer
+      "kubernetes.io/tls-acme"                   = "true"
+      "nginx.ingress.kubernetes.io/ssl-redirect" = "true"
+    }
+  }
+
+  spec {
+    dynamic "tls" {
+      for_each = var.tls_enabled ? [1] : []
+      content {
+        hosts       = [var.fqdn]
+        secret_name = "vaultwarden-tls"
+      }
+    }
+
+    rule {
+      host = var.fqdn
+      http {
+        path {
+          backend {
+            service {
+              name = kubernetes_service.vaultwarden.metadata[0].name
+              port {
+                number = 80
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}

terraform/modules/apps/vaultwarden/main.tf

@@ -0,0 +1,191 @@
+resource "kubernetes_namespace" "vaultwarden" {
+  metadata {
+    name = "vaultwarden"
+  }
+}
+
+resource "kubernetes_service_account" "vaultwarden" {
+  metadata {
+    name      = "vaultwarden-sa"
+    namespace = kubernetes_namespace.vaultwarden.metadata[0].name
+  }
+
+  automount_service_account_token = false
+}
+
+resource "kubernetes_config_map" "vaultwarden_config" {
+  metadata {
+    name      = "vaultwarden-config"
+    namespace = kubernetes_namespace.vaultwarden.metadata[0].name
+  }
+
+  data = {
+    DOMAIN       = "https://${local.app_fqdn}/"
+    SIGNUP       = var.signup_enabled ? "true" : "false"
+    DATABASE_URL = "file:///data/db.sqlite3"
+  }
+}
+
+resource "kubernetes_secret" "vaultwarden_secrets" {
+  metadata {
+    name      = "vaultwarden-keys"
+    namespace = kubernetes_namespace.vaultwarden.metadata[0].name
+  }
+
+  data = {
+    ADMIN_TOKEN = var.admin_token
+  }
+}
+
+resource "kubernetes_deployment" "vaultwarden" {
+  metadata {
+    name      = "vaultwarden"
+    namespace = kubernetes_namespace.vaultwarden.metadata[0].name
+    labels = {
+      app = "vaultwarden"
+    }
+  }
+
+  spec {
+    replicas = 1
+
+    selector {
+      match_labels = {
+        app = "vaultwarden"
+      }
+    }
+
+    strategy {
+      type = "Recreate"
+    }
+
+    template {
+      metadata {
+        labels = {
+          app = "vaultwarden"
+        }
+      }
+
+      spec {
+        service_account_name            = kubernetes_service_account.vaultwarden.metadata[0].name
+        automount_service_account_token = false
+
+        security_context {
+          run_as_non_root = true
+          run_as_user     = 1000
+          run_as_group    = 1000
+          fs_group        = 1000
+
+          seccomp_profile {
+            type = "RuntimeDefault"
+          }
+        }
+
+        container {
+          name  = "vaultwarden"
+          image = "vaultwarden/server:${local.app_version}"
+
+          env_from {
+            config_map_ref {
+              name = kubernetes_config_map.vaultwarden_config.metadata[0].name
+            }
+          }
+
+          env {
+            name = "ADMIN_TOKEN"
+            value_from {
+              secret_key_ref {
+                name = kubernetes_secret.vaultwarden_secrets.metadata[0].name
+                key  = "ADMIN_TOKEN"
+              }
+            }
+          }
+
+          security_context {
+            allow_privilege_escalation = false
+            privileged                 = false
+
+            capabilities {
+              drop = ["ALL"]
+            }
+
+            read_only_root_filesystem = true
+          }
+
+          port {
+            name           = "http"
+            container_port = 80
+            protocol       = "TCP"
+          }
+
+          liveness_probe {
+            http_get {
+              path = "/"
+              port = "http"
+            }
+            initial_delay_seconds = 30
+            period_seconds        = 15
+          }
+
+          readiness_probe {
+            http_get {
+              path = "/"
+              port = "http"
+            }
+            initial_delay_seconds = 10
+            period_seconds        = 10
+          }
+
+          volume_mount {
+            name       = "vaultwarden-data"
+            mount_path = "/data"
+          }
+
+          volume_mount {
+            name       = "vaultwarden-tmp"
+            mount_path = "/tmp"
+          }
+        }
+
+        volume {
+          name = "vaultwarden-data"
+          host_path {
+            path = local.db_path
+          }
+        }
+
+        volume {
+          name = "vaultwarden-tmp"
+          empty_dir {}
+        }
+      }
+    }
+  }
+}
+
+resource "kubernetes_service" "vaultwarden" {
+  metadata {
+    name      = "vaultwarden-service"
+    namespace = kubernetes_namespace.vaultwarden.metadata[0].name
+  }
+
+  spec {
+    selector = {
+      app = "vaultwarden"
+    }
+
+    port {
+      name        = "http"
+      port        = 80
+      target_port = 80
+    }
+
+    type = "ClusterIP"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      metadata[0].annotations
+    ]
+  }
+}

terraform/modules/apps/vaultwarden/provider.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = "~>1.8"
+  required_providers {
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "2.36.0"
+    }
+  }
+}

terraform/modules/apps/vaultwarden/variables.tf

@@ -0,0 +1,45 @@
+variable "persistent_folder" {
+  description = "Path for persistent data on the host"
+  type        = string
+}
+
+variable "fqdn" {
+  description = "FQDN for the service"
+  type        = string
+}
+
+variable "tag" {
+  description = "Image tag to deploy"
+  type        = string
+  default     = "latest"
+}
+
+variable "issuer" {
+  description = "The cert-manager cluster issuer"
+  type        = string
+  default     = "letsencrypt-prod"
+}
+
+variable "tls_enabled" {
+  description = "Enable TLS in ingress"
+  type        = bool
+  default     = true
+}
+
+variable "signup_enabled" {
+  description = "Allow new user signups"
+  type        = bool
+  default     = false
+}
+
+variable "admin_token" {
+  description = "Admin token for VaultWarden"
+  type        = string
+  sensitive   = true
+}
+
+variable "db_folder" {
+  description = "Path for the database folder (default: persistent_folder)"
+  type        = string
+  default     = ""
+}