alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat: Add VFIO binding script and update playbook for enhanced virtualization support

Browse Source
This commit is contained in:
Alexandre Pires
2026-01-02 23:15:08 +01:00
parent 03d5b39a4b
commit 3c6647c215
13 changed files with 540 additions and 135 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/host_vars/vh-01.lab.alexpires.me.yml
+204 -106
View File
@@ -1,6 +1,24 @@
hostname: vh-01.lab.alexpires.me
ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}"
packages_blocklist:
- apport*
- autofs
- beep
- git
- pastebinit
- popularity-contest
- prelink
- rpcbind
- rsh*
- talk*
- telnet*
- tftp*
- whoopsie
- xinetd
- yp-tools
- ypbind
# Users
login_users:
- username: "{{ ansible_user }}"
@@ -36,7 +54,7 @@ ufw_enable: true
fw_allowed_ports:
- { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop)
- { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network
- { rule: "allow", port: "9090", proto: "tcp" }
- { rule: "allow", port: "9090", proto: "tcp", from: "10.19.4.0/24" } # local network
ufw_outgoing_traffic:
- 22 # SSH
@@ -53,6 +71,14 @@ ipv4_sysctl_settings:
disable_ipv6: true
# Network Bridge Configuration
bridge_name: "br0"
bridge_interface: "{{ ansible_default_ipv4.interface }}" # Auto-detect primary interface
bridge_ipv4_address: "10.19.4.254/24" # Adjust to your static IP
bridge_ipv4_gateway: "10.19.4.1"
bridge_ipv4_dns: "10.19.4.1,1.1.1.1"
bridge_ipv4_domain: "lab.alexpires.me"
# geoip will override hosts_allow and hosts_deny (so it's disabled - CIS hardening)
custom_hosts_acls: true
@@ -63,31 +89,30 @@ hide_pid: 0
install_aide: false
# Unattended upgrades
unattended_reboot: true
unattended_reboot: false
unattended_reboot_time: "04:30"
# Duo Security
duo_users: ["*", "!provision"]
duo_api_hostname: api-7cda1654.duosecurity.com
# VMs reserved CPU (for gaming and AI)
virt_vm_reserved_cpu: "1-5,7-11"
virt_raw_block_devices:
- "nvme0n1"
- "nvme0n1p1"
- "nvme0n1p2"
# VMs reserved CPU )
virt_vm_reserved_cpu: "1-7,9-15"
virt_raw_block_devices: []
# Devices to unbind for VFIO passthrough (This are devices that will be unbound at boot with vfio-bind.sh)
virt_vfio_devices:
- { dev: "0000:08:00.0", vendor: "1b73", device: "1100" } # Fresco Logic FL1100 USB 3.0 Host Controller
- { dev: "0000:05:00.0", vendor: "c0a9", device: "5415" } # Micron/Crucial Technology T500 NVMe PCIe SSD
virt_extra_grub_args: >
i915.modeset=1 i915.enable_gvt=1 i915.enable_fbc=0
initcall_blacklist=simpledrm_platform_driver_init
rd.driver.blacklist=nouveau modprobe.blacklist=nouveau
rd.driver.blacklist=nouveau modprobe.blacklist=nouveau ipv6.disable=1 audit=1 audit_backlog_limit=8192
virt_vfio_ids:
- 10de:2482 # NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
- 10de:228b # NVIDIA Corporation GA106 High Definition Audio Controller
- 10de:2504 # NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate]
- 10de:228e # NVIDIA Corporation GA106 High Definition Audio Controller
- 10de:1430 # NVIDIA Corporation M2000 [Maxwell GM107GL]
- 10de:0fba # NVIDIA Corporation M2000 High Definition Audio Controller
- 1b73:1100 # Fresco Logic FL1100 USB 3.0 Host Controller
- c0a9:5415 # Micron/Crucial Technology T500 NVMe PCIe SSD
virt_blacklist:
- noveau
@@ -96,15 +121,15 @@ virt_blacklist:
- mxm_wmi
virt_machines:
- name: windows-11
title: "Microsoft Windows 11"
- name: win10pro
title: "Microsoft Windows 10 Pro"
uuid: "51d5d091-67cb-4113-bd8e-817e7317e1b4"
autostart: true
memory: 25165824
cores: 4
autostart: false
memory: 16
cores: 5
threads: 2
physical_cpus: "2-8,3-9,4-10,5-11"
reserved_cpus: "0,6"
physical_cpus: "3-11,4-12,5-13,6-14,7-15"
reserved_cpus: "0,8"
enable_hyperv: true
cdrom: true
console: false
@@ -112,126 +137,199 @@ virt_machines:
secure_boot: true
tpm: true
tablet: true
disk_file: "windows-11.qcow2"
net_bridge: br0
disk_file: "win10pro.qcow2"
mac_address: "52:54:00:cd:dd:2d"
block_devs:
- block_dev: "/dev/nvme0n1"
target_dev: "sdb"
block_devs: []
guest_agent: true
host_devs:
# Intel MDev device for GVT-g
- type: "mdev"
# Micron/Crucial Technology T500 NVMe PCIe SSD
- type: "pci"
source:
uuid: "5abeb24f-d6f4-4666-b495-303f15b05723"
address:
domain: "0x0000"
bus: "0x05"
slot: "0x00"
function: "0x0"
address:
{
type: "pci",
domain: "0x0000",
bus: "0x07",
slot: "0x00",
function: "0x0",
}
type: "pci"
domain: "0x0000"
bus: "0x11"
slot: "0x00"
function: "0x0"
# Fresco Logic FL1100 USB 3.0 Host Controller
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x06"
bus: "0x08"
slot: "0x00"
function: "0x0"
address:
{
type: "pci",
domain: "0x0000",
bus: "0x10",
slot: "0x00",
function: "0x0",
}
# NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
type: "pci"
domain: "0x0000"
bus: "0x10"
slot: "0x00"
function: "0x0"
# NVIDIA Corporation M2000 [Maxwell GM107GL]
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x01"
bus: "0x03"
slot: "0x00"
function: "0x0"
address:
{
type: "pci",
domain: "0x0000",
bus: "0x0b",
slot: "0x00",
function: "0x0",
}
# NVIDIA Corporation GA106 High Definition Audio Controller
type: "pci"
domain: "0x0000"
bus: "0x0b"
slot: "0x00"
function: "0x0"
# NVIDIA Corporation M2000 High Definition Audio Controller
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x01"
bus: "0x03"
slot: "0x00"
function: "0x1"
address:
{
type: "pci",
domain: "0x0000",
bus: "0x0f",
slot: "0x00",
function: "0x0",
}
type: "pci"
domain: "0x0000"
bus: "0x0f"
slot: "0x00"
function: "0x0"
- name: fedora-headless
title: "Fedora CUDA headless"
- name: win11home
title: "Microsoft Windows 11 Home"
uuid: "51d5d091-67cb-4113-bd8e-817e7317e1b5"
autostart: false
memory: 16
cores: 5
threads: 2
physical_cpus: "3-11,4-12,5-13,6-14,7-15"
reserved_cpus: "0,8"
enable_hyperv: true
cdrom: true
console: false
audio: true
secure_boot: true
tpm: true
tablet: true
net_bridge: br0
disk_file: "win11home.qcow2"
mac_address: "52:54:00:cd:dd:2e"
block_devs: []
guest_agent: true
host_devs:
# Micron/Crucial Technology T500 NVMe PCIe SSD
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x05"
slot: "0x00"
function: "0x0"
address:
type: "pci"
domain: "0x0000"
bus: "0x11"
slot: "0x00"
function: "0x0"
# Fresco Logic FL1100 USB 3.0 Host Controller
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x08"
slot: "0x00"
function: "0x0"
address:
type: "pci"
domain: "0x0000"
bus: "0x10"
slot: "0x00"
function: "0x0"
# NVIDIA Corporation M2000 [Maxwell GM107GL]
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x03"
slot: "0x00"
function: "0x0"
address:
type: "pci"
domain: "0x0000"
bus: "0x0b"
slot: "0x00"
function: "0x0"
# NVIDIA Corporation M2000 High Definition Audio Controller
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x03"
slot: "0x00"
function: "0x1"
address:
type: "pci"
domain: "0x0000"
bus: "0x0f"
slot: "0x00"
function: "0x0"
- name: dev-01
title: "Lab Kubernetes VM"
uuid: "55feda16-51ae-446e-9c83-4c0eee1e5e00"
cloud_image_url: "http://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img"
cloud_image_sha256: "2b5f90ffe8180def601c021c874e55d8303e8bcbfc66fee2b94414f43ac5eb1f"
disk_size: 80G
cloud_init: true
autostart: true
memory: 33554432
memory: 8
cores: 1
threads: 2
physical_cpus: "1-7"
reserved_cpus: "0,6"
cdrom: false
physical_cpus: "2-10"
reserved_cpus: "0,8"
cdrom: true
console: true
audio: false
secure_boot: false
secure_boot: true
tpm: true
disk_file: "fedora-headless.qcow2"
net_bridge: br0
disk_file: "dev-01.qcow2"
mac_address: "52:54:00:ae:f3:d0"
block_devs:
- block_dev: "/dev/nvme0n1"
target_dev: "sdb"
host_devs:
# NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate]
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x03"
slot: "0x00"
function: "0x0"
address:
{
type: "pci",
domain: "0x0000",
bus: "0x09",
slot: "0x00",
function: "0x0",
}
# NVIDIA Corporation GA106 High Definition Audio Controller
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x03"
slot: "0x00"
function: "0x1"
address:
{
type: "pci",
domain: "0x0000",
bus: "0x0a",
slot: "0x00",
function: "0x0",
}
block_devs: []
host_devs: []
guest_agent: true
virtio_fs:
- source: "/mnt/srv"
target: "srv"
- source: "/mnt/storage"
target: "storage"
user_data: |
#cloud-config
hostname: dev-01
fqdn: dev-01.lab.alexpires.me
manage_etc_hosts: true
users:
- name: provision
sudo: ALL=(ALL) NOPASSWD:ALL
shell: /bin/bash
lock_passwd: true
ssh_authorized_keys:
- {{ lookup('file', 'keys/localnetwork.pub') | trim }}
ssh_pwauth: false
disable_root: true
package_upgrade: true
packages:
- qemu-guest-agent
runcmd:
- systemctl enable qemu-guest-agent
- systemctl start qemu-guest-agent
# Let's Encrypt / Certbot
cloudns_auth_id: "{{ lookup('env', 'CLOUDNS_AUTH_ID') }}"
cloudns_auth_password: "{{ lookup('env', 'CLOUDNS_PASSWORD') }}"
cloudns_nameserver: "109.201.133.111"