Added support for private apis

ansible/files/dockerfiles/Dockerfile.mcp.gitea

@@ -0,0 +1,26 @@
+FROM python:3.11-slim
+ARG MCP_VERSION=0.2.0
+ARG UID=1000
+ARG GID=1000
+RUN groupadd --system --gid ${GID} worker && \
+    adduser --system --gid ${GID} --uid ${UID} --home /home/worker worker
+ENV PATH=/home/worker/.local/bin:$PATH
+WORKDIR /home/worker
+# Super user custom actions
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl \
+    tar \
+    && rm -rf /var/lib/apt/lists/*
+RUN curl -L https://gitea.com/gitea/gitea-mcp/releases/download/v${MCP_VERSION}/gitea-mcp_Linux_x86_64.tar.gz \
+    | tar -xz -C /usr/local/bin \
+    && chmod +x /usr/local/bin/gitea-mcp
+# End of super user custom actions
+USER worker
+RUN pip install mcpo uv
+EXPOSE 8000
+# Worker custom actions
+ENV GITEA_HOST="https://gitea.com"
+ENV GITEA_INSECURE="false"
+ENV GITEA_ACCESS_TOKEN="<your personal access token>"
+CMD ["uvx", "mcpo", "--host", "0.0.0.0", "--port", "8000", "--", "gitea-mcp"]
+# End of worker custom actions

ansible/host_vars/dev-01.alexpires.dev.yml

@@ -31,8 +31,7 @@ sshd_max_auth_tries: 10
 # Firewall ports
 ufw_enable: true
 fw_allowed_ports:
-  - { rule: "allow", port: "80", proto: "tcp" }
-  - { rule: "allow", port: "443", proto: "tcp" }
+  - { rule: "allow", port: "8000", proto: "tcp" }
   - { rule: "allow", port: "22", proto: "tcp" }
 
 ufw_outgoing_traffic:

ansible/host_vars/gpu-01.alexpires.dev.yml

@@ -45,6 +45,7 @@ ufw_outgoing_traffic:
   - 123 # NTP
   - 443 # HTTPS
   - 853 # DNS over TLS
+  - 8000
 
 ufw_default_forward_policy: "ACCEPT"
 
@@ -70,31 +71,8 @@ unattended_reboot_time: "04:30"
 duo_users: ["*", "!provision"]
 duo_api_hostname: api-7cda1654.duosecurity.com
 
-# ai tools
-ai_home: "/mnt/data/ai"
-ai_network_name: "ai-network"
-ai_user: "ai"
-ai_group: "ai"
-ai_workloads:
-  - name: ollama
-    build:
-      dockerfile: "{{ lookup('file', 'dockerfiles/Dockerfile.ollama') }}"
-    ports:
-      - 0.0.0.0:11434:11434/tcp
-    volumes:
-      - "{{ ai_home }}/ollama:/home/worker/.ollama:Z"
-    device:
-      - "nvidia.com/gpu=all"
-  - name: open-webui
-    repo: 
-      image: ghcr.io/open-webui/open-webui
-      tag: main
-    ports:
-      - 0.0.0.0:8080:8080/tcp
-    volumes:
-      - "{{ ai_home }}/open-webui:/app/backend/data:Z"
-    device:
-      - "nvidia.com/gpu=all"
-    env:
-      OLLAMA_BASE_URL: "http://ollama:11434"
-
+# open_web_ui settings
+open_webui_home: "/mnt/data/ai"
+open_webui_network_name: "ai-network"
+open_webui_user: "ai"
+open_webui_group: "ai"

ansible/playbook_ai_tools.yml

@@ -1,198 +0,0 @@
-- name: Setup AI tools with Podman (Ollama)
-  hosts: ai
-
-  tasks:
-    - name: Install Podman and its dependencies
-      become: true
-      ansible.builtin.dnf:
-        name:
-          - podman
-          - nvidia-container-toolkit
-        state: present
-
-    - name: Create group and user for AI workloads
-      become: true
-      ansible.builtin.group:
-        name: "{{ ai_group }}"
-        system: true
-
-    - name: Create user and group for AI containers
-      become: true
-      ansible.builtin.user:
-        name: "{{ ai_user }}"
-        groups: "{{ ai_group }}"
-        shell: /bin/bash
-        home: "{{ ai_home }}"
-        group: "{{ ai_group }}"
-
-    - name: Persistently set SELinux context for home directories on AI home
-      become: true
-      community.general.sefcontext:
-        target: "{{ ai_home }}(/.*)?"
-        setype: user_home_dir_t
-        state: present
-
-    - name: Apply SELinux context changes to AI home directories
-      become: true
-      ansible.builtin.command: restorecon -Rv {{ ai_home }}
-      changed_when: false
-
-    - name: Disable password login for AI user
-      ansible.builtin.command: passwd -d "{{ ai_user }}"
-      become: true
-      changed_when: false
-
-    - name: Create data folders for AI tools
-      become: true
-      ansible.builtin.file:
-        path: "{{ ai_home }}"
-        state: directory
-        owner: "{{ ai_user }}"
-        group: "{{ ai_group }}"
-        mode: "0750"
-
-    - name: Create build folders for AI tools
-      become: true
-      ansible.builtin.file:
-        path: "{{ ai_home }}/build"
-        state: directory
-        owner: "{{ ai_user }}"
-        group: "{{ ai_group }}"
-        mode: "0750"
-
-    - name: Create data folders for AI tools
-      become: true
-      ansible.builtin.file:
-        path: "{{ ai_home }}/{{ item.name }}"
-        state: directory
-        owner: "{{ ai_user }}"
-        group: "{{ ai_group }}"
-        mode: "0750"
-      loop: "{{ ai_workloads }}"
-
-    - name: Create systemd service file for nvidia-cdi-generator
-      become: true
-      ansible.builtin.copy:
-        src: services/nvidia-cdi-generator.service
-        dest: /etc/systemd/system/nvidia-cdi-generator.service
-        owner: root
-        group: root
-        mode: "0644"
-
-    - name: Reload systemd daemon
-      become: true
-      ansible.builtin.systemd:
-        daemon_reload: true
-        name: nvidia-cdi-generator
-
-    - name: Enable nvidia-cdi-generator service
-      become: true
-      ansible.builtin.systemd:
-        name: nvidia-cdi-generator
-        enabled: true
-        state: started
-
-    - name: Enable sudo access to ai user (temporary)
-      become: true
-      ansible.builtin.lineinfile:
-        path: /etc/sudoers.d/ansible_ai_tmp
-        create: true
-        mode: '0440'
-        line: "{{ ansible_user_id }} ALL=(ai) NOPASSWD: ALL"
-        validate: 'visudo -cf %s'
-
-    - name: Enable lingering for ai user
-      become: true
-      ansible.builtin.command: loginctl enable-linger {{ ai_user }}
-      register: linger_status
-      changed_when: "'created' in linger_status.stdout or (linger_status.rc == 0 and not ('linger file already exists' in linger_status.stderr or 'linger file does not exist' in linger_status.stderr))" # Heuristic for change
-      failed_when: linger_status.rc != 0 and not ('linger file already exists' in linger_status.stderr)
-
-    - name: Get current user's UID
-      ansible.builtin.command: id -u {{ ai_user }}
-      changed_when: false
-      register: uid
-
-    - name: Get current user's GID
-      ansible.builtin.command: id -g {{ ai_user }}
-      changed_when: false
-      register: gid
-
-    - name: SHowing UID and GID of ai user
-      ansible.builtin.debug:
-        msg: "UID: {{ uid.stdout }}, GID: {{ gid.stdout }}"
-
-    - name: Run tasks as ai user
-      become: true
-      become_user: "{{ ai_user }}"
-      block:
-        - name: Create a custom Podman network
-          containers.podman.podman_network:
-            name: "{{ ai_network_name }}"
-            state: present
-
-        - name: Build containers images
-          containers.podman.podman_image:
-            name: "ai/{{ item.name }}"
-            path: "{{ ai_home }}/build"
-            build:
-              cache: false
-              force_rm: true
-              container_file: "{{ item.build.dockerfile }}"
-              extra_args: "--build-arg UID={{ uid.stdout }} --build-arg GID={{ gid.stdout }} --security-opt=label=disable {{ item.build.args | default('') }}"
-            tag: "latest"
-            state: present
-          loop: "{{ ai_workloads }}"
-          when: item.build is defined
-
-        - name: Pull the requested images
-          containers.podman.podman_image:
-            name: "{{ item.repo.image }}"
-            tag: "{{ item.repo.tag | default('latest') }}"
-            state: present
-          loop: "{{ ai_workloads }}"
-          when: item.repo is defined
-
-        - name: Create a container instance for each workload
-          containers.podman.podman_container:
-            name: "{{ item.name }}"
-            image: "{{ item.repo.image | default('ai/' + item.name) }}"
-            state: started
-            device: "{{ item.device | default(omit) }}"
-            env: "{{ item.env | default(omit) }}"
-            network: "{{ ai_network_name }}"
-            ports: "{{ item.ports | default(omit) }}"
-            volumes: "{{ item.volumes | default(omit) }}"
-            cmd_args:
-              - "--userns=keep-id"
-              - "--security-opt=label=disable"
-          loop: "{{ ai_workloads }}"
-
-    - name: Create systemd service file for containers
-      become: true
-      ansible.builtin.template:
-        src: podman.service.j2
-        dest: "/etc/systemd/system/podman-{{ item.name }}.service"
-        owner: root
-        group: root
-        mode: "0644"
-      loop: "{{ ai_workloads }}"
-
-    - name: Reload systemd daemon
-      become: true
-      ansible.builtin.systemd:
-        daemon_reload: true
-
-    - name: Enable containers at boot
-      become: true
-      ansible.builtin.systemd:
-        name: "podman-{{ item.name }}"
-        enabled: true
-        state: started
-      loop: "{{ ai_workloads }}"
-
-    - name: Remove temporary sudo access
-      become: true
-      ansible.builtin.file:
-        path: /etc/sudoers.d/ansible_ai_tmp
-        state: absent

ansible/playbook_mcp_servers.yml

@@ -0,0 +1,20 @@
+- name: Setup MCP servers
+  hosts: mcp
+  vars:
+    podman_user: "{{ mcp_user | default('mcp') }}"
+    podman_group: "{{ mcp_group | default('mcp') }}"
+    podman_user_home: "{{ mcp_home | default('/home/mcp') }}"
+    pods:
+      - name: gitea-mcp
+        build:
+          dockerfile: "{{ lookup('file', 'dockerfiles/Dockerfile.mcp.gitea') }}"
+        ports:
+          - 0.0.0.0:8000:8000/tcp
+        env:
+          GITEA_HOST: "https://code.alexpires.me"
+          GITEA_ACCESS_TOKEN: "{{ lookup('env', 'GITEA_APP_TOKEN') }}"
+
+  tasks:
+    - name: Setup Pods
+      ansible.builtin.include_tasks:
+        file: tasks/podman.yml

ansible/playbook_open_webui.yml

@@ -0,0 +1,38 @@
+- name: Setup open-webui
+  hosts: openwebui
+  vars:
+    podman_user: "{{ open_webui_user | default('openwebui') }}"
+    podman_group: "{{ open_webui_group | default('openwebui') }}"
+    podman_network_name: "{{ open_webui_network_name | default('openwebui-network') }}"
+    podman_user_home: "{{ open_webui_home | default('/home/open-webui') }}"
+    pods:
+      - name: ollama
+        build:
+          dockerfile: "{{ lookup('file', 'dockerfiles/Dockerfile.ollama') }}"
+        ports:
+          - 0.0.0.0:11434:11434/tcp
+        volumes:
+          - "{{ podman_user_home }}/ollama:/home/worker/.ollama:Z"
+        device:
+          - "nvidia.com/gpu=all"
+      - name: open-webui
+        repo:
+          image: ghcr.io/open-webui/open-webui
+          tag: main
+        ports:
+          - 0.0.0.0:8080:8080/tcp
+        volumes:
+          - "{{ podman_user_home }}/open-webui:/app/backend/data:Z"
+        device:
+          - "nvidia.com/gpu=all"
+        env:
+          OLLAMA_BASE_URL: "http://ollama:11434"
+
+  tasks:
+    - name: Setup nvidia-cdi-generator
+      ansible.builtin.include_tasks:
+        file: tasks/nvidia-cdi-generator.yml
+
+    - name: Setup Pods
+      ansible.builtin.include_tasks:
+        file: tasks/podman.yml

ansible/sectool.env

@@ -10,3 +10,4 @@ MICROK8S_ENCRYPTION_SECRET=$MICROK8S_ENCRYPTION_SECRET
 KMS_ACCESS_KEY=$KMS_ACCESS_KEY
 KMS_SECRET_KEY=$KMS_SECRET_KEY
 KMS_KEY_ARN=$KMS_KEY_ARN
+GITEA_APP_TOKEN=$GITEA_APP_TOKEN

ansible/tasks/nvidia-cdi-generator.yml

@@ -0,0 +1,28 @@
+- name: Install nvidia-cdi-generator
+  become: true
+  ansible.builtin.package:
+    name:
+      - nvidia-container-toolkit
+    state: present
+
+- name: Create systemd service file for nvidia-cdi-generator
+  become: true
+  ansible.builtin.copy:
+    src: services/nvidia-cdi-generator.service
+    dest: /etc/systemd/system/nvidia-cdi-generator.service
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Reload systemd daemon
+  become: true
+  ansible.builtin.systemd:
+    daemon_reload: true
+    name: nvidia-cdi-generator
+
+- name: Enable nvidia-cdi-generator service
+  become: true
+  ansible.builtin.systemd:
+    name: nvidia-cdi-generator
+    enabled: true
+    state: started

ansible/tasks/podman.yml

@@ -0,0 +1,241 @@
+- name: Check if required vars are set
+  ansible.builtin.fail:
+    msg: "Required variables are not set for Podman setup. Please check your playbook variables.)"
+  when:
+    - podman_user is not defined
+    - podman_group is not defined
+    - podman_user_home is not defined
+
+- name: Set fact podman_binary (Debian family)
+  when: ansible_os_family == 'Debian'
+  ansible.builtin.set_fact:
+    podman_binary: /usr/bin/podman
+
+- name: Set fact podman_binary (Red Hat family)
+  when: ansible_os_family == 'RedHat'
+  ansible.builtin.set_fact:
+    podman_binary: /usr/sbin/podman
+
+- name: Install Podman and its dependencies
+  become: true
+  ansible.builtin.package:
+    name:
+      - podman
+      - acl
+    state: present
+
+- name: Create group and user for AI workloads
+  become: true
+  ansible.builtin.group:
+    name: "{{ podman_group }}"
+    system: true
+
+- name: Create user and group for AI containers
+  become: true
+  ansible.builtin.user:
+    name: "{{ podman_user }}"
+    groups: "{{ podman_group }}"
+    shell: /bin/bash
+    home: "{{ podman_user_home }}"
+    group: "{{ podman_group }}"
+
+- name: Disable password login for AI user
+  ansible.builtin.command: passwd -d "{{ podman_user }}"
+  become: true
+  changed_when: false
+
+- name: SELinux tasks (RedHat only)
+  when: ansible_os_family == 'RedHat'
+  become: true
+  block:
+    - name: Persistently set SELinux context for home directories on AI home
+      community.general.sefcontext:
+        target: "{{ podman_user_home }}(/.*)?"
+        setype: user_home_dir_t
+        state: present
+
+    - name: Apply SELinux context changes to AI home directories
+      ansible.builtin.command: restorecon -Rv {{ podman_user_home }}
+      changed_when: false
+
+- name: Create user home
+  become: true
+  ansible.builtin.file:
+    path: "{{ podman_user_home }}"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_group }}"
+    mode: "0750"
+
+- name: Create build folders
+  become: true
+  ansible.builtin.file:
+    path: "{{ podman_user_home }}/build"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_group }}"
+    mode: "0750"
+
+- name: Create folders
+  become: true
+  ansible.builtin.file:
+    path: "{{ podman_user_home }}/{{ item.name }}"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_group }}"
+    mode: "0750"
+  loop: "{{ pods }}"
+
+- name: Enable sudo access to podman user (temporary)
+  become: true
+  ansible.builtin.lineinfile:
+    path: "/etc/sudoers.d/ansible_{{ podman_user }}_tmp"
+    create: true
+    mode: "0440"
+    line: "{{ ansible_user_id }} ALL=({{ podman_user }}) NOPASSWD: ALL"
+    validate: "visudo -cf %s"
+
+- name: Enable lingering for podman user
+  become: true
+  ansible.builtin.command: loginctl enable-linger {{ podman_user }}
+  register: linger_status
+  changed_when: >-
+    "'created' in linger_status.stdout or
+    (linger_status.rc == 0 and not
+      ('linger file already exists' in linger_status.stderr or
+      'linger file does not exist' in linger_status.stderr))"
+  failed_when:
+    - linger_status.rc != 0 and not
+      ('linger file already exists' in linger_status.stderr)
+
+- name: Get current user's UID
+  ansible.builtin.command: id -u {{ podman_user }}
+  changed_when: false
+  register: uid
+
+- name: Get current user's GID
+  ansible.builtin.command: id -g {{ podman_user }}
+  changed_when: false
+  register: gid
+
+- name: Ensure rootless Podman works with overlay driver on Debian-family systems
+  become: true
+  vars:
+    subuid_range: "100000:65536"
+  block:
+    - name: Install required packages for rootless Podman overlay support
+      ansible.builtin.apt:
+        name:
+          - uidmap
+          - fuse-overlayfs
+          - libslirp0
+          - slirp4netns
+        state: present
+        update_cache: true
+
+    - name: Ensure subuid entry exists for the user
+      ansible.builtin.lineinfile:
+        path: /etc/subuid
+        line: "{{ podman_user }}:{{ subuid_range }}"
+        create: true
+        state: present
+        regexp: "^{{ podman_user }}:"
+        mode: "0644"
+
+    - name: Ensure subgid entry exists for the user
+      ansible.builtin.lineinfile:
+        path: /etc/subgid
+        line: "{{ podman_user }}:{{ subuid_range }}"
+        create: true
+        state: present
+        regexp: "^{{ podman_user }}:"
+        mode: "0644"
+
+    - name: Ensure overlay module is loaded  # noqa no-ignore-errors
+      community.general.modprobe:
+        name: overlay
+        state: present
+
+    - name: Ensure overlay module loads on boot
+      ansible.builtin.lineinfile:
+        path: /etc/modules
+        line: overlay
+        create: true
+        state: present
+        mode: "0644"
+
+- name: Run tasks as podman user
+  become: true
+  become_user: "{{ podman_user }}"
+  block:
+    - name: Create a custom Podman network
+      when: podman_network_name is defined and podman_network_name != 'none'
+      containers.podman.podman_network:
+        name: "{{ podman_network_name }}"
+        state: present
+
+    - name: Build containers images
+      containers.podman.podman_image:
+        name: "{{ podman_user }}/{{ item.name }}"
+        path: "{{ podman_user_home }}/build"
+        build:
+          cache: false
+          force_rm: true
+          container_file: "{{ item.build.dockerfile }}"
+          extra_args: "--build-arg UID={{ uid.stdout }} --build-arg GID={{ gid.stdout }} --security-opt=label=disable {{ item.build.args | default('') }}"
+        tag: "latest"
+        state: present
+      loop: "{{ pods }}"
+      when: item.build is defined
+
+    - name: Pull the requested images
+      containers.podman.podman_image:
+        name: "{{ item.repo.image }}"
+        tag: "{{ item.repo.tag | default('latest') }}"
+        state: present
+      loop: "{{ pods }}"
+      when: item.repo is defined
+
+    - name: Create pods
+      containers.podman.podman_container:
+        name: "{{ item.name }}"
+        image: "{{ item.repo.image | default(podman_user + '/' + item.name) }}"
+        state: started
+        device: "{{ item.device | default(omit) }}"
+        env: "{{ item.env | default(omit) }}"
+        network: "{{ podman_network_name | default(omit) }}"
+        ports: "{{ item.ports | default(omit) }}"
+        volumes: "{{ item.volumes | default(omit) }}"
+        cmd_args:
+          - "--userns=keep-id"
+          - "--security-opt=label=disable"
+      loop: "{{ pods }}"
+
+- name: Create systemd service file for pods
+  become: true
+  ansible.builtin.template:
+    src: podman.service.j2
+    dest: "/etc/systemd/system/podman-{{ item.name }}.service"
+    owner: root
+    group: root
+    mode: "0644"
+  loop: "{{ pods }}"
+
+- name: Reload systemd daemon
+  become: true
+  ansible.builtin.systemd:
+    daemon_reload: true
+
+- name: Enable containers at boot
+  become: true
+  ansible.builtin.systemd:
+    name: "podman-{{ item.name }}"
+    enabled: true
+    state: started
+  loop: "{{ pods }}"
+
+- name: Remove temporary sudo access
+  become: true
+  ansible.builtin.file:
+    path: "/etc/sudoers.d/ansible_{{ podman_user }}_tmp"
+    state: absent

ansible/templates/podman.service.j2

@@ -4,11 +4,11 @@ After=local-fs.target network-online.target nvidia-cdi-generator.service
 
 [Service]
 Type=oneshot
-User={{ ai_user}}
-Group={{ ai_group }}
+User={{ podman_user }}
+Group={{ podman_group }}
 RemainAfterExit=true
-ExecStart=/usr/sbin/podman start {{ item.name }}
-ExecStop=/usr/sbin/podman stop {{ item.name }}
+ExecStart={{ podman_binary }} start {{ item.name }}
+ExecStop={{ podman_binary }} stop {{ item.name }}
 
 StandardOutput=journal
 StandardError=journal