alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Add configuration and playbook for virtualization host setup

Browse Source 
- Create host variable file for vh-01.alexpires.dev with user, SSH, firewall, and VM configurations.
- Update playbook_duo_security.yml to target the 2fa group.
- Introduce playbook_virt_host.yml for setting up GPU passthrough on Fedora with QEMU/KVM.
- Add required collections to requirements.yml for Podman and Libvirt.
- Modify ctrlaltdel.yml to remove existing symlink for ctrl-alt-del.target before masking it.
- Enhance users.yml to show warnings for users that could not be removed.
- Update Duo Security role to use the correct repository and package names.
- Improve login role to handle user UID and group assignments.
- Create udev rules template for NVMe devices.
- Add blacklist template for VFIO drivers.
- Implement domain XML template for virtual machines with detailed configurations.
- Update inventory to include vh-01.alexpires.dev in relevant groups.
- Refactor cpu_power_monitor.py for improved error handling and modularity.
This commit is contained in:
Alexandre Pires
2025-05-31 00:28:04 +02:00
parent c1c92a866e
commit b692627317
17 changed files with 594 additions and 1040 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/files/vms/fedora-headless.xml
-199
View File
@@ -1,199 +0,0 @@
<domain type='kvm'>
<name>fedora-headless</name>
<uuid>55feda16-51ae-446e-9c83-4c0eee1e5e00</uuid>
<title>Fedora CUDA headless</title>
<memory unit='KiB'>33554432</memory>
<currentMemory unit='KiB'>33554432</currentMemory>
<memoryBacking>
<hugepages/>
<source type='memfd'/>
<access mode='shared'/>
</memoryBacking>
<vcpu placement='static'>2</vcpu>
<cputune>
<vcpupin vcpu='0' cpuset='1'/>
<vcpupin vcpu='1' cpuset='7'/>
<emulatorpin cpuset='0,6'/>
</cputune>
<os>
<type arch='x86_64' machine='pc-q35-7.0'>hvm</type>
<loader readonly='yes' secure='no' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.fd</loader>
<nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/fedora-headless_VARS.fd</nvram>
<boot dev='hd'/>
<bootmenu enable='no'/>
</os>
<features>
<acpi/>
<apic/>
<smm state='on'/>
</features>
<cpu mode='host-passthrough' check='none' migratable='on'>
<topology sockets='1' dies='1' cores='1' threads='2'/>
</cpu>
<clock offset='localtime'>
<timer name='rtc' tickpolicy='catchup'/>
<timer name='pit' tickpolicy='delay'/>
<timer name='hpet' present='no'/>
<timer name='kvmclock' present='yes'/>
</clock>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>destroy</on_crash>
<pm>
<suspend-to-mem enabled='no'/>
<suspend-to-disk enabled='no'/>
</pm>
<devices>
<emulator>/usr/bin/qemu-system-x86_64</emulator>
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2' cache='writeback'/>
<source file='/var/lib/libvirt/images/fedora-headless.snap-2025-05-27'/>
<backingStore type='file'>
<format type='qcow2'/>
<source file='/var/lib/libvirt/images/fedora-headless.qcow2'/>
<backingStore/>
</backingStore>
<target dev='sda' bus='virtio'/>
<address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
</disk>
<disk type='block' device='disk'>
<driver name='qemu' type='raw'/>
<source dev='/dev/nvme0n1'/>
<target dev='sdb' bus='virtio'/>
</disk>
<controller type='usb' index='0' model='qemu-xhci' ports='15'>
<address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
</controller>
<controller type='sata' index='0'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
</controller>
<controller type='pci' index='0' model='pcie-root'/>
<controller type='pci' index='1' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='1' port='0x8'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0' multifunction='on'/>
</controller>
<controller type='pci' index='2' model='pcie-to-pci-bridge'>
<model name='pcie-pci-bridge'/>
<address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
</controller>
<controller type='pci' index='3' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='3' port='0x9'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/>
</controller>
<controller type='pci' index='4' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='4' port='0xa'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
</controller>
<controller type='pci' index='5' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='5' port='0xb'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x3'/>
</controller>
<controller type='pci' index='6' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='6' port='0xc'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x4'/>
</controller>
<controller type='pci' index='7' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='7' port='0xd'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x5'/>
</controller>
<controller type='pci' index='8' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='8' port='0xe'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x6'/>
</controller>
<controller type='pci' index='9' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='9' port='0xf'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x7'/>
</controller>
<controller type='pci' index='10' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='10' port='0x10'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/>
</controller>
<controller type='pci' index='11' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='11' port='0x11'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/>
</controller>
<controller type='pci' index='12' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='12' port='0x12'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2'/>
</controller>
<controller type='pci' index='13' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='13' port='0x13'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3'/>
</controller>
<controller type='pci' index='14' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='14' port='0x14'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4'/>
</controller>
<controller type='pci' index='15' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='15' port='0x15'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5'/>
</controller>
<controller type='pci' index='16' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='16' port='0x16'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6'/>
</controller>
<controller type='virtio-serial' index='0'>
<address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/>
</controller>
<controller type='ccid' index='0'>
<address type='usb' bus='0' port='1'/>
</controller>
<filesystem type='mount' accessmode='passthrough'>
<driver type='virtiofs'/>
<source dir='/media'/>
<target dir='Media'/>
<address type='pci' domain='0x0000' bus='0x08' slot='0x00' function='0x0'/>
</filesystem>
<interface type='bridge'>
<mac address='52:54:00:ae:f3:d0'/>
<source bridge='bridge0'/>
<model type='virtio'/>
<address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
</interface>
<serial type='pty'>
<target type='isa-serial' port='0'>
<model name='isa-serial'/>
</target>
</serial>
<console type='pty'>
<target type='serial' port='0'/>
</console>
<input type='mouse' bus='ps2'/>
<input type='keyboard' bus='ps2'/>
<tpm model='tpm-tis'>
<backend type='emulator' version='2.0'/>
</tpm>
<audio id='1' type='none'/>
<hostdev mode='subsystem' type='pci' managed='yes'>
<source>
<address domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
</source>
<address type='pci' domain='0x0000' bus='0x09' slot='0x00' function='0x0'/>
</hostdev>
<hostdev mode='subsystem' type='pci' managed='yes'>
<source>
<address domain='0x0000' bus='0x03' slot='0x00' function='0x1'/>
</source>
<address type='pci' domain='0x0000' bus='0x0a' slot='0x00' function='0x0'/>
</hostdev>
<memballoon model='virtio'>
<address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
</memballoon>
</devices>
</domain>
ansible/files/vms/old/fedora-headless.old.xml
-220
View File
@@ -1,220 +0,0 @@
<domain type='kvm'>
<name>fedora-headless</name>
<uuid>55feda16-51ae-446e-9c83-4c0eee1e5e00</uuid>
<title>Fedora CUDA headless</title>
<memory unit='KiB'>33554432</memory>
<currentMemory unit='KiB'>33554432</currentMemory>
<memoryBacking>
<hugepages/>
<source type='memfd'/>
<access mode='shared'/>
</memoryBacking>
<vcpu placement='static'>10</vcpu>
<cputune>
<vcpupin vcpu='0' cpuset='1'/>
<vcpupin vcpu='1' cpuset='7'/>
<vcpupin vcpu='2' cpuset='2'/>
<vcpupin vcpu='3' cpuset='8'/>
<vcpupin vcpu='4' cpuset='3'/>
<vcpupin vcpu='5' cpuset='9'/>
<vcpupin vcpu='6' cpuset='4'/>
<vcpupin vcpu='7' cpuset='10'/>
<vcpupin vcpu='8' cpuset='5'/>
<vcpupin vcpu='9' cpuset='11'/>
<emulatorpin cpuset='0,6'/>
</cputune>
<os>
<type arch='x86_64' machine='pc-q35-7.0'>hvm</type>
<loader readonly='yes' secure='no' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.fd</loader>
<nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/fedora-headless_VARS.fd</nvram>
<boot dev='hd'/>
<bootmenu enable='no'/>
</os>
<features>
<acpi/>
<apic/>
<smm state='on'/>
</features>
<cpu mode='host-passthrough' check='none' migratable='on'>
<topology sockets='1' dies='1' cores='5' threads='2'/>
</cpu>
<clock offset='localtime'>
<timer name='rtc' tickpolicy='catchup'/>
<timer name='pit' tickpolicy='delay'/>
<timer name='hpet' present='no'/>
<timer name='kvmclock' present='yes'/>
</clock>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>destroy</on_crash>
<pm>
<suspend-to-mem enabled='no'/>
<suspend-to-disk enabled='no'/>
</pm>
<devices>
<emulator>/usr/bin/qemu-system-x86_64</emulator>
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2' cache='writeback'/>
<source file='/var/lib/libvirt/images/fedora-headless.snap-2025-05-27'/>
<backingStore type='file'>
<format type='qcow2'/>
<source file='/var/lib/libvirt/images/fedora-headless.qcow2'/>
<backingStore/>
</backingStore>
<target dev='sda' bus='virtio'/>
<address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
</disk>
<controller type='usb' index='0' model='qemu-xhci' ports='15'>
<address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
</controller>
<controller type='sata' index='0'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
</controller>
<controller type='pci' index='0' model='pcie-root'/>
<controller type='pci' index='1' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='1' port='0x8'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0' multifunction='on'/>
</controller>
<controller type='pci' index='2' model='pcie-to-pci-bridge'>
<model name='pcie-pci-bridge'/>
<address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
</controller>
<controller type='pci' index='3' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='3' port='0x9'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/>
</controller>
<controller type='pci' index='4' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='4' port='0xa'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
</controller>
<controller type='pci' index='5' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='5' port='0xb'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x3'/>
</controller>
<controller type='pci' index='6' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='6' port='0xc'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x4'/>
</controller>
<controller type='pci' index='7' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='7' port='0xd'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x5'/>
</controller>
<controller type='pci' index='8' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='8' port='0xe'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x6'/>
</controller>
<controller type='pci' index='9' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='9' port='0xf'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x7'/>
</controller>
<controller type='pci' index='10' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='10' port='0x10'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/>
</controller>
<controller type='pci' index='11' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='11' port='0x11'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/>
</controller>
<controller type='pci' index='12' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='12' port='0x12'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2'/>
</controller>
<controller type='pci' index='13' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='13' port='0x13'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3'/>
</controller>
<controller type='pci' index='14' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='14' port='0x14'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4'/>
</controller>
<controller type='pci' index='15' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='15' port='0x15'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5'/>
</controller>
<controller type='pci' index='16' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='16' port='0x16'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6'/>
</controller>
<controller type='virtio-serial' index='0'>
<address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/>
</controller>
<controller type='ccid' index='0'>
<address type='usb' bus='0' port='1'/>
</controller>
<filesystem type='mount' accessmode='passthrough'>
<driver type='virtiofs'/>
<source dir='/media'/>
<target dir='Media'/>
<address type='pci' domain='0x0000' bus='0x08' slot='0x00' function='0x0'/>
</filesystem>
<interface type='bridge'>
<mac address='52:54:00:ae:f3:d0'/>
<source bridge='bridge0'/>
<model type='virtio'/>
<address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
</interface>
<serial type='pty'>
<target type='isa-serial' port='0'>
<model name='isa-serial'/>
</target>
</serial>
<console type='pty'>
<target type='serial' port='0'/>
</console>
<input type='mouse' bus='ps2'/>
<input type='keyboard' bus='ps2'/>
<tpm model='tpm-tis'>
<backend type='emulator' version='2.0'/>
</tpm>
<audio id='1' type='none'/>
<hostdev mode='subsystem' type='pci' managed='yes'>
<source>
<address domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
</source>
<address type='pci' domain='0x0000' bus='0x09' slot='0x00' function='0x0'/>
</hostdev>
<hostdev mode='subsystem' type='pci' managed='yes'>
<source>
<address domain='0x0000' bus='0x03' slot='0x00' function='0x1'/>
</source>
<address type='pci' domain='0x0000' bus='0x0a' slot='0x00' function='0x0'/>
</hostdev>
<hostdev mode='subsystem' type='pci' managed='yes'>
<source>
<address domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
</source>
<address type='pci' domain='0x0000' bus='0x0c' slot='0x00' function='0x0'/>
</hostdev>
<hostdev mode='subsystem' type='pci' managed='yes'>
<source>
<address domain='0x0000' bus='0x01' slot='0x00' function='0x1'/>
</source>
<address type='pci' domain='0x0000' bus='0x0f' slot='0x00' function='0x0'/>
</hostdev>
<hostdev mode='subsystem' type='pci' managed='yes'>
<source>
<address domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
</source>
<address type='pci' domain='0x0000' bus='0x10' slot='0x00' function='0x0'/>
</hostdev>
<memballoon model='virtio'>
<address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
</memballoon>
</devices>
</domain>
ansible/files/vms/old/windows-11-pro.old.xml
-300
View File
@@ -1,300 +0,0 @@
<domain type='kvm' id='1'>
<name>windows-11</name>
<uuid>51d5d091-67cb-4113-bd8e-817e7317e1b4</uuid>
<title>Microsoft Windows 11</title>
<memory unit='KiB'>25165824</memory>
<currentMemory unit='KiB'>25165824</currentMemory>
<memoryBacking>
<hugepages/>
<source type='memfd'/>
<access mode='shared'/>
</memoryBacking>
<vcpu placement='static'>10</vcpu>
<cputune>
<vcpupin vcpu='0' cpuset='1'/>
<vcpupin vcpu='1' cpuset='7'/>
<vcpupin vcpu='2' cpuset='2'/>
<vcpupin vcpu='3' cpuset='8'/>
<vcpupin vcpu='4' cpuset='3'/>
<vcpupin vcpu='5' cpuset='9'/>
<vcpupin vcpu='6' cpuset='4'/>
<vcpupin vcpu='7' cpuset='10'/>
<vcpupin vcpu='8' cpuset='5'/>
<vcpupin vcpu='9' cpuset='11'/>
<emulatorpin cpuset='0,6'/>
</cputune>
<resource>
<partition>/machine</partition>
</resource>
<os>
<type arch='x86_64' machine='pc-q35-7.0'>hvm</type>
<loader readonly='yes' secure='yes' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader>
<nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/windows-11_VARS.fd</nvram>
<boot dev='hd'/>
<bootmenu enable='no'/>
</os>
<features>
<acpi/>
<apic/>
<hyperv mode='custom'>
<relaxed state='on'/>
<vapic state='on'/>
<spinlocks state='on' retries='8191'/>
<vendor_id state='on' value='whatever'/>
</hyperv>
<kvm>
<hidden state='on'/>
</kvm>
<smm state='on'/>
</features>
<cpu mode='host-passthrough' check='none' migratable='on'>
<topology sockets='1' dies='1' cores='5' threads='2'/>
</cpu>
<clock offset='localtime'>
<timer name='rtc' tickpolicy='catchup'/>
<timer name='pit' tickpolicy='delay'/>
<timer name='hpet' present='no'/>
<timer name='kvmclock' present='yes'/>
<timer name='hypervclock' present='yes'/>
</clock>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>destroy</on_crash>
<pm>
<suspend-to-mem enabled='no'/>
<suspend-to-disk enabled='no'/>
</pm>
<devices>
<emulator>/usr/bin/qemu-system-x86_64</emulator>
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2' cache='writeback'/>
<source file='/var/lib/libvirt/images/windows-11.qcow2' index='2'/>
<backingStore/>
<target dev='sda' bus='virtio'/>
<alias name='virtio-disk0'/>
<address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
</disk>
<disk type='file' device='cdrom'>
<driver name='qemu'/>
<target dev='hdc' bus='sata'/>
<readonly/>
<alias name='sata0-0-2'/>
<address type='drive' controller='0' bus='0' target='0' unit='2'/>
</disk>
<controller type='usb' index='0' model='qemu-xhci' ports='15'>
<alias name='usb'/>
<address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
</controller>
<controller type='sata' index='0'>
<alias name='ide'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
</controller>
<controller type='pci' index='0' model='pcie-root'>
<alias name='pcie.0'/>
</controller>
<controller type='pci' index='1' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='1' port='0x8'/>
<alias name='pci.1'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0' multifunction='on'/>
</controller>
<controller type='pci' index='2' model='pcie-to-pci-bridge'>
<model name='pcie-pci-bridge'/>
<alias name='pci.2'/>
<address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
</controller>
<controller type='pci' index='3' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='3' port='0x9'/>
<alias name='pci.3'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/>
</controller>
<controller type='pci' index='4' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='4' port='0xa'/>
<alias name='pci.4'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
</controller>
<controller type='pci' index='5' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='5' port='0xb'/>
<alias name='pci.5'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x3'/>
</controller>
<controller type='pci' index='6' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='6' port='0xc'/>
<alias name='pci.6'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x4'/>
</controller>
<controller type='pci' index='7' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='7' port='0xd'/>
<alias name='pci.7'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x5'/>
</controller>
<controller type='pci' index='8' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='8' port='0xe'/>
<alias name='pci.8'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x6'/>
</controller>
<controller type='pci' index='9' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='9' port='0xf'/>
<alias name='pci.9'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x7'/>
</controller>
<controller type='pci' index='10' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='10' port='0x10'/>
<alias name='pci.10'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/>
</controller>
<controller type='pci' index='11' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='11' port='0x11'/>
<alias name='pci.11'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/>
</controller>
<controller type='pci' index='12' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='12' port='0x12'/>
<alias name='pci.12'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2'/>
</controller>
<controller type='pci' index='13' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='13' port='0x13'/>
<alias name='pci.13'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3'/>
</controller>
<controller type='pci' index='14' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='14' port='0x14'/>
<alias name='pci.14'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4'/>
</controller>
<controller type='pci' index='15' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='15' port='0x15'/>
<alias name='pci.15'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5'/>
</controller>
<controller type='pci' index='16' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='16' port='0x16'/>
<alias name='pci.16'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6'/>
</controller>
<controller type='virtio-serial' index='0'>
<alias name='virtio-serial0'/>
<address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/>
</controller>
<controller type='ccid' index='0'>
<alias name='ccid0'/>
<address type='usb' bus='0' port='1'/>
</controller>
<filesystem type='mount' accessmode='passthrough'>
<driver type='virtiofs'/>
<binary path='/usr/libexec/virtiofsd'/>
<source dir='/media'/>
<target dir='Media'/>
<alias name='fs0'/>
<address type='pci' domain='0x0000' bus='0x08' slot='0x00' function='0x0'/>
</filesystem>
<interface type='bridge'>
<mac address='52:54:00:cd:dd:2d'/>
<source bridge='bridge0'/>
<target dev='vnet0'/>
<model type='virtio'/>
<alias name='net0'/>
<address type='pci' domain='0x0000' bus='0x0e' slot='0x00' function='0x0'/>
</interface>
<input type='tablet' bus='usb'>
<alias name='input0'/>
<address type='usb' bus='0' port='2'/>
</input>
<input type='mouse' bus='ps2'>
<alias name='input1'/>
</input>
<input type='keyboard' bus='ps2'>
<alias name='input2'/>
</input>
<tpm model='tpm-tis'>
<backend type='emulator' version='2.0'/>
<alias name='tpm0'/>
</tpm>
<audio id='1' type='none'/>
<hostdev mode='subsystem' type='pci' managed='yes'>
<driver name='vfio'/>
<source>
<address domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
</source>
<alias name='hostdev0'/>
<address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
</hostdev>
<hostdev mode='subsystem' type='pci' managed='yes'>
<driver name='vfio'/>
<source>
<address domain='0x0000' bus='0x03' slot='0x00' function='0x1'/>
</source>
<alias name='hostdev1'/>
<address type='pci' domain='0x0000' bus='0x09' slot='0x00' function='0x0'/>
</hostdev>
<hostdev mode='subsystem' type='pci' managed='yes'>
<driver name='vfio'/>
<source>
<address domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
</source>
<alias name='hostdev2'/>
<address type='pci' domain='0x0000' bus='0x10' slot='0x00' function='0x0'/>
</hostdev>
<hostdev mode='subsystem' type='pci' managed='yes'>
<driver name='vfio'/>
<source>
<address domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
</source>
<alias name='hostdev3'/>
<address type='pci' domain='0x0000' bus='0x0b' slot='0x00' function='0x0'/>
</hostdev>
<hostdev mode='subsystem' type='pci' managed='yes'>
<driver name='vfio'/>
<source>
<address domain='0x0000' bus='0x01' slot='0x00' function='0x1'/>
</source>
<alias name='hostdev4'/>
<address type='pci' domain='0x0000' bus='0x0f' slot='0x00' function='0x0'/>
</hostdev>
<hostdev mode='subsystem' type='usb' managed='yes'>
<source>
<vendor id='0x1462'/>
<product id='0x7c75'/>
<address bus='1' device='3'/>
</source>
<alias name='hostdev5'/>
<address type='usb' bus='0' port='3'/>
</hostdev>
<hostdev mode='subsystem' type='pci' managed='yes'>
<driver name='vfio'/>
<source>
<address domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
</source>
<alias name='hostdev6'/>
<address type='pci' domain='0x0000' bus='0x0c' slot='0x00' function='0x0'/>
</hostdev>
<memballoon model='virtio'>
<alias name='balloon0'/>
<address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
</memballoon>
</devices>
<seclabel type='dynamic' model='selinux' relabel='yes'>
<label>system_u:system_r:svirt_t:s0:c399,c880</label>
<imagelabel>system_u:object_r:svirt_image_t:s0:c399,c880</imagelabel>
</seclabel>
<seclabel type='dynamic' model='dac' relabel='yes'>
<label>+107:+107</label>
<imagelabel>+107:+107</imagelabel>
</seclabel>
</domain>
ansible/files/vms/windows-11.xml
-224
View File
@@ -1,224 +0,0 @@
<domain type='kvm'>
<name>windows-11</name>
<uuid>51d5d091-67cb-4113-bd8e-817e7317e1b4</uuid>
<title>Microsoft Windows 11</title>
<memory unit='KiB'>25165824</memory>
<currentMemory unit='KiB'>25165824</currentMemory>
<memoryBacking>
<hugepages/>
<source type='memfd'/>
<access mode='shared'/>
</memoryBacking>
<vcpu placement='static'>8</vcpu>
<cputune>
<vcpupin vcpu='0' cpuset='2'/>
<vcpupin vcpu='1' cpuset='8'/>
<vcpupin vcpu='2' cpuset='3'/>
<vcpupin vcpu='3' cpuset='9'/>
<vcpupin vcpu='4' cpuset='4'/>
<vcpupin vcpu='5' cpuset='10'/>
<vcpupin vcpu='6' cpuset='5'/>
<vcpupin vcpu='7' cpuset='11'/>
<emulatorpin cpuset='0,6'/>
</cputune>
<os>
<type arch='x86_64' machine='pc-q35-7.0'>hvm</type>
<loader readonly='yes' secure='yes' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader>
<nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/windows-11_VARS.fd</nvram>
<boot dev='hd'/>
<bootmenu enable='no'/>
</os>
<features>
<acpi/>
<apic/>
<hyperv mode='custom'>
<relaxed state='on'/>
<vapic state='on'/>
<spinlocks state='on' retries='8191'/>
<vendor_id state='on' value='whatever'/>
</hyperv>
<kvm>
<hidden state='on'/>
</kvm>
<smm state='on'/>
</features>
<cpu mode='host-passthrough' check='none' migratable='on'>
<topology sockets='1' dies='1' cores='4' threads='2'/>
</cpu>
<clock offset='localtime'>
<timer name='rtc' tickpolicy='catchup'/>
<timer name='pit' tickpolicy='delay'/>
<timer name='hpet' present='no'/>
<timer name='kvmclock' present='yes'/>
<timer name='hypervclock' present='yes'/>
</clock>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>destroy</on_crash>
<pm>
<suspend-to-mem enabled='no'/>
<suspend-to-disk enabled='no'/>
</pm>
<devices>
<emulator>/usr/bin/qemu-system-x86_64</emulator>
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2' cache='writeback'/>
<source file='/var/lib/libvirt/images/windows-11.qcow2'/>
<backingStore/>
<target dev='sda' bus='virtio'/>
<address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
</disk>
<disk type='block' device='disk'>
<driver name='qemu' type='raw'/>
<source dev='/dev/nvme0n1'/>
<target dev='sdb' bus='virtio'/>
</disk>
<disk type='file' device='cdrom'>
<driver name='qemu' type='raw'/>
<target dev='hdc' bus='sata'/>
<readonly/>
<address type='drive' controller='0' bus='0' target='0' unit='2'/>
</disk>
<controller type='usb' index='0' model='qemu-xhci' ports='15'>
<address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
</controller>
<controller type='sata' index='0'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
</controller>
<controller type='pci' index='0' model='pcie-root'/>
<controller type='pci' index='1' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='1' port='0x8'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0' multifunction='on'/>
</controller>
<controller type='pci' index='2' model='pcie-to-pci-bridge'>
<model name='pcie-pci-bridge'/>
<address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
</controller>
<controller type='pci' index='3' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='3' port='0x9'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/>
</controller>
<controller type='pci' index='4' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='4' port='0xa'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
</controller>
<controller type='pci' index='5' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='5' port='0xb'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x3'/>
</controller>
<controller type='pci' index='6' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='6' port='0xc'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x4'/>
</controller>
<controller type='pci' index='7' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='7' port='0xd'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x5'/>
</controller>
<controller type='pci' index='8' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='8' port='0xe'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x6'/>
</controller>
<controller type='pci' index='9' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='9' port='0xf'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x7'/>
</controller>
<controller type='pci' index='10' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='10' port='0x10'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/>
</controller>
<controller type='pci' index='11' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='11' port='0x11'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/>
</controller>
<controller type='pci' index='12' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='12' port='0x12'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2'/>
</controller>
<controller type='pci' index='13' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='13' port='0x13'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3'/>
</controller>
<controller type='pci' index='14' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='14' port='0x14'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4'/>
</controller>
<controller type='pci' index='15' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='15' port='0x15'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5'/>
</controller>
<controller type='pci' index='16' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='16' port='0x16'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6'/>
</controller>
<controller type='virtio-serial' index='0'>
<address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/>
</controller>
<controller type='ccid' index='0'>
<address type='usb' bus='0' port='1'/>
</controller>
<filesystem type='mount' accessmode='passthrough'>
<driver type='virtiofs'/>
<source dir='/media'/>
<target dir='Media'/>
<address type='pci' domain='0x0000' bus='0x08' slot='0x00' function='0x0'/>
</filesystem>
<interface type='bridge'>
<mac address='52:54:00:cd:dd:2d'/>
<source bridge='bridge0'/>
<model type='virtio'/>
<address type='pci' domain='0x0000' bus='0x0e' slot='0x00' function='0x0'/>
</interface>
<input type='tablet' bus='usb'>
<address type='usb' bus='0' port='2'/>
</input>
<input type='mouse' bus='ps2'/>
<input type='keyboard' bus='ps2'/>
<tpm model='tpm-tis'>
<backend type='emulator' version='2.0'/>
</tpm>
<audio id='1' type='none'/>
<hostdev mode='subsystem' type='mdev' managed='no' model='vfio-pci' display='off'>
<source>
<address uuid='5abeb24f-d6f4-4666-b495-303f15b05723'/>
</source>
<address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
</hostdev>
<hostdev mode='subsystem' type='pci' managed='yes'>
<source>
<address domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
</source>
<address type='pci' domain='0x0000' bus='0x10' slot='0x00' function='0x0'/>
</hostdev>
<hostdev mode='subsystem' type='pci' managed='yes'>
<source>
<address domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
</source>
<address type='pci' domain='0x0000' bus='0x0b' slot='0x00' function='0x0'/>
</hostdev>
<hostdev mode='subsystem' type='pci' managed='yes'>
<source>
<address domain='0x0000' bus='0x01' slot='0x00' function='0x1'/>
</source>
<address type='pci' domain='0x0000' bus='0x0f' slot='0x00' function='0x0'/>
</hostdev>
<memballoon model='virtio'>
<address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
</memballoon>
</devices>
</domain>
ansible/host_vars/vh-01.alexpires.dev.yml
+189
View File
@@ -0,0 +1,189 @@
hostname: vh-01.alexpires.local
ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}"
# Users
login_users:
- username: "{{ ansible_user }}"
comment: "Managed by Ansible"
sudoer: true
sudoer_root_only: true
sudoer_no_password: true
pubkey: "{{ lookup('file', 'keys/ansible_user.pub') }}"
password_disabled: true
- username: operator
comment: "Managed by Ansible"
sudoer: true
pubkey: "{{ lookup('file', 'keys/operator.pub') }}"
shell: "/bin/zsh"
password_expiration: false
# SSH Connection and security
sshd_port: 22
ssh_allowed_networks:
- "0.0.0.0/0"
sshd_admin_net: "0.0.0.0/0"
sshd_allow_groups: "{{ ansible_user }} users"
sshd_permit_root_login: "no"
sshd_password_authentication: "no"
sshd_allow_tcp_forwarding: "yes"
# Due to an issue increase the number of max auth tries
sshd_max_auth_tries: 10
# Firewall ports
ufw_enable: true
fw_allowed_ports:
- { rule: "allow", port: "22", proto: "tcp" }
- { rule: "allow", port: "9090", proto: "tcp" }
ufw_outgoing_traffic:
- 22 # SSH
- 53 # DNS
- 80 # HTTP
- 123 # NTP
- 443 # HTTPS
- 853 # DNS over TLS
ufw_default_forward_policy: "ACCEPT"
ipv4_sysctl_settings:
net.ipv4.ip_forward: 1
disable_ipv6: true
# geoip will override hosts_allow and hosts_deny (so it's disabled - CIS hardening)
custom_hosts_acls: true
# This fixes polkit issues with sudoers file (CIS hardening)
hide_pid: 0
# aide
install_aide: false
# Unattended upgrades
unattended_reboot: true
unattended_reboot_time: "04:30"
# Duo Security
duo_users: ["*", "!provision"]
duo_api_hostname: api-7cda1654.duosecurity.com
# VMs reserved CPU (for gaming and AI)
virt_vm_reserved_cpu: "1-5,7-11"
virt_raw_block_devices:
- "nvme0n1"
- "nvme0n1p1"
- "nvme0n1p2"
virt_extra_grub_args: >
i915.modeset=1 i915.enable_gvt=1 i915.enable_fbc=0
initcall_blacklist=simpledrm_platform_driver_init
rd.driver.blacklist=nouveau modprobe.blacklist=nouveau
virt_vfio_ids:
- 10de:2482 # NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
- 10de:228b # NVIDIA Corporation GA106 High Definition Audio Controller
- 10de:2504 # NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate]
- 10de:228e # NVIDIA Corporation GA106 High Definition Audio Controller
- 1b73:1100 # Fresco Logic FL1100 USB 3.0 Host Controller
virt_blacklist:
- noveau
- snd_hda_codec_hdmi
- i2c_nvidia_gpu
- mxm_wmi
virt_machines:
- name: windows-11
title: "Microsoft Windows 11"
uuid: "51d5d091-67cb-4113-bd8e-817e7317e1b4"
autostart: true
memory: 25165824
cores: 4
threads: 2
physical_cpus: "2-8,3-9,4-10,5-11"
reserved_cpus: "0,6"
enable_hyperv: true
cdrom: true
console: false
audio: true
secure_boot: true
tpm: true
tablet: true
disk_file: "windows-11.qcow2"
mac_address: "52:54:00:cd:dd:2d"
block_devs:
- block_dev: "/dev/nvme0n1"
target_dev: "sdb"
host_devs:
# Intel MDev device for GVT-g
- type: "mdev"
source:
uuid: "5abeb24f-d6f4-4666-b495-303f15b05723"
address: { type: 'pci', domain: '0x0000', bus: '0x07', slot: '0x00', function: '0x0' }
# Fresco Logic FL1100 USB 3.0 Host Controller
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x06"
slot: "0x00"
function: "0x0"
address: { type: 'pci', domain: '0x0000', bus: '0x10', slot: '0x00', function: '0x0' }
# NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x01"
slot: "0x00"
function: "0x0"
address: { type: 'pci', domain: '0x0000', bus: '0x0b', slot: '0x00', function: '0x0' }
# NVIDIA Corporation GA106 High Definition Audio Controller
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x01"
slot: "0x00"
function: "0x1"
address: { type: 'pci', domain: '0x0000', bus: '0x0f', slot: '0x00', function: '0x0' }
- name: fedora-headless
title: "Fedora CUDA headless"
uuid: "55feda16-51ae-446e-9c83-4c0eee1e5e00"
autostart: true
memory: 33554432
cores: 1
threads: 2
physical_cpus: "1-7"
reserved_cpus: "0,6"
cdrom: false
console: true
audio: false
secure_boot: false
tpm: true
disk_file: "fedora-headless.qcow2"
mac_address: "52:54:00:ae:f3:d0"
block_devs:
- block_dev: "/dev/nvme0n1"
target_dev: "sdb"
host_devs:
# NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate]
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x03"
slot: "0x00"
function: "0x0"
address: { type: 'pci',domain: '0x0000',bus: '0x09',slot: '0x00',function: '0x0' }
# NVIDIA Corporation GA106 High Definition Audio Controller
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x03"
slot: "0x00"
function: "0x1"
address: { type: 'pci',domain: '0x0000',bus: '0x0a',slot: '0x00',function: '0x0' }
ansible/playbook_duo_security.yml
+1 -1
View File
@@ -1,6 +1,6 @@
---
- name: Duo Security
hosts: public
hosts: 2fa
gather_facts: true
roles:
ansible/localhost_playbook_vm_host.yml → ansible/playbook_virt_host.yml
+78 -66
View File
@@ -1,35 +1,16 @@
- name: Setup GPU passthrough host (Fedora + QEMU/KVM)
hosts: localhost
hosts: virtualization
become: true
vars:
host_reserved_cpu: "0-1"
gaming_vm_cpus: "2-9"
ai_vm_cpus: "10-11"
vfio_ids:
- 10de:2482 # NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
- 10de:228b # NVIDIA Corporation GA106 High Definition Audio Controller
- 10de:2504 # NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate]
- 10de:228e # NVIDIA Corporation GA106 High Definition Audio Controller
- 1b73:1100 # Fresco Logic FL1100 USB 3.0 Host Controller
# - 144d:a808 # Samsung Electronics Co Ltd NVMe SSD Controller SM981/PM981/PM983
grub_config_file: "/etc/default/grub"
grub_cmdline_args: >
rhgb quiet intel_iommu=on iommu=pt
isolcpus=1-5,7-11 nohz_full=1-5,7-11 rcu_nocbs=1-5,7-11
i915.modeset=1 i915.enable_gvt=1 i915.enable_fbc=0
initcall_blacklist=simpledrm_platform_driver_init
rd.driver.blacklist=nouveau modprobe.blacklist=nouveau
isolcpus={{ virt_vm_reserved_cpu }} nohz_full={{ virt_vm_reserved_cpu }} rcu_nocbs={{ virt_vm_reserved_cpu }}
snd_hda_codec_hdmi.blacklist=1 rd.driver.pre=vfio-pci audit=off
win_partition: "/dev/nvme0n1p1"
ai_partition: "/dev/nvme0n1p2"
partitions:
- { dev: "/dev/nvme0n1p1", label: "win-nvme" }
- { dev: "/dev/nvme0n1p2", label: "ai-nvme" }
default_hugepagesz=1G hugepagesz=1G hugepages=8 mitigations=off loglevel=3 {{ virt_extra_grub_args | default("") | trim}}
tasks:
- name: Install virtualization packages
- name: Install required packages
ansible.builtin.dnf:
name:
- qemu-kvm
@@ -38,6 +19,9 @@
- virt-manager
- bridge-utils
- pciutils
- tuned
- python3-lxml
- python3-libvirt
state: present
- name: Enable and start libvirtd
@@ -52,24 +36,22 @@
regexp: '^GRUB_CMDLINE_LINUX='
line: 'GRUB_CMDLINE_LINUX="{{ grub_cmdline_args | trim }}"'
backrefs: true
notify: Rebuild GRUB config
- name: Add VFIO PCI device IDs to modprobe
ansible.builtin.copy:
dest: /etc/modprobe.d/vfio.conf
content: |
options vfio-pci ids={{ vfio_ids | join(',') }}
options vfio-pci ids={{ virt_vfio_ids | join(',') }}
install snd_hda_codec_hdmi /bin/false
mode: '0644'
- name: Blacklist Nouveau and other drivers
ansible.builtin.copy:
ansible.builtin.template:
src: blacklist.conf.j2
dest: /etc/modprobe.d/ansible-blacklist.conf
content: |
blacklist noveau
blacklist snd_hda_codec_hdmi
blacklist i2c_nvidia_gpu
blacklist mxm_wmi
mode: '0644'
when: virt_blacklist is defined
- name: Add vfio modules to initramfs config
ansible.builtin.copy:
@@ -77,15 +59,14 @@
content: |
add_drivers+=" vfio vfio_iommu_type1 vfio_pci "
mode: '0644'
notify: Rebuild initramfs
- name: Rebuild initramfs
changed_when: false
ansible.builtin.command: dracut -f
- name: Rebuild GRUB config
changed_when: false
ansible.builtin.command: grub2-mkconfig -o /boot/grub2/grub.cfg
when: ansible_facts['distribution'] == "Fedora"
- name: Configure hugepages
ansible.posix.sysctl:
name: vm.nr_hugepages
value: "{{ hugepages_count | default('2048') }}"
state: present
reload: true
- name: Enable KVM modules at boot
ansible.builtin.copy:
@@ -98,40 +79,62 @@
vfio_iommu_type1
mode: '0644'
- name: Set I/O scheduler to 'none' for NVMes
ansible.builtin.copy:
dest: /etc/udev/rules.d/60-ioscheduler.rules
content: |
ACTION=="add|change", KERNEL=="nvme[0-9]*", ATTR{queue/scheduler}="none"
mode: '0644'
notify:
- Reload udev rules
- Trigger udev to apply changes
- name: Activate virtual-host tuned profile
ansible.builtin.command: tuned-adm profile virtual-host
changed_when: false
- name: Set permissions for partition passthrough
ansible.builtin.file:
path: "/dev/{{ item }}"
owner: qemu
group: kvm
mode: '0660'
loop: "{{ virt_raw_block_devices }}"
- name: Create udev rules for persistent access
ansible.builtin.template:
src: 99-qemu-nvme.rules.j2
dest: /etc/udev/rules.d/99-qemu-nvme.rules
mode: '0644'
notify:
- Reload udev rules
- Trigger udev to apply changes
- name: Create or update virtual machine
vars:
vm: "{{ item }}"
loop: "{{ virt_machines }}"
community.libvirt.virt:
autostart: "{{ vm.autostart | default(false) }}"
name: "{{ vm.name }}"
state: running
command: define
xml: "{{ lookup('template', 'domain.xml.j2') }}"
- name: Ensure virtual machines are running
vars:
vm: "{{ item }}"
loop: "{{ virt_machines }}"
community.libvirt.virt:
name: "{{ vm.name }}"
state: running
- name: Notify user to reboot for changes
ansible.builtin.debug:
msg: |
Reboot your system to apply IOMMU, CPU isolation, and VFIO settings.
After reboot, verify using: `dmesg | grep -i vfio` and `lspci -nnk`
- name: Ensure partitions are unmounted
ansible.posix.mount:
path: "/mnt/{{ item.label }}"
src: "{{ item.dev }}"
state: absent
fstype: auto
loop: "{{ partitions }}"
- name: Set permissions for partition passthrough
ansible.builtin.file:
path: "{{ item.dev }}"
owner: qemu
group: kvm
mode: '0660'
loop: "{{ partitions }}"
- name: Create udev rules for persistent access
ansible.builtin.copy:
dest: /etc/udev/rules.d/99-qemu-nvme.rules
content: |
KERNEL=="nvme0n1", OWNER="qemu", GROUP="kvm", MODE="0660"
KERNEL=="nvme0n1p1", OWNER="qemu", GROUP="kvm", MODE="0660"
KERNEL=="nvme0n1p2", OWNER="qemu", GROUP="kvm", MODE="0660"
mode: '0644'
notify:
- Reload udev rules
- Trigger udev to apply changes
handlers:
- name: Reload udev rules
changed_when: false
@@ -140,3 +143,12 @@
- name: Trigger udev to apply changes
changed_when: false
ansible.builtin.command: udevadm trigger
- name: Rebuild initramfs
changed_when: false
ansible.builtin.command: dracut -f
- name: Rebuild GRUB config
changed_when: false
ansible.builtin.command: grub2-mkconfig -o /boot/grub2/grub.cfg
when: ansible_facts['distribution'] == "Fedora"
ansible/requirements.yml
+2
View File
@@ -2,3 +2,5 @@
collections:
- ansible.posix
- community.general
- containers.podman
- community.libvirt
ansible/roles/cis/tasks/ctrlaltdel.yml
+13 -2
View File
@@ -12,7 +12,18 @@
- CCE-80785-9
- systemd
- name: Disable systemd ctrl-alt-del - RedHat family
- name: Remove existing symlink for ctrl-alt-del.target if it exists
become: true
ansible.builtin.file:
path: /etc/systemd/system/ctrl-alt-del.target
state: absent
when: ansible_os_family == "RedHat"
tags:
- ctrl-alt-del
- CCE-80785-9
- systemd
- name: Mask ctrl-alt-del.target to disable Ctrl+Alt+Del
become: true
ansible.builtin.systemd:
name: ctrl-alt-del.target
@@ -25,4 +36,4 @@
- ctrl-alt-del
- CCE-80785-9
- systemd
...
ansible/roles/cis/tasks/users.yml
+10 -6
View File
@@ -5,13 +5,17 @@
name: "{{ item }}"
state: absent
remove: true
loop: "{{ delete_users }}"
register: remove_users
with_items:
- "{{ delete_users }}"
failed_when: >
remove_users is not success and
not ("not removing" in remove_users.msg or
"not found" in remove_users.msg)
ignore_errors: true
tags:
- users
- name: Show warning for users that could not be removed
debug:
msg: "Could not remove user '{{ item.item }}'. Error: {{ item.msg | default('unknown error') }}"
loop: "{{ remove_users.results | selectattr('failed', 'equalto', true) | list }}"
when: remove_users is defined
tags:
- users
ansible/roles/duo/tasks/main.yml
+3 -3
View File
@@ -47,9 +47,9 @@
- name: Add Duo Source (RedHat)
become: true
ansible.builtin.yum_repository:
name: Duo Security
name: duo-security
description: Duo Security Repository
baseurl: https://pkg.duosecurity.com/RHEL/$releasever/$basearch
baseurl: https://pkg.duosecurity.com/Fedora/$releasever/$basearch
gpgcheck: true
gpgkey: https://duo.com/DUO-GPG-PUBLIC-KEY.asc
enabled: true
@@ -57,7 +57,7 @@
- name: Install Duo Unix Application Integration
become: true
ansible.builtin.dnf:
name: duo-unix
name: duo_unix
state: present
- name: Install Duo config
ansible/roles/login/tasks/main.yml
+5 -2
View File
@@ -11,17 +11,20 @@
password: "{{ lookup('env', 'USER_PASSWORD_' + (item.username | upper)) | password_hash('sha512', user_password_salt) }}"
state: "{{ 'absent' if item.enabled is defined and not item.enabled else 'present' }}"
shell: "{{ item.shell if item.shell is defined else '/bin/bash' }}"
groups: "{{ item.groups | default(omit) }}"
uid: "{{ item.uid | default(omit) }}"
loop: "{{ login_users }}"
- name: Disable password expiration
ansible.builtin.command: chage -M -1 "{{ item.username }}"
become: yes
become: true
when: item.password_expiration is defined and not item.password_expiration
loop: "{{ login_users }}"
- name: Disable password login
ansible.builtin.command: passwd -d "{{ item.username }}"
become: yes
become: true
when: item.password_disabled is defined and item.password_disabled
loop: "{{ login_users }}"
ansible/templates/99-qemu-nvme.rules.j2
+3
View File
@@ -0,0 +1,3 @@
{% for dev in virt_raw_block_devices %}
KERNEL=="{{ dev }}", OWNER="qemu", GROUP="kvm", MODE="0660"
{% endfor %}
ansible/templates/blacklist.conf.j2
+3
View File
@@ -0,0 +1,3 @@
{% for driver in virt_blacklist %}
blacklist {{ driver }}
{% endfor %}
ansible/templates/domain.xml.j2
+255
View File
@@ -0,0 +1,255 @@
<domain type='kvm'>
<name>{{ vm.name }}</name>
<uuid>{{ vm.uuid }}</uuid>
<title>{{ vm.title }}</title>
<memory unit='KiB'>{{ vm.memory }}</memory>
<currentMemory unit='KiB'>{{ vm.memory }}</currentMemory>
<memoryBacking>
<hugepages/>
<source type='memfd'/>
<access mode='shared'/>
</memoryBacking>
<vcpu placement='static'>{{ vm.cores * vm.threads }}</vcpu>
<cputune>
{% set pairs = vm.physical_cpus.split(',') %}
{% set ns = namespace(vcpu=0) %}
{% for pair in pairs %}
{% set parts = pair.split('-') %}
<vcpupin vcpu='{{ ns.vcpu }}' cpuset='{{ parts[0] }}'/>
{% set ns.vcpu = ns.vcpu + 1 %}
<vcpupin vcpu='{{ ns.vcpu }}' cpuset='{{ parts[1] }}'/>
{% set ns.vcpu = ns.vcpu + 1 %}
{% endfor %}
<emulatorpin cpuset='{{ vm.reserved_cpus }}'/>
</cputune>
<os>
<type arch='x86_64' machine='pc-q35-7.0'>hvm</type>
<loader readonly='yes' secure='{% if vm.secure_boot %}yes{% else %}no{% endif %}' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE{% if vm.secure_boot %}.secboot{% endif %}.fd</loader>
<nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/{{ vm.name }}_VARS.fd</nvram>
<boot dev='hd'/>
<bootmenu enable='no'/>
</os>
<features>
<acpi/>
<apic/>
{% if vm.enable_hyperv is defined %}
{% if vm.enable_hyperv | default(false) %}
<hyperv mode='custom'>
<relaxed state='on'/>
<vapic state='on'/>
<spinlocks state='on' retries='8191'/>
<vendor_id state='on' value='{{ vm.hyperv_vendor_id | default("whatever") }}'/>
</hyperv>
{% endif %}
{% endif %}
<smm state='on'/>
</features>
<cpu mode='host-passthrough' check='none' migratable='on'>
<topology sockets='1' dies='1' cores='{{ vm.cores }}' threads='{{ vm.threads }}'/>
</cpu>
<clock offset='localtime'>
<timer name='rtc' tickpolicy='catchup'/>
<timer name='pit' tickpolicy='delay'/>
<timer name='hpet' present='no'/>
<timer name='kvmclock' present='yes'/>
{% if vm.enable_hyperv is defined %}
{% if vm.enable_hyperv | default(false) %}
<timer name='hypervclock' present='yes'/>
{% endif %}
{% endif %}
</clock>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>destroy</on_crash>
<pm>
<suspend-to-mem enabled='no'/>
<suspend-to-disk enabled='no'/>
</pm>
<devices>
<emulator>{{ vm.emulator | default("/usr/bin/qemu-system-x86_64") }}</emulator>
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2' cache='writeback'/>
<source file='/var/lib/libvirt/images/{{ vm.disk_file }}'/>
<backingStore />
<target dev='sda' bus='virtio'/>
<address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0' />
</disk>
{% for block_dev in vm.block_devs %}
<disk type='block' device='disk'>
<driver name='qemu' type='raw'/>
<source dev='{{ block_dev.block_dev }}'/>
<target dev='{{ block_dev.target_dev }}' bus='virtio'/>
</disk>
{% endfor %}
{% if vm.cdrom %}
<disk type='file' device='cdrom'>
<driver name='qemu' type='raw'/>
<target dev='hdc' bus='sata'/>
<readonly/>
<address type='drive' controller='0' bus='0' target='0' unit='2'/>
</disk>
{% endif %}
<controller type='usb' index='0' model='qemu-xhci' ports='15'>
<address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0' />
</controller>
<controller type='sata' index='0'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2' />
</controller>
<controller type='pci' index='0' model='pcie-root' />
<controller type='pci' index='1' model='pcie-root-port'>
<model name='pcie-root-port' />
<target chassis='1' port='0x8' />
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'
multifunction='on' />
</controller>
<controller type='pci' index='2' model='pcie-to-pci-bridge'>
<model name='pcie-pci-bridge' />
<address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0' />
</controller>
<controller type='pci' index='3' model='pcie-root-port'>
<model name='pcie-root-port' />
<target chassis='3' port='0x9' />
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1' />
</controller>
<controller type='pci' index='4' model='pcie-root-port'>
<model name='pcie-root-port' />
<target chassis='4' port='0xa' />
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2' />
</controller>
<controller type='pci' index='5' model='pcie-root-port'>
<model name='pcie-root-port' />
<target chassis='5' port='0xb' />
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x3' />
</controller>
<controller type='pci' index='6' model='pcie-root-port'>
<model name='pcie-root-port' />
<target chassis='6' port='0xc' />
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x4' />
</controller>
<controller type='pci' index='7' model='pcie-root-port'>
<model name='pcie-root-port' />
<target chassis='7' port='0xd' />
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x5' />
</controller>
<controller type='pci' index='8' model='pcie-root-port'>
<model name='pcie-root-port' />
<target chassis='8' port='0xe' />
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x6' />
</controller>
<controller type='pci' index='9' model='pcie-root-port'>
<model name='pcie-root-port' />
<target chassis='9' port='0xf' />
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x7' />
</controller>
<controller type='pci' index='10' model='pcie-root-port'>
<model name='pcie-root-port' />
<target chassis='10' port='0x10' />
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'
multifunction='on' />
</controller>
<controller type='pci' index='11' model='pcie-root-port'>
<model name='pcie-root-port' />
<target chassis='11' port='0x11' />
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1' />
</controller>
<controller type='pci' index='12' model='pcie-root-port'>
<model name='pcie-root-port' />
<target chassis='12' port='0x12' />
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2' />
</controller>
<controller type='pci' index='13' model='pcie-root-port'>
<model name='pcie-root-port' />
<target chassis='13' port='0x13' />
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3' />
</controller>
<controller type='pci' index='14' model='pcie-root-port'>
<model name='pcie-root-port' />
<target chassis='14' port='0x14' />
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4' />
</controller>
<controller type='pci' index='15' model='pcie-root-port'>
<model name='pcie-root-port' />
<target chassis='15' port='0x15' />
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5' />
</controller>
<controller type='pci' index='16' model='pcie-root-port'>
<model name='pcie-root-port' />
<target chassis='16' port='0x16' />
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6' />
</controller>
<controller type='virtio-serial' index='0'>
<address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0' />
</controller>
{% if vm.smartcard is defined %}
{% if vm.smartcard | default(false) %}
<controller type='ccid' index='0'>
<alias name='ccid0'/>
<address type='usb' bus='0' port='1'/>
</controller>
{% endif %}
{% endif %}
{% if vm.virtio_fs is defined %}
{% if vm.virtio_fs | default(false) %}
<filesystem type='mount' accessmode='passthrough'>
<driver type='virtiofs'/>
<source dir='{{ vm.virtio_fs.source }}'/>
<target dir='{{ vm.virtio_fs.target }}'/>
</filesystem>
{% endif %}
{% endif %}
<interface type='bridge'>
<mac address='{{ vm.mac_address }}'/>
<source bridge='{{ vm.net_bridge | default("bridge0") }}'/>
<model type='virtio'/>
<address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0' />
</interface>
{% if vm.tablet is defined %}
{% if vm.tablet | default(false) %}
<input type='tablet' bus='usb'/>
{% endif %}
{% endif %}
{% if vm.console %}
<serial type='pty'>
<target type='isa-serial' port='0'>
<model name='isa-serial'/>
</target>
</serial>
<console type='pty'>
<target type='serial' port='0'/>
</console>
{% endif %}
<input type='mouse' bus='ps2'/>
<input type='keyboard' bus='ps2'/>
{% if vm.tpm %}
<tpm model='tpm-tis'>
<backend type='emulator' version='2.0'/>
</tpm>
{% endif %}
{% if vm.audio %}
<audio id='1' type='none'/>
{% endif %}
{% for dev in vm.host_devs %}
{% if dev.type == 'mdev' %}
<hostdev mode='subsystem' type='mdev' managed='no' model='{{ dev.model | default('vfio-pci') }}' display='{{ dev.display | default('off') }}'>
<source>
<address uuid='{{ dev.source.uuid }}'/>
</source>
{% elif dev.type == 'pci' %}
<hostdev mode='subsystem' type='pci' managed='yes'>
<source>
<address domain='{{ dev.source.address.domain }}' bus='{{ dev.source.address.bus }}'
slot='{{ dev.source.address.slot }}' function='{{ dev.source.address.function }}'/>
</source>
{% endif %}
{% if dev.address is defined %}
<address {% for key, value in dev.address.items() %}
{{ key }}='{{ value }}'{% if not loop.last %} {% endif %}
{% endfor %}/>
{% endif %}
</hostdev>
{% endfor %}
<memballoon model='virtio'>
<address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
</memballoon>
</devices>
</domain>
inventory/hosts
+10
View File
@@ -5,6 +5,7 @@ dev-01.alexpires.dev
[hardening]
prod-01.alexpires.me
dev-01.alexpires.dev
vh-01.alexpires.dev
[ubuntu]
prod-01.alexpires.me
@@ -15,6 +16,7 @@ prod-01.alexpires.me
[private]
dev-01.alexpires.dev
vh-01.alexpires.dev
[gitea]
prod-01.alexpires.me
@@ -48,3 +50,11 @@ prod-01.alexpires.me
[trivy]
prod-01.alexpires.me
[virtualization]
vh-01.alexpires.dev
[2fa]
prod-01.alexpires.me
dev-01.alexpires.dev
vh-01.alexpires.dev
scripts/cpu_power_monitor.py
+22 -17
View File
@@ -1,33 +1,38 @@
import time
import os
RAPL_PATH = "/sys/class/powercap/intel-rapl:0/energy_uj"
RAPL_PATH = "/sys/class/powercap/intel-rapl:0/energy_uj"
INTERVAL_SEC = 1.0 # configurable via command-line argument or env var
def read_energy():
def read_energy(path):
try:
with open(RAPL_PATH, "r") as f:
with open(path, "r") as f:
return int(f.read().strip())
except FileNotFoundError:
print(f"Error: {RAPL_PATH} not found.")
exit(1)
raise RuntimeError(f"RAPL support not available: {path}")
def calculate_power(interval=1.0):
print(f"Monitoring CPU package power every {interval} second(s)... (Ctrl+C to stop)")
while True:
energy_before = read_energy()
time.sleep(interval)
energy_after = read_energy()
delta_uj = energy_after - energy_before
power_watts = (delta_uj / 1_000_000) / interval
print(f"Power Usage: {power_watts:.2f} Watts")
def calculate_power(energy_before, energy_after, interval_sec):
delta_uj = energy_after - energy_before
power_watts = (delta_uj / 1_000_000) / interval_sec
return f"{power_watts:.2f} Watts"
if __name__ == "__main__":
if os.geteuid() != 0:
print("Please run this script as root.")
exit(1)
try:
calculate_power(interval=1.0)
# RAPL support check
with open(RAPL_PATH, "r") as f:
_ = int(f.read().strip())
while True:
energy_before = read_energy(RAPL_PATH)
time.sleep(INTERVAL_SEC)
energy_after = read_energy(RAPL_PATH)
power_reading = calculate_power(energy_before, energy_after, INTERVAL_SEC)
print(f"Power Usage: {power_reading}")
except KeyboardInterrupt:
print("\nStopped.")