From b6926273175daf9cbdfbe30a43c0f2aa9670c7c0 Mon Sep 17 00:00:00 2001
From: Alexandre Pires <c.alexandre.pires@gmail.com>
Date: Sat, 31 May 2025 00:28:04 +0200
Subject: [PATCH] Add configuration and playbook for virtualization host setup

- Create host variable file for vh-01.alexpires.dev with user, SSH, firewall, and VM configurations.
- Update playbook_duo_security.yml to target the 2fa group.
- Introduce playbook_virt_host.yml for setting up GPU passthrough on Fedora with QEMU/KVM.
- Add required collections to requirements.yml for Podman and Libvirt.
- Modify ctrlaltdel.yml to remove existing symlink for ctrl-alt-del.target before masking it.
- Enhance users.yml to show warnings for users that could not be removed.
- Update Duo Security role to use the correct repository and package names.
- Improve login role to handle user UID and group assignments.
- Create udev rules template for NVMe devices.
- Add blacklist template for VFIO drivers.
- Implement domain XML template for virtual machines with detailed configurations.
- Update inventory to include vh-01.alexpires.dev in relevant groups.
- Refactor cpu_power_monitor.py for improved error handling and modularity.
---
 ansible/files/vms/fedora-headless.xml         | 199 ------------
 ansible/files/vms/old/fedora-headless.old.xml | 220 -------------
 ansible/files/vms/old/windows-11-pro.old.xml  | 300 ------------------
 ansible/files/vms/windows-11.xml              | 224 -------------
 ansible/host_vars/vh-01.alexpires.dev.yml     | 189 +++++++++++
 ansible/playbook_duo_security.yml             |   2 +-
 ...ook_vm_host.yml => playbook_virt_host.yml} | 144 +++++----
 ansible/requirements.yml                      |   2 +
 ansible/roles/cis/tasks/ctrlaltdel.yml        |  15 +-
 ansible/roles/cis/tasks/users.yml             |  16 +-
 ansible/roles/duo/tasks/main.yml              |   6 +-
 ansible/roles/login/tasks/main.yml            |   7 +-
 ansible/templates/99-qemu-nvme.rules.j2       |   3 +
 ansible/templates/blacklist.conf.j2           |   3 +
 ansible/templates/domain.xml.j2               | 255 +++++++++++++++
 inventory/hosts                               |  10 +
 scripts/cpu_power_monitor.py                  |  39 ++-
 17 files changed, 594 insertions(+), 1040 deletions(-)
 delete mode 100644 ansible/files/vms/fedora-headless.xml
 delete mode 100644 ansible/files/vms/old/fedora-headless.old.xml
 delete mode 100644 ansible/files/vms/old/windows-11-pro.old.xml
 delete mode 100644 ansible/files/vms/windows-11.xml
 create mode 100644 ansible/host_vars/vh-01.alexpires.dev.yml
 rename ansible/{localhost_playbook_vm_host.yml => playbook_virt_host.yml} (60%)
 create mode 100644 ansible/templates/99-qemu-nvme.rules.j2
 create mode 100644 ansible/templates/blacklist.conf.j2
 create mode 100644 ansible/templates/domain.xml.j2

diff --git a/ansible/files/vms/fedora-headless.xml b/ansible/files/vms/fedora-headless.xml
deleted file mode 100644
index c6449ac..0000000
--- a/ansible/files/vms/fedora-headless.xml
+++ /dev/null
@@ -1,199 +0,0 @@
-<domain type='kvm'>
-  <name>fedora-headless</name>
-  <uuid>55feda16-51ae-446e-9c83-4c0eee1e5e00</uuid>
-  <title>Fedora CUDA headless</title>
-  <memory unit='KiB'>33554432</memory>
-  <currentMemory unit='KiB'>33554432</currentMemory>
-  <memoryBacking>
-    <hugepages/>
-    <source type='memfd'/>
-    <access mode='shared'/>
-  </memoryBacking>
-  <vcpu placement='static'>2</vcpu>
-  <cputune>
-    <vcpupin vcpu='0' cpuset='1'/>
-    <vcpupin vcpu='1' cpuset='7'/>
-    <emulatorpin cpuset='0,6'/>
-  </cputune>
-  <os>
-    <type arch='x86_64' machine='pc-q35-7.0'>hvm</type>
-    <loader readonly='yes' secure='no' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.fd</loader>
-    <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/fedora-headless_VARS.fd</nvram>
-    <boot dev='hd'/>
-    <bootmenu enable='no'/>
-  </os>
-  <features>
-    <acpi/>
-    <apic/>
-    <smm state='on'/>
-  </features>
-  <cpu mode='host-passthrough' check='none' migratable='on'>
-    <topology sockets='1' dies='1' cores='1' threads='2'/>
-  </cpu>
-  <clock offset='localtime'>
-    <timer name='rtc' tickpolicy='catchup'/>
-    <timer name='pit' tickpolicy='delay'/>
-    <timer name='hpet' present='no'/>
-    <timer name='kvmclock' present='yes'/>
-  </clock>
-  <on_poweroff>destroy</on_poweroff>
-  <on_reboot>restart</on_reboot>
-  <on_crash>destroy</on_crash>
-  <pm>
-    <suspend-to-mem enabled='no'/>
-    <suspend-to-disk enabled='no'/>
-  </pm>
-  <devices>
-    <emulator>/usr/bin/qemu-system-x86_64</emulator>
-    <disk type='file' device='disk'>
-      <driver name='qemu' type='qcow2' cache='writeback'/>
-      <source file='/var/lib/libvirt/images/fedora-headless.snap-2025-05-27'/>
-      <backingStore type='file'>
-        <format type='qcow2'/>
-        <source file='/var/lib/libvirt/images/fedora-headless.qcow2'/>
-        <backingStore/>
-      </backingStore>
-      <target dev='sda' bus='virtio'/>
-      <address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
-    </disk>
-    <disk type='block' device='disk'>
-      <driver name='qemu' type='raw'/>
-      <source dev='/dev/nvme0n1'/>
-      <target dev='sdb' bus='virtio'/>
-    </disk>    
-    <controller type='usb' index='0' model='qemu-xhci' ports='15'>
-      <address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
-    </controller>
-    <controller type='sata' index='0'>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
-    </controller>
-    <controller type='pci' index='0' model='pcie-root'/>
-    <controller type='pci' index='1' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='1' port='0x8'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0' multifunction='on'/>
-    </controller>
-    <controller type='pci' index='2' model='pcie-to-pci-bridge'>
-      <model name='pcie-pci-bridge'/>
-      <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
-    </controller>
-    <controller type='pci' index='3' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='3' port='0x9'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/>
-    </controller>
-    <controller type='pci' index='4' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='4' port='0xa'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
-    </controller>
-    <controller type='pci' index='5' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='5' port='0xb'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x3'/>
-    </controller>
-    <controller type='pci' index='6' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='6' port='0xc'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x4'/>
-    </controller>
-    <controller type='pci' index='7' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='7' port='0xd'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x5'/>
-    </controller>
-    <controller type='pci' index='8' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='8' port='0xe'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x6'/>
-    </controller>
-    <controller type='pci' index='9' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='9' port='0xf'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x7'/>
-    </controller>
-    <controller type='pci' index='10' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='10' port='0x10'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/>
-    </controller>
-    <controller type='pci' index='11' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='11' port='0x11'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/>
-    </controller>
-    <controller type='pci' index='12' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='12' port='0x12'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2'/>
-    </controller>
-    <controller type='pci' index='13' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='13' port='0x13'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3'/>
-    </controller>
-    <controller type='pci' index='14' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='14' port='0x14'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4'/>
-    </controller>
-    <controller type='pci' index='15' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='15' port='0x15'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5'/>
-    </controller>
-    <controller type='pci' index='16' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='16' port='0x16'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6'/>
-    </controller>
-    <controller type='virtio-serial' index='0'>
-      <address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/>
-    </controller>
-    <controller type='ccid' index='0'>
-      <address type='usb' bus='0' port='1'/>
-    </controller>
-    <filesystem type='mount' accessmode='passthrough'>
-      <driver type='virtiofs'/>
-      <source dir='/media'/>
-      <target dir='Media'/>
-      <address type='pci' domain='0x0000' bus='0x08' slot='0x00' function='0x0'/>
-    </filesystem>
-    <interface type='bridge'>
-      <mac address='52:54:00:ae:f3:d0'/>
-      <source bridge='bridge0'/>
-      <model type='virtio'/>
-      <address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
-    </interface>
-    <serial type='pty'>
-      <target type='isa-serial' port='0'>
-        <model name='isa-serial'/>
-      </target>
-    </serial>
-    <console type='pty'>
-      <target type='serial' port='0'/>
-    </console>
-    <input type='mouse' bus='ps2'/>
-    <input type='keyboard' bus='ps2'/>
-    <tpm model='tpm-tis'>
-      <backend type='emulator' version='2.0'/>
-    </tpm>
-    <audio id='1' type='none'/>
-    <hostdev mode='subsystem' type='pci' managed='yes'>
-      <source>
-        <address domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
-      </source>
-      <address type='pci' domain='0x0000' bus='0x09' slot='0x00' function='0x0'/>
-    </hostdev>
-    <hostdev mode='subsystem' type='pci' managed='yes'>
-      <source>
-        <address domain='0x0000' bus='0x03' slot='0x00' function='0x1'/>
-      </source>
-      <address type='pci' domain='0x0000' bus='0x0a' slot='0x00' function='0x0'/>
-    </hostdev>
-    <memballoon model='virtio'>
-      <address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
-    </memballoon>
-  </devices>
-</domain>
-
diff --git a/ansible/files/vms/old/fedora-headless.old.xml b/ansible/files/vms/old/fedora-headless.old.xml
deleted file mode 100644
index a346373..0000000
--- a/ansible/files/vms/old/fedora-headless.old.xml
+++ /dev/null
@@ -1,220 +0,0 @@
-<domain type='kvm'>
-  <name>fedora-headless</name>
-  <uuid>55feda16-51ae-446e-9c83-4c0eee1e5e00</uuid>
-  <title>Fedora CUDA headless</title>
-  <memory unit='KiB'>33554432</memory>
-  <currentMemory unit='KiB'>33554432</currentMemory>
-  <memoryBacking>
-    <hugepages/>
-    <source type='memfd'/>
-    <access mode='shared'/>
-  </memoryBacking>
-  <vcpu placement='static'>10</vcpu>
-  <cputune>
-    <vcpupin vcpu='0' cpuset='1'/>
-    <vcpupin vcpu='1' cpuset='7'/>
-    <vcpupin vcpu='2' cpuset='2'/>
-    <vcpupin vcpu='3' cpuset='8'/>
-    <vcpupin vcpu='4' cpuset='3'/>
-    <vcpupin vcpu='5' cpuset='9'/>
-    <vcpupin vcpu='6' cpuset='4'/>
-    <vcpupin vcpu='7' cpuset='10'/>
-    <vcpupin vcpu='8' cpuset='5'/>
-    <vcpupin vcpu='9' cpuset='11'/>
-    <emulatorpin cpuset='0,6'/>
-  </cputune>
-  <os>
-    <type arch='x86_64' machine='pc-q35-7.0'>hvm</type>
-    <loader readonly='yes' secure='no' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.fd</loader>
-    <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/fedora-headless_VARS.fd</nvram>
-    <boot dev='hd'/>
-    <bootmenu enable='no'/>
-  </os>
-  <features>
-    <acpi/>
-    <apic/>
-    <smm state='on'/>
-  </features>
-  <cpu mode='host-passthrough' check='none' migratable='on'>
-    <topology sockets='1' dies='1' cores='5' threads='2'/>
-  </cpu>
-  <clock offset='localtime'>
-    <timer name='rtc' tickpolicy='catchup'/>
-    <timer name='pit' tickpolicy='delay'/>
-    <timer name='hpet' present='no'/>
-    <timer name='kvmclock' present='yes'/>
-  </clock>
-  <on_poweroff>destroy</on_poweroff>
-  <on_reboot>restart</on_reboot>
-  <on_crash>destroy</on_crash>
-  <pm>
-    <suspend-to-mem enabled='no'/>
-    <suspend-to-disk enabled='no'/>
-  </pm>
-  <devices>
-    <emulator>/usr/bin/qemu-system-x86_64</emulator>
-    <disk type='file' device='disk'>
-      <driver name='qemu' type='qcow2' cache='writeback'/>
-      <source file='/var/lib/libvirt/images/fedora-headless.snap-2025-05-27'/>
-      <backingStore type='file'>
-        <format type='qcow2'/>
-        <source file='/var/lib/libvirt/images/fedora-headless.qcow2'/>
-        <backingStore/>
-      </backingStore>
-      <target dev='sda' bus='virtio'/>
-      <address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
-    </disk>
-    <controller type='usb' index='0' model='qemu-xhci' ports='15'>
-      <address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
-    </controller>
-    <controller type='sata' index='0'>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
-    </controller>
-    <controller type='pci' index='0' model='pcie-root'/>
-    <controller type='pci' index='1' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='1' port='0x8'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0' multifunction='on'/>
-    </controller>
-    <controller type='pci' index='2' model='pcie-to-pci-bridge'>
-      <model name='pcie-pci-bridge'/>
-      <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
-    </controller>
-    <controller type='pci' index='3' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='3' port='0x9'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/>
-    </controller>
-    <controller type='pci' index='4' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='4' port='0xa'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
-    </controller>
-    <controller type='pci' index='5' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='5' port='0xb'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x3'/>
-    </controller>
-    <controller type='pci' index='6' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='6' port='0xc'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x4'/>
-    </controller>
-    <controller type='pci' index='7' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='7' port='0xd'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x5'/>
-    </controller>
-    <controller type='pci' index='8' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='8' port='0xe'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x6'/>
-    </controller>
-    <controller type='pci' index='9' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='9' port='0xf'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x7'/>
-    </controller>
-    <controller type='pci' index='10' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='10' port='0x10'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/>
-    </controller>
-    <controller type='pci' index='11' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='11' port='0x11'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/>
-    </controller>
-    <controller type='pci' index='12' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='12' port='0x12'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2'/>
-    </controller>
-    <controller type='pci' index='13' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='13' port='0x13'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3'/>
-    </controller>
-    <controller type='pci' index='14' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='14' port='0x14'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4'/>
-    </controller>
-    <controller type='pci' index='15' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='15' port='0x15'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5'/>
-    </controller>
-    <controller type='pci' index='16' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='16' port='0x16'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6'/>
-    </controller>
-    <controller type='virtio-serial' index='0'>
-      <address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/>
-    </controller>
-    <controller type='ccid' index='0'>
-      <address type='usb' bus='0' port='1'/>
-    </controller>
-    <filesystem type='mount' accessmode='passthrough'>
-      <driver type='virtiofs'/>
-      <source dir='/media'/>
-      <target dir='Media'/>
-      <address type='pci' domain='0x0000' bus='0x08' slot='0x00' function='0x0'/>
-    </filesystem>
-    <interface type='bridge'>
-      <mac address='52:54:00:ae:f3:d0'/>
-      <source bridge='bridge0'/>
-      <model type='virtio'/>
-      <address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
-    </interface>
-    <serial type='pty'>
-      <target type='isa-serial' port='0'>
-        <model name='isa-serial'/>
-      </target>
-    </serial>
-    <console type='pty'>
-      <target type='serial' port='0'/>
-    </console>
-    <input type='mouse' bus='ps2'/>
-    <input type='keyboard' bus='ps2'/>
-    <tpm model='tpm-tis'>
-      <backend type='emulator' version='2.0'/>
-    </tpm>
-    <audio id='1' type='none'/>
-    <hostdev mode='subsystem' type='pci' managed='yes'>
-      <source>
-        <address domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
-      </source>
-      <address type='pci' domain='0x0000' bus='0x09' slot='0x00' function='0x0'/>
-    </hostdev>
-    <hostdev mode='subsystem' type='pci' managed='yes'>
-      <source>
-        <address domain='0x0000' bus='0x03' slot='0x00' function='0x1'/>
-      </source>
-      <address type='pci' domain='0x0000' bus='0x0a' slot='0x00' function='0x0'/>
-    </hostdev>
-    <hostdev mode='subsystem' type='pci' managed='yes'>
-      <source>
-        <address domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
-      </source>
-      <address type='pci' domain='0x0000' bus='0x0c' slot='0x00' function='0x0'/>
-    </hostdev>
-    <hostdev mode='subsystem' type='pci' managed='yes'>
-      <source>
-        <address domain='0x0000' bus='0x01' slot='0x00' function='0x1'/>
-      </source>
-      <address type='pci' domain='0x0000' bus='0x0f' slot='0x00' function='0x0'/>
-    </hostdev>
-    <hostdev mode='subsystem' type='pci' managed='yes'>
-      <source>
-        <address domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
-      </source>
-      <address type='pci' domain='0x0000' bus='0x10' slot='0x00' function='0x0'/>
-    </hostdev>
-    <memballoon model='virtio'>
-      <address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
-    </memballoon>
-  </devices>
-</domain>
-
diff --git a/ansible/files/vms/old/windows-11-pro.old.xml b/ansible/files/vms/old/windows-11-pro.old.xml
deleted file mode 100644
index ad03378..0000000
--- a/ansible/files/vms/old/windows-11-pro.old.xml
+++ /dev/null
@@ -1,300 +0,0 @@
-<domain type='kvm' id='1'>
-  <name>windows-11</name>
-  <uuid>51d5d091-67cb-4113-bd8e-817e7317e1b4</uuid>
-  <title>Microsoft Windows 11</title>
-  <memory unit='KiB'>25165824</memory>
-  <currentMemory unit='KiB'>25165824</currentMemory>
-  <memoryBacking>
-    <hugepages/>
-    <source type='memfd'/>
-    <access mode='shared'/>
-  </memoryBacking>
-  <vcpu placement='static'>10</vcpu>
-  <cputune>
-    <vcpupin vcpu='0' cpuset='1'/>
-    <vcpupin vcpu='1' cpuset='7'/>
-    <vcpupin vcpu='2' cpuset='2'/>
-    <vcpupin vcpu='3' cpuset='8'/>
-    <vcpupin vcpu='4' cpuset='3'/>
-    <vcpupin vcpu='5' cpuset='9'/>
-    <vcpupin vcpu='6' cpuset='4'/>
-    <vcpupin vcpu='7' cpuset='10'/>
-    <vcpupin vcpu='8' cpuset='5'/>
-    <vcpupin vcpu='9' cpuset='11'/>
-    <emulatorpin cpuset='0,6'/>
-  </cputune>
-  <resource>
-    <partition>/machine</partition>
-  </resource>
-  <os>
-    <type arch='x86_64' machine='pc-q35-7.0'>hvm</type>
-    <loader readonly='yes' secure='yes' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader>
-    <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/windows-11_VARS.fd</nvram>
-    <boot dev='hd'/>
-    <bootmenu enable='no'/>
-  </os>
-  <features>
-    <acpi/>
-    <apic/>
-    <hyperv mode='custom'>
-      <relaxed state='on'/>
-      <vapic state='on'/>
-      <spinlocks state='on' retries='8191'/>
-      <vendor_id state='on' value='whatever'/>
-    </hyperv>
-    <kvm>
-      <hidden state='on'/>
-    </kvm>
-    <smm state='on'/>
-  </features>
-  <cpu mode='host-passthrough' check='none' migratable='on'>
-    <topology sockets='1' dies='1' cores='5' threads='2'/>
-  </cpu>
-  <clock offset='localtime'>
-    <timer name='rtc' tickpolicy='catchup'/>
-    <timer name='pit' tickpolicy='delay'/>
-    <timer name='hpet' present='no'/>
-    <timer name='kvmclock' present='yes'/>
-    <timer name='hypervclock' present='yes'/>
-  </clock>
-  <on_poweroff>destroy</on_poweroff>
-  <on_reboot>restart</on_reboot>
-  <on_crash>destroy</on_crash>
-  <pm>
-    <suspend-to-mem enabled='no'/>
-    <suspend-to-disk enabled='no'/>
-  </pm>
-  <devices>
-    <emulator>/usr/bin/qemu-system-x86_64</emulator>
-    <disk type='file' device='disk'>
-      <driver name='qemu' type='qcow2' cache='writeback'/>
-      <source file='/var/lib/libvirt/images/windows-11.qcow2' index='2'/>
-      <backingStore/>
-      <target dev='sda' bus='virtio'/>
-      <alias name='virtio-disk0'/>
-      <address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
-    </disk>
-    <disk type='file' device='cdrom'>
-      <driver name='qemu'/>
-      <target dev='hdc' bus='sata'/>
-      <readonly/>
-      <alias name='sata0-0-2'/>
-      <address type='drive' controller='0' bus='0' target='0' unit='2'/>
-    </disk>
-    <controller type='usb' index='0' model='qemu-xhci' ports='15'>
-      <alias name='usb'/>
-      <address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
-    </controller>
-    <controller type='sata' index='0'>
-      <alias name='ide'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
-    </controller>
-    <controller type='pci' index='0' model='pcie-root'>
-      <alias name='pcie.0'/>
-    </controller>
-    <controller type='pci' index='1' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='1' port='0x8'/>
-      <alias name='pci.1'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0' multifunction='on'/>
-    </controller>
-    <controller type='pci' index='2' model='pcie-to-pci-bridge'>
-      <model name='pcie-pci-bridge'/>
-      <alias name='pci.2'/>
-      <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
-    </controller>
-    <controller type='pci' index='3' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='3' port='0x9'/>
-      <alias name='pci.3'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/>
-    </controller>
-    <controller type='pci' index='4' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='4' port='0xa'/>
-      <alias name='pci.4'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
-    </controller>
-    <controller type='pci' index='5' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='5' port='0xb'/>
-      <alias name='pci.5'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x3'/>
-    </controller>
-    <controller type='pci' index='6' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='6' port='0xc'/>
-      <alias name='pci.6'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x4'/>
-    </controller>
-    <controller type='pci' index='7' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='7' port='0xd'/>
-      <alias name='pci.7'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x5'/>
-    </controller>
-    <controller type='pci' index='8' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='8' port='0xe'/>
-      <alias name='pci.8'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x6'/>
-    </controller>
-    <controller type='pci' index='9' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='9' port='0xf'/>
-      <alias name='pci.9'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x7'/>
-    </controller>
-    <controller type='pci' index='10' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='10' port='0x10'/>
-      <alias name='pci.10'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/>
-    </controller>
-    <controller type='pci' index='11' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='11' port='0x11'/>
-      <alias name='pci.11'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/>
-    </controller>
-    <controller type='pci' index='12' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='12' port='0x12'/>
-      <alias name='pci.12'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2'/>
-    </controller>
-    <controller type='pci' index='13' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='13' port='0x13'/>
-      <alias name='pci.13'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3'/>
-    </controller>
-    <controller type='pci' index='14' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='14' port='0x14'/>
-      <alias name='pci.14'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4'/>
-    </controller>
-    <controller type='pci' index='15' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='15' port='0x15'/>
-      <alias name='pci.15'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5'/>
-    </controller>
-    <controller type='pci' index='16' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='16' port='0x16'/>
-      <alias name='pci.16'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6'/>
-    </controller>
-    <controller type='virtio-serial' index='0'>
-      <alias name='virtio-serial0'/>
-      <address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/>
-    </controller>
-    <controller type='ccid' index='0'>
-      <alias name='ccid0'/>
-      <address type='usb' bus='0' port='1'/>
-    </controller>
-    <filesystem type='mount' accessmode='passthrough'>
-      <driver type='virtiofs'/>
-      <binary path='/usr/libexec/virtiofsd'/>
-      <source dir='/media'/>
-      <target dir='Media'/>
-      <alias name='fs0'/>
-      <address type='pci' domain='0x0000' bus='0x08' slot='0x00' function='0x0'/>
-    </filesystem>
-    <interface type='bridge'>
-      <mac address='52:54:00:cd:dd:2d'/>
-      <source bridge='bridge0'/>
-      <target dev='vnet0'/>
-      <model type='virtio'/>
-      <alias name='net0'/>
-      <address type='pci' domain='0x0000' bus='0x0e' slot='0x00' function='0x0'/>
-    </interface>
-    <input type='tablet' bus='usb'>
-      <alias name='input0'/>
-      <address type='usb' bus='0' port='2'/>
-    </input>
-    <input type='mouse' bus='ps2'>
-      <alias name='input1'/>
-    </input>
-    <input type='keyboard' bus='ps2'>
-      <alias name='input2'/>
-    </input>
-    <tpm model='tpm-tis'>
-      <backend type='emulator' version='2.0'/>
-      <alias name='tpm0'/>
-    </tpm>
-    <audio id='1' type='none'/>
-    <hostdev mode='subsystem' type='pci' managed='yes'>
-      <driver name='vfio'/>
-      <source>
-        <address domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
-      </source>
-      <alias name='hostdev0'/>
-      <address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
-    </hostdev>
-    <hostdev mode='subsystem' type='pci' managed='yes'>
-      <driver name='vfio'/>
-      <source>
-        <address domain='0x0000' bus='0x03' slot='0x00' function='0x1'/>
-      </source>
-      <alias name='hostdev1'/>
-      <address type='pci' domain='0x0000' bus='0x09' slot='0x00' function='0x0'/>
-    </hostdev>
-    <hostdev mode='subsystem' type='pci' managed='yes'>
-      <driver name='vfio'/>
-      <source>
-        <address domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
-      </source>
-      <alias name='hostdev2'/>
-      <address type='pci' domain='0x0000' bus='0x10' slot='0x00' function='0x0'/>
-    </hostdev>
-    <hostdev mode='subsystem' type='pci' managed='yes'>
-      <driver name='vfio'/>
-      <source>
-        <address domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
-      </source>
-      <alias name='hostdev3'/>
-      <address type='pci' domain='0x0000' bus='0x0b' slot='0x00' function='0x0'/>
-    </hostdev>
-    <hostdev mode='subsystem' type='pci' managed='yes'>
-      <driver name='vfio'/>
-      <source>
-        <address domain='0x0000' bus='0x01' slot='0x00' function='0x1'/>
-      </source>
-      <alias name='hostdev4'/>
-      <address type='pci' domain='0x0000' bus='0x0f' slot='0x00' function='0x0'/>
-    </hostdev>
-    <hostdev mode='subsystem' type='usb' managed='yes'>
-      <source>
-        <vendor id='0x1462'/>
-        <product id='0x7c75'/>
-        <address bus='1' device='3'/>
-      </source>
-      <alias name='hostdev5'/>
-      <address type='usb' bus='0' port='3'/>
-    </hostdev>
-    <hostdev mode='subsystem' type='pci' managed='yes'>
-      <driver name='vfio'/>
-      <source>
-        <address domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
-      </source>
-      <alias name='hostdev6'/>
-      <address type='pci' domain='0x0000' bus='0x0c' slot='0x00' function='0x0'/>
-    </hostdev>
-    <memballoon model='virtio'>
-      <alias name='balloon0'/>
-      <address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
-    </memballoon>
-  </devices>
-  <seclabel type='dynamic' model='selinux' relabel='yes'>
-    <label>system_u:system_r:svirt_t:s0:c399,c880</label>
-    <imagelabel>system_u:object_r:svirt_image_t:s0:c399,c880</imagelabel>
-  </seclabel>
-  <seclabel type='dynamic' model='dac' relabel='yes'>
-    <label>+107:+107</label>
-    <imagelabel>+107:+107</imagelabel>
-  </seclabel>
-</domain>
-
diff --git a/ansible/files/vms/windows-11.xml b/ansible/files/vms/windows-11.xml
deleted file mode 100644
index 1948ad0..0000000
--- a/ansible/files/vms/windows-11.xml
+++ /dev/null
@@ -1,224 +0,0 @@
-<domain type='kvm'>
-  <name>windows-11</name>
-  <uuid>51d5d091-67cb-4113-bd8e-817e7317e1b4</uuid>
-  <title>Microsoft Windows 11</title>
-  <memory unit='KiB'>25165824</memory>
-  <currentMemory unit='KiB'>25165824</currentMemory>
-  <memoryBacking>
-    <hugepages/>
-    <source type='memfd'/>
-    <access mode='shared'/>
-  </memoryBacking>
-  <vcpu placement='static'>8</vcpu>
-  <cputune>
-    <vcpupin vcpu='0' cpuset='2'/>
-    <vcpupin vcpu='1' cpuset='8'/>
-    <vcpupin vcpu='2' cpuset='3'/>
-    <vcpupin vcpu='3' cpuset='9'/>
-    <vcpupin vcpu='4' cpuset='4'/>
-    <vcpupin vcpu='5' cpuset='10'/>
-    <vcpupin vcpu='6' cpuset='5'/>
-    <vcpupin vcpu='7' cpuset='11'/>
-    <emulatorpin cpuset='0,6'/>
-  </cputune>
-  <os>
-    <type arch='x86_64' machine='pc-q35-7.0'>hvm</type>
-    <loader readonly='yes' secure='yes' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader>
-    <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/windows-11_VARS.fd</nvram>
-    <boot dev='hd'/>
-    <bootmenu enable='no'/>
-  </os>
-  <features>
-    <acpi/>
-    <apic/>
-    <hyperv mode='custom'>
-      <relaxed state='on'/>
-      <vapic state='on'/>
-      <spinlocks state='on' retries='8191'/>
-      <vendor_id state='on' value='whatever'/>
-    </hyperv>
-    <kvm>
-      <hidden state='on'/>
-    </kvm>
-    <smm state='on'/>
-  </features>
-  <cpu mode='host-passthrough' check='none' migratable='on'>
-    <topology sockets='1' dies='1' cores='4' threads='2'/>
-  </cpu>
-  <clock offset='localtime'>
-    <timer name='rtc' tickpolicy='catchup'/>
-    <timer name='pit' tickpolicy='delay'/>
-    <timer name='hpet' present='no'/>
-    <timer name='kvmclock' present='yes'/>
-    <timer name='hypervclock' present='yes'/>
-  </clock>
-  <on_poweroff>destroy</on_poweroff>
-  <on_reboot>restart</on_reboot>
-  <on_crash>destroy</on_crash>
-  <pm>
-    <suspend-to-mem enabled='no'/>
-    <suspend-to-disk enabled='no'/>
-  </pm>
-  <devices>
-    <emulator>/usr/bin/qemu-system-x86_64</emulator>
-    <disk type='file' device='disk'>
-      <driver name='qemu' type='qcow2' cache='writeback'/>
-      <source file='/var/lib/libvirt/images/windows-11.qcow2'/>
-      <backingStore/>
-      <target dev='sda' bus='virtio'/>
-      <address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
-    </disk>
-    <disk type='block' device='disk'>
-      <driver name='qemu' type='raw'/>
-      <source dev='/dev/nvme0n1'/>
-      <target dev='sdb' bus='virtio'/>
-    </disk>    
-    <disk type='file' device='cdrom'>
-      <driver name='qemu' type='raw'/>
-      <target dev='hdc' bus='sata'/>
-      <readonly/>
-      <address type='drive' controller='0' bus='0' target='0' unit='2'/>
-    </disk>
-    <controller type='usb' index='0' model='qemu-xhci' ports='15'>
-      <address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
-    </controller>
-    <controller type='sata' index='0'>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
-    </controller>
-    <controller type='pci' index='0' model='pcie-root'/>
-    <controller type='pci' index='1' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='1' port='0x8'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0' multifunction='on'/>
-    </controller>
-    <controller type='pci' index='2' model='pcie-to-pci-bridge'>
-      <model name='pcie-pci-bridge'/>
-      <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
-    </controller>
-    <controller type='pci' index='3' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='3' port='0x9'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/>
-    </controller>
-    <controller type='pci' index='4' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='4' port='0xa'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
-    </controller>
-    <controller type='pci' index='5' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='5' port='0xb'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x3'/>
-    </controller>
-    <controller type='pci' index='6' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='6' port='0xc'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x4'/>
-    </controller>
-    <controller type='pci' index='7' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='7' port='0xd'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x5'/>
-    </controller>
-    <controller type='pci' index='8' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='8' port='0xe'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x6'/>
-    </controller>
-    <controller type='pci' index='9' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='9' port='0xf'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x7'/>
-    </controller>
-    <controller type='pci' index='10' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='10' port='0x10'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/>
-    </controller>
-    <controller type='pci' index='11' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='11' port='0x11'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/>
-    </controller>
-    <controller type='pci' index='12' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='12' port='0x12'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2'/>
-    </controller>
-    <controller type='pci' index='13' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='13' port='0x13'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3'/>
-    </controller>
-    <controller type='pci' index='14' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='14' port='0x14'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4'/>
-    </controller>
-    <controller type='pci' index='15' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='15' port='0x15'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5'/>
-    </controller>
-    <controller type='pci' index='16' model='pcie-root-port'>
-      <model name='pcie-root-port'/>
-      <target chassis='16' port='0x16'/>
-      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6'/>
-    </controller>
-    <controller type='virtio-serial' index='0'>
-      <address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/>
-    </controller>
-    <controller type='ccid' index='0'>
-      <address type='usb' bus='0' port='1'/>
-    </controller>
-    <filesystem type='mount' accessmode='passthrough'>
-      <driver type='virtiofs'/>
-      <source dir='/media'/>
-      <target dir='Media'/>
-      <address type='pci' domain='0x0000' bus='0x08' slot='0x00' function='0x0'/>
-    </filesystem>
-    <interface type='bridge'>
-      <mac address='52:54:00:cd:dd:2d'/>
-      <source bridge='bridge0'/>
-      <model type='virtio'/>
-      <address type='pci' domain='0x0000' bus='0x0e' slot='0x00' function='0x0'/>
-    </interface>
-    <input type='tablet' bus='usb'>
-      <address type='usb' bus='0' port='2'/>
-    </input>
-    <input type='mouse' bus='ps2'/>
-    <input type='keyboard' bus='ps2'/>
-    <tpm model='tpm-tis'>
-      <backend type='emulator' version='2.0'/>
-    </tpm>
-    <audio id='1' type='none'/>
-    <hostdev mode='subsystem' type='mdev' managed='no' model='vfio-pci' display='off'>
-      <source>
-        <address uuid='5abeb24f-d6f4-4666-b495-303f15b05723'/>
-      </source>
-      <address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
-    </hostdev>    
-    <hostdev mode='subsystem' type='pci' managed='yes'>
-      <source>
-        <address domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
-      </source>
-      <address type='pci' domain='0x0000' bus='0x10' slot='0x00' function='0x0'/>
-    </hostdev>
-    <hostdev mode='subsystem' type='pci' managed='yes'>
-      <source>
-        <address domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
-      </source>
-      <address type='pci' domain='0x0000' bus='0x0b' slot='0x00' function='0x0'/>
-    </hostdev>
-    <hostdev mode='subsystem' type='pci' managed='yes'>
-      <source>
-        <address domain='0x0000' bus='0x01' slot='0x00' function='0x1'/>
-      </source>
-      <address type='pci' domain='0x0000' bus='0x0f' slot='0x00' function='0x0'/>
-    </hostdev>
-    <memballoon model='virtio'>
-      <address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
-    </memballoon>
-  </devices>
-</domain>
-
diff --git a/ansible/host_vars/vh-01.alexpires.dev.yml b/ansible/host_vars/vh-01.alexpires.dev.yml
new file mode 100644
index 0000000..e1909da
--- /dev/null
+++ b/ansible/host_vars/vh-01.alexpires.dev.yml
@@ -0,0 +1,189 @@
+hostname: vh-01.alexpires.local
+ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}"
+
+# Users
+login_users:
+  - username: "{{ ansible_user }}"
+    comment: "Managed by Ansible"
+    sudoer: true
+    sudoer_root_only: true
+    sudoer_no_password: true
+    pubkey: "{{ lookup('file', 'keys/ansible_user.pub') }}"
+    password_disabled: true
+  - username: operator
+    comment: "Managed by Ansible"
+    sudoer: true
+    pubkey: "{{ lookup('file', 'keys/operator.pub') }}"
+    shell: "/bin/zsh"
+    password_expiration: false
+
+# SSH Connection and security
+sshd_port: 22
+ssh_allowed_networks:
+  - "0.0.0.0/0"
+sshd_admin_net: "0.0.0.0/0"
+sshd_allow_groups: "{{ ansible_user }} users"
+sshd_permit_root_login: "no"
+sshd_password_authentication: "no"
+sshd_allow_tcp_forwarding: "yes"
+
+# Due to an issue increase the number of max auth tries
+sshd_max_auth_tries: 10
+
+# Firewall ports
+ufw_enable: true
+fw_allowed_ports:
+  - { rule: "allow", port: "22", proto: "tcp" }
+  - { rule: "allow", port: "9090", proto: "tcp" }
+
+ufw_outgoing_traffic:
+  - 22 # SSH
+  - 53 # DNS
+  - 80 # HTTP
+  - 123 # NTP
+  - 443 # HTTPS
+  - 853 # DNS over TLS
+
+ufw_default_forward_policy: "ACCEPT"
+
+ipv4_sysctl_settings:
+  net.ipv4.ip_forward: 1
+
+disable_ipv6: true
+
+# geoip will override hosts_allow and hosts_deny (so it's disabled - CIS hardening)
+custom_hosts_acls: true
+
+# This fixes polkit issues with sudoers file (CIS hardening)
+hide_pid: 0
+
+# aide
+install_aide: false
+
+# Unattended upgrades
+unattended_reboot: true
+unattended_reboot_time: "04:30"
+
+# Duo Security
+duo_users: ["*", "!provision"]
+duo_api_hostname: api-7cda1654.duosecurity.com
+
+# VMs reserved CPU (for gaming and AI)
+virt_vm_reserved_cpu: "1-5,7-11"
+virt_raw_block_devices:
+  - "nvme0n1"
+  - "nvme0n1p1"
+  - "nvme0n1p2"
+
+virt_extra_grub_args: >
+    i915.modeset=1 i915.enable_gvt=1 i915.enable_fbc=0
+    initcall_blacklist=simpledrm_platform_driver_init
+    rd.driver.blacklist=nouveau modprobe.blacklist=nouveau
+
+virt_vfio_ids:
+  - 10de:2482 # NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
+  - 10de:228b # NVIDIA Corporation GA106 High Definition Audio Controller
+  - 10de:2504 # NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate]
+  - 10de:228e # NVIDIA Corporation GA106 High Definition Audio Controller
+  - 1b73:1100 # Fresco Logic FL1100 USB 3.0 Host Controller
+
+virt_blacklist:
+  - noveau
+  - snd_hda_codec_hdmi
+  - i2c_nvidia_gpu
+  - mxm_wmi
+
+virt_machines:
+  - name: windows-11
+    title: "Microsoft Windows 11"
+    uuid: "51d5d091-67cb-4113-bd8e-817e7317e1b4"
+    autostart: true
+    memory: 25165824
+    cores: 4
+    threads: 2
+    physical_cpus: "2-8,3-9,4-10,5-11"
+    reserved_cpus: "0,6"
+    enable_hyperv: true
+    cdrom: true
+    console: false
+    audio: true
+    secure_boot: true
+    tpm: true
+    tablet: true
+    disk_file: "windows-11.qcow2"
+    mac_address: "52:54:00:cd:dd:2d"
+    block_devs:
+      - block_dev: "/dev/nvme0n1"
+        target_dev: "sdb"
+    host_devs:
+      # Intel MDev device for GVT-g
+      - type: "mdev"
+        source:
+          uuid: "5abeb24f-d6f4-4666-b495-303f15b05723"
+        address: { type: 'pci', domain: '0x0000', bus: '0x07', slot: '0x00', function: '0x0' }
+      # Fresco Logic FL1100 USB 3.0 Host Controller
+      - type: "pci"
+        source:
+          address:
+            domain: "0x0000"
+            bus: "0x06"
+            slot: "0x00"
+            function: "0x0"
+        address: { type: 'pci', domain: '0x0000', bus: '0x10', slot: '0x00', function: '0x0' }
+      # NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
+      - type: "pci"
+        source:
+          address:
+            domain: "0x0000"
+            bus: "0x01"
+            slot: "0x00"
+            function: "0x0"
+        address: { type: 'pci', domain: '0x0000', bus: '0x0b', slot: '0x00', function: '0x0' }
+      # NVIDIA Corporation GA106 High Definition Audio Controller
+      - type: "pci"
+        source:
+          address:
+            domain: "0x0000"
+            bus: "0x01"
+            slot: "0x00"
+            function: "0x1"
+        address: { type: 'pci', domain: '0x0000', bus: '0x0f', slot: '0x00', function: '0x0' }
+
+  - name: fedora-headless
+    title: "Fedora CUDA headless"
+    uuid: "55feda16-51ae-446e-9c83-4c0eee1e5e00"
+    autostart: true
+    memory: 33554432
+    cores: 1
+    threads: 2
+    physical_cpus: "1-7"
+    reserved_cpus: "0,6"
+    cdrom: false
+    console: true
+    audio: false
+    secure_boot: false
+    tpm: true
+    disk_file: "fedora-headless.qcow2"
+    mac_address: "52:54:00:ae:f3:d0"
+    block_devs:
+      - block_dev: "/dev/nvme0n1"
+        target_dev: "sdb"
+    host_devs:
+      # NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate]
+      - type: "pci"
+        source:
+          address:
+            domain: "0x0000"
+            bus: "0x03"
+            slot: "0x00"
+            function: "0x0"
+        address: { type: 'pci',domain: '0x0000',bus: '0x09',slot: '0x00',function: '0x0' }
+      # NVIDIA Corporation GA106 High Definition Audio Controller
+      - type: "pci"
+        source:
+          address:
+            domain: "0x0000"
+            bus: "0x03"
+            slot: "0x00"
+            function: "0x1"
+        address: { type: 'pci',domain: '0x0000',bus: '0x0a',slot: '0x00',function: '0x0' }
diff --git a/ansible/playbook_duo_security.yml b/ansible/playbook_duo_security.yml
index 7a3ba49..d41e887 100644
--- a/ansible/playbook_duo_security.yml
+++ b/ansible/playbook_duo_security.yml
@@ -1,6 +1,6 @@
 ---
 - name: Duo Security
-  hosts: public
+  hosts: 2fa
   gather_facts: true
 
   roles:
diff --git a/ansible/localhost_playbook_vm_host.yml b/ansible/playbook_virt_host.yml
similarity index 60%
rename from ansible/localhost_playbook_vm_host.yml
rename to ansible/playbook_virt_host.yml
index ebf144a..29f1c86 100644
--- a/ansible/localhost_playbook_vm_host.yml
+++ b/ansible/playbook_virt_host.yml
@@ -1,35 +1,16 @@
 - name: Setup GPU passthrough host (Fedora + QEMU/KVM)
-  hosts: localhost
+  hosts: virtualization
   become: true
   vars:
-    host_reserved_cpu: "0-1"
-    gaming_vm_cpus: "2-9"
-    ai_vm_cpus: "10-11"
-    vfio_ids:
-      - 10de:2482 # NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
-      - 10de:228b # NVIDIA Corporation GA106 High Definition Audio Controller
-      - 10de:2504 # NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate]
-      - 10de:228e # NVIDIA Corporation GA106 High Definition Audio Controller
-      - 1b73:1100 # Fresco Logic FL1100 USB 3.0 Host Controller
-      # - 144d:a808 # Samsung Electronics Co Ltd NVMe SSD Controller SM981/PM981/PM983
     grub_config_file: "/etc/default/grub"
     grub_cmdline_args: >
       rhgb quiet intel_iommu=on iommu=pt
-      isolcpus=1-5,7-11 nohz_full=1-5,7-11 rcu_nocbs=1-5,7-11
-      i915.modeset=1 i915.enable_gvt=1 i915.enable_fbc=0
-      initcall_blacklist=simpledrm_platform_driver_init
-      rd.driver.blacklist=nouveau modprobe.blacklist=nouveau
+      isolcpus={{ virt_vm_reserved_cpu }} nohz_full={{ virt_vm_reserved_cpu }} rcu_nocbs={{ virt_vm_reserved_cpu }}
       snd_hda_codec_hdmi.blacklist=1 rd.driver.pre=vfio-pci audit=off
-
-    win_partition: "/dev/nvme0n1p1"
-    ai_partition: "/dev/nvme0n1p2"
-    partitions:
-      - { dev: "/dev/nvme0n1p1", label: "win-nvme" }
-      - { dev: "/dev/nvme0n1p2", label: "ai-nvme" }
+      default_hugepagesz=1G hugepagesz=1G hugepages=8 mitigations=off loglevel=3 {{ virt_extra_grub_args | default("") | trim}}
 
   tasks:
-
-    - name: Install virtualization packages
+    - name: Install required packages
       ansible.builtin.dnf:
         name:
           - qemu-kvm
@@ -38,6 +19,9 @@
           - virt-manager
           - bridge-utils
           - pciutils
+          - tuned
+          - python3-lxml
+          - python3-libvirt
         state: present
 
     - name: Enable and start libvirtd
@@ -52,24 +36,22 @@
         regexp: '^GRUB_CMDLINE_LINUX='
         line: 'GRUB_CMDLINE_LINUX="{{ grub_cmdline_args | trim }}"'
         backrefs: true
+      notify: Rebuild GRUB config
 
     - name: Add VFIO PCI device IDs to modprobe
       ansible.builtin.copy:
         dest: /etc/modprobe.d/vfio.conf
         content: |
-          options vfio-pci ids={{ vfio_ids | join(',') }}
+          options vfio-pci ids={{ virt_vfio_ids | join(',') }}
           install snd_hda_codec_hdmi /bin/false
         mode: '0644'
 
     - name: Blacklist Nouveau and other drivers
-      ansible.builtin.copy:
+      ansible.builtin.template:
+        src: blacklist.conf.j2
         dest: /etc/modprobe.d/ansible-blacklist.conf
-        content: |
-          blacklist noveau
-          blacklist snd_hda_codec_hdmi
-          blacklist i2c_nvidia_gpu
-          blacklist mxm_wmi
         mode: '0644'
+      when: virt_blacklist is defined
 
     - name: Add vfio modules to initramfs config
       ansible.builtin.copy:
@@ -77,15 +59,14 @@
         content: |
           add_drivers+=" vfio vfio_iommu_type1 vfio_pci "
         mode: '0644'
+      notify: Rebuild initramfs
 
-    - name: Rebuild initramfs
-      changed_when: false
-      ansible.builtin.command: dracut -f
-
-    - name: Rebuild GRUB config
-      changed_when: false
-      ansible.builtin.command: grub2-mkconfig -o /boot/grub2/grub.cfg
-      when: ansible_facts['distribution'] == "Fedora"
+    - name: Configure hugepages
+      ansible.posix.sysctl:
+        name: vm.nr_hugepages
+        value: "{{ hugepages_count | default('2048') }}"
+        state: present
+        reload: true
 
     - name: Enable KVM modules at boot
       ansible.builtin.copy:
@@ -98,40 +79,62 @@
           vfio_iommu_type1
         mode: '0644'
 
+    - name: Set I/O scheduler to 'none' for NVMes
+      ansible.builtin.copy:
+        dest: /etc/udev/rules.d/60-ioscheduler.rules
+        content: |
+          ACTION=="add|change", KERNEL=="nvme[0-9]*", ATTR{queue/scheduler}="none"
+        mode: '0644'
+      notify:
+        - Reload udev rules
+        - Trigger udev to apply changes
+
+    - name: Activate virtual-host tuned profile
+      ansible.builtin.command: tuned-adm profile virtual-host
+      changed_when: false
+
+    - name: Set permissions for partition passthrough
+      ansible.builtin.file:
+        path: "/dev/{{ item }}"
+        owner: qemu
+        group: kvm
+        mode: '0660'
+      loop: "{{ virt_raw_block_devices }}"
+
+    - name: Create udev rules for persistent access
+      ansible.builtin.template:
+        src: 99-qemu-nvme.rules.j2
+        dest: /etc/udev/rules.d/99-qemu-nvme.rules
+        mode: '0644'
+      notify:
+        - Reload udev rules
+        - Trigger udev to apply changes
+
+    - name: Create or update virtual machine
+      vars:
+        vm: "{{ item }}"
+      loop: "{{ virt_machines }}"
+      community.libvirt.virt:
+        autostart: "{{ vm.autostart | default(false) }}"
+        name: "{{ vm.name }}"
+        state: running
+        command: define
+        xml: "{{ lookup('template', 'domain.xml.j2') }}"
+
+    - name: Ensure virtual machines are running
+      vars:
+        vm: "{{ item }}"
+      loop: "{{ virt_machines }}"
+      community.libvirt.virt:
+        name: "{{ vm.name }}"
+        state: running
+
     - name: Notify user to reboot for changes
       ansible.builtin.debug:
         msg: |
           Reboot your system to apply IOMMU, CPU isolation, and VFIO settings.
           After reboot, verify using: `dmesg | grep -i vfio` and `lspci -nnk`
 
-    - name: Ensure partitions are unmounted
-      ansible.posix.mount:
-        path: "/mnt/{{ item.label }}"
-        src: "{{ item.dev }}"
-        state: absent
-        fstype: auto
-      loop: "{{ partitions }}"
-
-    - name: Set permissions for partition passthrough
-      ansible.builtin.file:
-        path: "{{ item.dev }}"
-        owner: qemu
-        group: kvm
-        mode: '0660'
-      loop: "{{ partitions }}"
-
-    - name: Create udev rules for persistent access
-      ansible.builtin.copy:
-        dest: /etc/udev/rules.d/99-qemu-nvme.rules
-        content: |
-          KERNEL=="nvme0n1", OWNER="qemu", GROUP="kvm", MODE="0660"
-          KERNEL=="nvme0n1p1", OWNER="qemu", GROUP="kvm", MODE="0660"
-          KERNEL=="nvme0n1p2", OWNER="qemu", GROUP="kvm", MODE="0660"
-        mode: '0644'
-      notify:
-        - Reload udev rules
-        - Trigger udev to apply changes
-
   handlers:
     - name: Reload udev rules
       changed_when: false
@@ -140,3 +143,12 @@
     - name: Trigger udev to apply changes
       changed_when: false
       ansible.builtin.command: udevadm trigger
+
+    - name: Rebuild initramfs
+      changed_when: false
+      ansible.builtin.command: dracut -f
+
+    - name: Rebuild GRUB config
+      changed_when: false
+      ansible.builtin.command: grub2-mkconfig -o /boot/grub2/grub.cfg
+      when: ansible_facts['distribution'] == "Fedora"
diff --git a/ansible/requirements.yml b/ansible/requirements.yml
index a6b0fd8..d640cbb 100644
--- a/ansible/requirements.yml
+++ b/ansible/requirements.yml
@@ -2,3 +2,5 @@
 collections:
   - ansible.posix
   - community.general
+  - containers.podman
+  - community.libvirt
diff --git a/ansible/roles/cis/tasks/ctrlaltdel.yml b/ansible/roles/cis/tasks/ctrlaltdel.yml
index 80da1ec..1c38c91 100644
--- a/ansible/roles/cis/tasks/ctrlaltdel.yml
+++ b/ansible/roles/cis/tasks/ctrlaltdel.yml
@@ -12,7 +12,18 @@
     - CCE-80785-9
     - systemd
 
-- name: Disable systemd ctrl-alt-del - RedHat family
+- name: Remove existing symlink for ctrl-alt-del.target if it exists
+  become: true
+  ansible.builtin.file:
+    path: /etc/systemd/system/ctrl-alt-del.target
+    state: absent
+  when: ansible_os_family == "RedHat"
+  tags:
+    - ctrl-alt-del
+    - CCE-80785-9
+    - systemd
+
+- name: Mask ctrl-alt-del.target to disable Ctrl+Alt+Del
   become: true
   ansible.builtin.systemd:
     name: ctrl-alt-del.target
@@ -25,4 +36,4 @@
     - ctrl-alt-del
     - CCE-80785-9
     - systemd
-...
+
diff --git a/ansible/roles/cis/tasks/users.yml b/ansible/roles/cis/tasks/users.yml
index 87a71e2..1b48402 100644
--- a/ansible/roles/cis/tasks/users.yml
+++ b/ansible/roles/cis/tasks/users.yml
@@ -5,13 +5,17 @@
     name: "{{ item }}"
     state: absent
     remove: true
+  loop: "{{ delete_users }}"
   register: remove_users
-  with_items:
-    - "{{ delete_users }}"
-  failed_when: >
-    remove_users is not success and
-    not ("not removing" in remove_users.msg or
-    "not found" in remove_users.msg)
+  ignore_errors: true
+  tags:
+    - users
+
+- name: Show warning for users that could not be removed
+  debug:
+    msg: "Could not remove user '{{ item.item }}'. Error: {{ item.msg | default('unknown error') }}"
+  loop: "{{ remove_users.results | selectattr('failed', 'equalto', true) | list }}"
+  when: remove_users is defined
   tags:
     - users
 
diff --git a/ansible/roles/duo/tasks/main.yml b/ansible/roles/duo/tasks/main.yml
index 9abd606..84bef13 100644
--- a/ansible/roles/duo/tasks/main.yml
+++ b/ansible/roles/duo/tasks/main.yml
@@ -47,9 +47,9 @@
     - name: Add Duo Source (RedHat)
       become: true
       ansible.builtin.yum_repository:
-        name: Duo Security
+        name: duo-security
         description: Duo Security Repository
-        baseurl: https://pkg.duosecurity.com/RHEL/$releasever/$basearch
+        baseurl: https://pkg.duosecurity.com/Fedora/$releasever/$basearch
         gpgcheck: true
         gpgkey: https://duo.com/DUO-GPG-PUBLIC-KEY.asc
         enabled: true
@@ -57,7 +57,7 @@
     - name: Install Duo Unix Application Integration
       become: true
       ansible.builtin.dnf:
-        name: duo-unix
+        name: duo_unix
         state: present
 
 - name: Install Duo config
diff --git a/ansible/roles/login/tasks/main.yml b/ansible/roles/login/tasks/main.yml
index ed3aeb4..6608cf4 100644
--- a/ansible/roles/login/tasks/main.yml
+++ b/ansible/roles/login/tasks/main.yml
@@ -11,17 +11,20 @@
     password: "{{ lookup('env', 'USER_PASSWORD_' + (item.username | upper)) | password_hash('sha512', user_password_salt) }}"
     state: "{{ 'absent' if item.enabled is defined and not item.enabled else 'present' }}"
     shell: "{{ item.shell if item.shell is defined else '/bin/bash' }}"
+    groups: "{{ item.groups | default(omit) }}"
+    uid: "{{ item.uid | default(omit) }}"
   loop: "{{ login_users }}"
 
+
 - name: Disable password expiration
   ansible.builtin.command: chage -M -1 "{{ item.username }}"
-  become: yes
+  become: true
   when: item.password_expiration is defined and not item.password_expiration
   loop: "{{ login_users }}"
 
 - name: Disable password login
   ansible.builtin.command: passwd -d "{{ item.username }}"
-  become: yes
+  become: true
   when: item.password_disabled is defined and item.password_disabled
   loop: "{{ login_users }}"
 
diff --git a/ansible/templates/99-qemu-nvme.rules.j2 b/ansible/templates/99-qemu-nvme.rules.j2
new file mode 100644
index 0000000..e65c83d
--- /dev/null
+++ b/ansible/templates/99-qemu-nvme.rules.j2
@@ -0,0 +1,3 @@
+{% for dev in virt_raw_block_devices %}
+KERNEL=="{{ dev }}", OWNER="qemu", GROUP="kvm", MODE="0660"
+{% endfor %}
\ No newline at end of file
diff --git a/ansible/templates/blacklist.conf.j2 b/ansible/templates/blacklist.conf.j2
new file mode 100644
index 0000000..7be0dd5
--- /dev/null
+++ b/ansible/templates/blacklist.conf.j2
@@ -0,0 +1,3 @@
+{% for driver in virt_blacklist %}
+blacklist {{ driver }}
+{% endfor %}
\ No newline at end of file
diff --git a/ansible/templates/domain.xml.j2 b/ansible/templates/domain.xml.j2
new file mode 100644
index 0000000..d5de25a
--- /dev/null
+++ b/ansible/templates/domain.xml.j2
@@ -0,0 +1,255 @@
+<domain type='kvm'>
+  <name>{{ vm.name }}</name>
+  <uuid>{{ vm.uuid }}</uuid>
+  <title>{{ vm.title }}</title>
+  <memory unit='KiB'>{{ vm.memory }}</memory>
+  <currentMemory unit='KiB'>{{ vm.memory }}</currentMemory>
+  <memoryBacking>
+    <hugepages/>
+    <source type='memfd'/>
+    <access mode='shared'/>
+  </memoryBacking>
+  <vcpu placement='static'>{{ vm.cores * vm.threads }}</vcpu>
+  <cputune>
+  {% set pairs = vm.physical_cpus.split(',') %}
+  {% set ns = namespace(vcpu=0) %}
+  {% for pair in pairs %}
+      {% set parts = pair.split('-') %}
+      <vcpupin vcpu='{{ ns.vcpu }}' cpuset='{{ parts[0] }}'/>
+      {% set ns.vcpu = ns.vcpu + 1 %}
+      <vcpupin vcpu='{{ ns.vcpu }}' cpuset='{{ parts[1] }}'/>
+      {% set ns.vcpu = ns.vcpu + 1 %}
+  {% endfor %}
+    <emulatorpin cpuset='{{ vm.reserved_cpus }}'/>
+  </cputune>
+  <os>
+    <type arch='x86_64' machine='pc-q35-7.0'>hvm</type>
+    <loader readonly='yes' secure='{% if vm.secure_boot %}yes{% else %}no{% endif %}' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE{% if vm.secure_boot %}.secboot{% endif %}.fd</loader>
+    <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/{{ vm.name }}_VARS.fd</nvram>
+    <boot dev='hd'/>
+    <bootmenu enable='no'/>
+  </os>
+  <features>
+    <acpi/>
+    <apic/>
+{% if vm.enable_hyperv is defined %}
+  {% if vm.enable_hyperv | default(false) %}
+    <hyperv mode='custom'>
+      <relaxed state='on'/>
+      <vapic state='on'/>
+      <spinlocks state='on' retries='8191'/>
+      <vendor_id state='on' value='{{ vm.hyperv_vendor_id | default("whatever") }}'/>
+    </hyperv>
+  {% endif %}
+{% endif %}
+    <smm state='on'/>
+  </features>
+  <cpu mode='host-passthrough' check='none' migratable='on'>
+    <topology sockets='1' dies='1' cores='{{ vm.cores }}' threads='{{ vm.threads }}'/>
+  </cpu>
+  <clock offset='localtime'>
+    <timer name='rtc' tickpolicy='catchup'/>
+    <timer name='pit' tickpolicy='delay'/>
+    <timer name='hpet' present='no'/>
+    <timer name='kvmclock' present='yes'/>
+{% if vm.enable_hyperv is defined %}
+  {% if vm.enable_hyperv | default(false) %}
+    <timer name='hypervclock' present='yes'/>
+  {% endif %}
+{% endif %}
+  </clock>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <pm>
+    <suspend-to-mem enabled='no'/>
+    <suspend-to-disk enabled='no'/>
+  </pm>
+  <devices>
+    <emulator>{{ vm.emulator | default("/usr/bin/qemu-system-x86_64") }}</emulator>
+    <disk type='file' device='disk'>
+      <driver name='qemu' type='qcow2' cache='writeback'/>
+      <source file='/var/lib/libvirt/images/{{ vm.disk_file }}'/>
+      <backingStore />
+      <target dev='sda' bus='virtio'/>
+      <address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0' />
+    </disk>
+    {% for block_dev in vm.block_devs %}
+    <disk type='block' device='disk'>
+      <driver name='qemu' type='raw'/>
+      <source dev='{{ block_dev.block_dev }}'/>
+      <target dev='{{ block_dev.target_dev }}' bus='virtio'/>
+    </disk>
+    {% endfor %}
+    {% if vm.cdrom %}
+    <disk type='file' device='cdrom'>
+      <driver name='qemu' type='raw'/>
+      <target dev='hdc' bus='sata'/>
+      <readonly/>
+      <address type='drive' controller='0' bus='0' target='0' unit='2'/>
+    </disk>
+    {% endif %}
+    <controller type='usb' index='0' model='qemu-xhci' ports='15'>
+        <address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0' />
+    </controller>
+    <controller type='sata' index='0'>
+        <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2' />
+    </controller>
+    <controller type='pci' index='0' model='pcie-root' />
+    <controller type='pci' index='1' model='pcie-root-port'>
+        <model name='pcie-root-port' />
+        <target chassis='1' port='0x8' />
+        <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'
+            multifunction='on' />
+    </controller>
+    <controller type='pci' index='2' model='pcie-to-pci-bridge'>
+        <model name='pcie-pci-bridge' />
+        <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0' />
+    </controller>
+    <controller type='pci' index='3' model='pcie-root-port'>
+        <model name='pcie-root-port' />
+        <target chassis='3' port='0x9' />
+        <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1' />
+    </controller>
+    <controller type='pci' index='4' model='pcie-root-port'>
+        <model name='pcie-root-port' />
+        <target chassis='4' port='0xa' />
+        <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2' />
+    </controller>
+    <controller type='pci' index='5' model='pcie-root-port'>
+        <model name='pcie-root-port' />
+        <target chassis='5' port='0xb' />
+        <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x3' />
+    </controller>
+    <controller type='pci' index='6' model='pcie-root-port'>
+        <model name='pcie-root-port' />
+        <target chassis='6' port='0xc' />
+        <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x4' />
+    </controller>
+    <controller type='pci' index='7' model='pcie-root-port'>
+        <model name='pcie-root-port' />
+        <target chassis='7' port='0xd' />
+        <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x5' />
+    </controller>
+    <controller type='pci' index='8' model='pcie-root-port'>
+        <model name='pcie-root-port' />
+        <target chassis='8' port='0xe' />
+        <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x6' />
+    </controller>
+    <controller type='pci' index='9' model='pcie-root-port'>
+        <model name='pcie-root-port' />
+        <target chassis='9' port='0xf' />
+        <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x7' />
+    </controller>
+    <controller type='pci' index='10' model='pcie-root-port'>
+        <model name='pcie-root-port' />
+        <target chassis='10' port='0x10' />
+        <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'
+            multifunction='on' />
+    </controller>
+    <controller type='pci' index='11' model='pcie-root-port'>
+        <model name='pcie-root-port' />
+        <target chassis='11' port='0x11' />
+        <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1' />
+    </controller>
+    <controller type='pci' index='12' model='pcie-root-port'>
+        <model name='pcie-root-port' />
+        <target chassis='12' port='0x12' />
+        <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2' />
+    </controller>
+    <controller type='pci' index='13' model='pcie-root-port'>
+        <model name='pcie-root-port' />
+        <target chassis='13' port='0x13' />
+        <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3' />
+    </controller>
+    <controller type='pci' index='14' model='pcie-root-port'>
+        <model name='pcie-root-port' />
+        <target chassis='14' port='0x14' />
+        <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4' />
+    </controller>
+    <controller type='pci' index='15' model='pcie-root-port'>
+        <model name='pcie-root-port' />
+        <target chassis='15' port='0x15' />
+        <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5' />
+    </controller>
+    <controller type='pci' index='16' model='pcie-root-port'>
+        <model name='pcie-root-port' />
+        <target chassis='16' port='0x16' />
+        <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6' />
+    </controller>
+    <controller type='virtio-serial' index='0'>
+        <address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0' />
+    </controller>
+  {% if vm.smartcard is defined %}
+    {% if vm.smartcard | default(false) %}
+    <controller type='ccid' index='0'>
+      <alias name='ccid0'/>
+      <address type='usb' bus='0' port='1'/>
+    </controller>
+    {% endif %}
+  {% endif %}    
+  {% if vm.virtio_fs is defined %}
+    {% if vm.virtio_fs | default(false) %}
+    <filesystem type='mount' accessmode='passthrough'>
+      <driver type='virtiofs'/>
+      <source dir='{{ vm.virtio_fs.source }}'/>
+      <target dir='{{ vm.virtio_fs.target }}'/>
+    </filesystem>
+    {% endif %}
+  {% endif %}
+    <interface type='bridge'>
+      <mac address='{{ vm.mac_address }}'/>
+      <source bridge='{{ vm.net_bridge  | default("bridge0") }}'/>
+      <model type='virtio'/>
+      <address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0' />
+    </interface>
+  {% if vm.tablet is defined %}
+    {% if vm.tablet | default(false) %}
+    <input type='tablet' bus='usb'/>
+    {% endif %}  
+  {% endif %}
+  {% if vm.console %}
+    <serial type='pty'>
+      <target type='isa-serial' port='0'>
+        <model name='isa-serial'/>
+      </target>
+    </serial>
+    <console type='pty'>
+      <target type='serial' port='0'/>
+    </console>
+  {% endif %}
+    <input type='mouse' bus='ps2'/>
+    <input type='keyboard' bus='ps2'/>
+  {% if vm.tpm %}
+    <tpm model='tpm-tis'>
+      <backend type='emulator' version='2.0'/>
+    </tpm>
+  {% endif %}
+  {% if vm.audio %}
+    <audio id='1' type='none'/>
+  {% endif %}
+{% for dev in vm.host_devs %}
+  {% if dev.type == 'mdev' %}
+    <hostdev mode='subsystem' type='mdev' managed='no' model='{{ dev.model | default('vfio-pci') }}' display='{{ dev.display | default('off') }}'>
+      <source>
+        <address uuid='{{ dev.source.uuid }}'/>
+      </source>
+  {% elif dev.type == 'pci' %}
+    <hostdev mode='subsystem' type='pci' managed='yes'>
+      <source>
+        <address domain='{{ dev.source.address.domain }}' bus='{{ dev.source.address.bus }}'
+                 slot='{{ dev.source.address.slot }}' function='{{ dev.source.address.function }}'/>
+      </source>
+  {% endif %}
+  {% if dev.address is defined %}
+      <address {% for key, value in dev.address.items() %}
+               {{ key }}='{{ value }}'{% if not loop.last %} {% endif %}
+      {% endfor %}/>
+  {% endif %}
+    </hostdev>
+{% endfor %}
+    <memballoon model='virtio'>
+      <address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
+    </memballoon>
+  </devices>
+</domain>
\ No newline at end of file
diff --git a/inventory/hosts b/inventory/hosts
index 28b0904..4301a88 100644
--- a/inventory/hosts
+++ b/inventory/hosts
@@ -5,6 +5,7 @@ dev-01.alexpires.dev
 [hardening]
 prod-01.alexpires.me
 dev-01.alexpires.dev
+vh-01.alexpires.dev
 
 [ubuntu]
 prod-01.alexpires.me
@@ -15,6 +16,7 @@ prod-01.alexpires.me
 
 [private]
 dev-01.alexpires.dev
+vh-01.alexpires.dev
 
 [gitea]
 prod-01.alexpires.me
@@ -48,3 +50,11 @@ prod-01.alexpires.me
 
 [trivy]
 prod-01.alexpires.me
+
+[virtualization]
+vh-01.alexpires.dev
+
+[2fa]
+prod-01.alexpires.me
+dev-01.alexpires.dev
+vh-01.alexpires.dev
diff --git a/scripts/cpu_power_monitor.py b/scripts/cpu_power_monitor.py
index 7e55978..f115b38 100644
--- a/scripts/cpu_power_monitor.py
+++ b/scripts/cpu_power_monitor.py
@@ -1,33 +1,38 @@
 import time
 import os
 
-RAPL_PATH = "/sys/class/powercap/intel-rapl:0/energy_uj"
+RAPL_PATH = "/sys/class/powercap/intel-rapl:0/energy_uj" 
+INTERVAL_SEC = 1.0  # configurable via command-line argument or env var
 
-def read_energy():
+def read_energy(path):
     try:
-        with open(RAPL_PATH, "r") as f:
+        with open(path, "r") as f:
             return int(f.read().strip())
     except FileNotFoundError:
-        print(f"Error: {RAPL_PATH} not found.")
-        exit(1)
+        raise RuntimeError(f"RAPL support not available: {path}")
 
-def calculate_power(interval=1.0):
-    print(f"Monitoring CPU package power every {interval} second(s)... (Ctrl+C to stop)")
-    while True:
-        energy_before = read_energy()
-        time.sleep(interval)
-        energy_after = read_energy()
-
-        delta_uj = energy_after - energy_before
-        power_watts = (delta_uj / 1_000_000) / interval
-
-        print(f"Power Usage: {power_watts:.2f} Watts")
+def calculate_power(energy_before, energy_after, interval_sec):
+    delta_uj = energy_after - energy_before
+    power_watts = (delta_uj / 1_000_000) / interval_sec
+    return f"{power_watts:.2f} Watts"
 
 if __name__ == "__main__":
     if os.geteuid() != 0:
         print("Please run this script as root.")
         exit(1)
+    
     try:
-        calculate_power(interval=1.0)
+        # RAPL support check
+        with open(RAPL_PATH, "r") as f:
+            _ = int(f.read().strip())
+        
+        while True:
+            energy_before = read_energy(RAPL_PATH)
+            time.sleep(INTERVAL_SEC)
+            energy_after = read_energy(RAPL_PATH)
+            
+            power_reading = calculate_power(energy_before, energy_after, INTERVAL_SEC)
+            print(f"Power Usage: {power_reading}")
+    
     except KeyboardInterrupt:
         print("\nStopped.")
\ No newline at end of file