Add configuration and playbook for virtualization host setup
- Create host variable file for vh-01.alexpires.dev with user, SSH, firewall, and VM configurations. - Update playbook_duo_security.yml to target the 2fa group. - Introduce playbook_virt_host.yml for setting up GPU passthrough on Fedora with QEMU/KVM. - Add required collections to requirements.yml for Podman and Libvirt. - Modify ctrlaltdel.yml to remove existing symlink for ctrl-alt-del.target before masking it. - Enhance users.yml to show warnings for users that could not be removed. - Update Duo Security role to use the correct repository and package names. - Improve login role to handle user UID and group assignments. - Create udev rules template for NVMe devices. - Add blacklist template for VFIO drivers. - Implement domain XML template for virtual machines with detailed configurations. - Update inventory to include vh-01.alexpires.dev in relevant groups. - Refactor cpu_power_monitor.py for improved error handling and modularity.
This commit is contained in:
@@ -0,0 +1,189 @@
|
||||
hostname: vh-01.alexpires.local
|
||||
ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}"
|
||||
|
||||
# Users
|
||||
login_users:
|
||||
- username: "{{ ansible_user }}"
|
||||
comment: "Managed by Ansible"
|
||||
sudoer: true
|
||||
sudoer_root_only: true
|
||||
sudoer_no_password: true
|
||||
pubkey: "{{ lookup('file', 'keys/ansible_user.pub') }}"
|
||||
password_disabled: true
|
||||
- username: operator
|
||||
comment: "Managed by Ansible"
|
||||
sudoer: true
|
||||
pubkey: "{{ lookup('file', 'keys/operator.pub') }}"
|
||||
shell: "/bin/zsh"
|
||||
password_expiration: false
|
||||
|
||||
# SSH Connection and security
|
||||
sshd_port: 22
|
||||
ssh_allowed_networks:
|
||||
- "0.0.0.0/0"
|
||||
sshd_admin_net: "0.0.0.0/0"
|
||||
sshd_allow_groups: "{{ ansible_user }} users"
|
||||
sshd_permit_root_login: "no"
|
||||
sshd_password_authentication: "no"
|
||||
sshd_allow_tcp_forwarding: "yes"
|
||||
|
||||
# Due to an issue increase the number of max auth tries
|
||||
sshd_max_auth_tries: 10
|
||||
|
||||
# Firewall ports
|
||||
ufw_enable: true
|
||||
fw_allowed_ports:
|
||||
- { rule: "allow", port: "22", proto: "tcp" }
|
||||
- { rule: "allow", port: "9090", proto: "tcp" }
|
||||
|
||||
ufw_outgoing_traffic:
|
||||
- 22 # SSH
|
||||
- 53 # DNS
|
||||
- 80 # HTTP
|
||||
- 123 # NTP
|
||||
- 443 # HTTPS
|
||||
- 853 # DNS over TLS
|
||||
|
||||
ufw_default_forward_policy: "ACCEPT"
|
||||
|
||||
ipv4_sysctl_settings:
|
||||
net.ipv4.ip_forward: 1
|
||||
|
||||
disable_ipv6: true
|
||||
|
||||
# geoip will override hosts_allow and hosts_deny (so it's disabled - CIS hardening)
|
||||
custom_hosts_acls: true
|
||||
|
||||
# This fixes polkit issues with sudoers file (CIS hardening)
|
||||
hide_pid: 0
|
||||
|
||||
# aide
|
||||
install_aide: false
|
||||
|
||||
# Unattended upgrades
|
||||
unattended_reboot: true
|
||||
unattended_reboot_time: "04:30"
|
||||
|
||||
# Duo Security
|
||||
duo_users: ["*", "!provision"]
|
||||
duo_api_hostname: api-7cda1654.duosecurity.com
|
||||
|
||||
# VMs reserved CPU (for gaming and AI)
|
||||
virt_vm_reserved_cpu: "1-5,7-11"
|
||||
virt_raw_block_devices:
|
||||
- "nvme0n1"
|
||||
- "nvme0n1p1"
|
||||
- "nvme0n1p2"
|
||||
|
||||
virt_extra_grub_args: >
|
||||
i915.modeset=1 i915.enable_gvt=1 i915.enable_fbc=0
|
||||
initcall_blacklist=simpledrm_platform_driver_init
|
||||
rd.driver.blacklist=nouveau modprobe.blacklist=nouveau
|
||||
|
||||
virt_vfio_ids:
|
||||
- 10de:2482 # NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
|
||||
- 10de:228b # NVIDIA Corporation GA106 High Definition Audio Controller
|
||||
- 10de:2504 # NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate]
|
||||
- 10de:228e # NVIDIA Corporation GA106 High Definition Audio Controller
|
||||
- 1b73:1100 # Fresco Logic FL1100 USB 3.0 Host Controller
|
||||
|
||||
virt_blacklist:
|
||||
- noveau
|
||||
- snd_hda_codec_hdmi
|
||||
- i2c_nvidia_gpu
|
||||
- mxm_wmi
|
||||
|
||||
virt_machines:
|
||||
- name: windows-11
|
||||
title: "Microsoft Windows 11"
|
||||
uuid: "51d5d091-67cb-4113-bd8e-817e7317e1b4"
|
||||
autostart: true
|
||||
memory: 25165824
|
||||
cores: 4
|
||||
threads: 2
|
||||
physical_cpus: "2-8,3-9,4-10,5-11"
|
||||
reserved_cpus: "0,6"
|
||||
enable_hyperv: true
|
||||
cdrom: true
|
||||
console: false
|
||||
audio: true
|
||||
secure_boot: true
|
||||
tpm: true
|
||||
tablet: true
|
||||
disk_file: "windows-11.qcow2"
|
||||
mac_address: "52:54:00:cd:dd:2d"
|
||||
block_devs:
|
||||
- block_dev: "/dev/nvme0n1"
|
||||
target_dev: "sdb"
|
||||
host_devs:
|
||||
# Intel MDev device for GVT-g
|
||||
- type: "mdev"
|
||||
source:
|
||||
uuid: "5abeb24f-d6f4-4666-b495-303f15b05723"
|
||||
address: { type: 'pci', domain: '0x0000', bus: '0x07', slot: '0x00', function: '0x0' }
|
||||
# Fresco Logic FL1100 USB 3.0 Host Controller
|
||||
- type: "pci"
|
||||
source:
|
||||
address:
|
||||
domain: "0x0000"
|
||||
bus: "0x06"
|
||||
slot: "0x00"
|
||||
function: "0x0"
|
||||
address: { type: 'pci', domain: '0x0000', bus: '0x10', slot: '0x00', function: '0x0' }
|
||||
# NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
|
||||
- type: "pci"
|
||||
source:
|
||||
address:
|
||||
domain: "0x0000"
|
||||
bus: "0x01"
|
||||
slot: "0x00"
|
||||
function: "0x0"
|
||||
address: { type: 'pci', domain: '0x0000', bus: '0x0b', slot: '0x00', function: '0x0' }
|
||||
# NVIDIA Corporation GA106 High Definition Audio Controller
|
||||
- type: "pci"
|
||||
source:
|
||||
address:
|
||||
domain: "0x0000"
|
||||
bus: "0x01"
|
||||
slot: "0x00"
|
||||
function: "0x1"
|
||||
address: { type: 'pci', domain: '0x0000', bus: '0x0f', slot: '0x00', function: '0x0' }
|
||||
|
||||
- name: fedora-headless
|
||||
title: "Fedora CUDA headless"
|
||||
uuid: "55feda16-51ae-446e-9c83-4c0eee1e5e00"
|
||||
autostart: true
|
||||
memory: 33554432
|
||||
cores: 1
|
||||
threads: 2
|
||||
physical_cpus: "1-7"
|
||||
reserved_cpus: "0,6"
|
||||
cdrom: false
|
||||
console: true
|
||||
audio: false
|
||||
secure_boot: false
|
||||
tpm: true
|
||||
disk_file: "fedora-headless.qcow2"
|
||||
mac_address: "52:54:00:ae:f3:d0"
|
||||
block_devs:
|
||||
- block_dev: "/dev/nvme0n1"
|
||||
target_dev: "sdb"
|
||||
host_devs:
|
||||
# NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate]
|
||||
- type: "pci"
|
||||
source:
|
||||
address:
|
||||
domain: "0x0000"
|
||||
bus: "0x03"
|
||||
slot: "0x00"
|
||||
function: "0x0"
|
||||
address: { type: 'pci',domain: '0x0000',bus: '0x09',slot: '0x00',function: '0x0' }
|
||||
# NVIDIA Corporation GA106 High Definition Audio Controller
|
||||
- type: "pci"
|
||||
source:
|
||||
address:
|
||||
domain: "0x0000"
|
||||
bus: "0x03"
|
||||
slot: "0x00"
|
||||
function: "0x1"
|
||||
address: { type: 'pci',domain: '0x0000',bus: '0x0a',slot: '0x00',function: '0x0' }
|
||||
Reference in New Issue
Block a user