Add configuration and playbook for virtualization host setup
- Create host variable file for vh-01.alexpires.dev with user, SSH, firewall, and VM configurations. - Update playbook_duo_security.yml to target the 2fa group. - Introduce playbook_virt_host.yml for setting up GPU passthrough on Fedora with QEMU/KVM. - Add required collections to requirements.yml for Podman and Libvirt. - Modify ctrlaltdel.yml to remove existing symlink for ctrl-alt-del.target before masking it. - Enhance users.yml to show warnings for users that could not be removed. - Update Duo Security role to use the correct repository and package names. - Improve login role to handle user UID and group assignments. - Create udev rules template for NVMe devices. - Add blacklist template for VFIO drivers. - Implement domain XML template for virtual machines with detailed configurations. - Update inventory to include vh-01.alexpires.dev in relevant groups. - Refactor cpu_power_monitor.py for improved error handling and modularity.
This commit is contained in:
@@ -1,199 +0,0 @@
|
|||||||
<domain type='kvm'>
|
|
||||||
<name>fedora-headless</name>
|
|
||||||
<uuid>55feda16-51ae-446e-9c83-4c0eee1e5e00</uuid>
|
|
||||||
<title>Fedora CUDA headless</title>
|
|
||||||
<memory unit='KiB'>33554432</memory>
|
|
||||||
<currentMemory unit='KiB'>33554432</currentMemory>
|
|
||||||
<memoryBacking>
|
|
||||||
<hugepages/>
|
|
||||||
<source type='memfd'/>
|
|
||||||
<access mode='shared'/>
|
|
||||||
</memoryBacking>
|
|
||||||
<vcpu placement='static'>2</vcpu>
|
|
||||||
<cputune>
|
|
||||||
<vcpupin vcpu='0' cpuset='1'/>
|
|
||||||
<vcpupin vcpu='1' cpuset='7'/>
|
|
||||||
<emulatorpin cpuset='0,6'/>
|
|
||||||
</cputune>
|
|
||||||
<os>
|
|
||||||
<type arch='x86_64' machine='pc-q35-7.0'>hvm</type>
|
|
||||||
<loader readonly='yes' secure='no' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.fd</loader>
|
|
||||||
<nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/fedora-headless_VARS.fd</nvram>
|
|
||||||
<boot dev='hd'/>
|
|
||||||
<bootmenu enable='no'/>
|
|
||||||
</os>
|
|
||||||
<features>
|
|
||||||
<acpi/>
|
|
||||||
<apic/>
|
|
||||||
<smm state='on'/>
|
|
||||||
</features>
|
|
||||||
<cpu mode='host-passthrough' check='none' migratable='on'>
|
|
||||||
<topology sockets='1' dies='1' cores='1' threads='2'/>
|
|
||||||
</cpu>
|
|
||||||
<clock offset='localtime'>
|
|
||||||
<timer name='rtc' tickpolicy='catchup'/>
|
|
||||||
<timer name='pit' tickpolicy='delay'/>
|
|
||||||
<timer name='hpet' present='no'/>
|
|
||||||
<timer name='kvmclock' present='yes'/>
|
|
||||||
</clock>
|
|
||||||
<on_poweroff>destroy</on_poweroff>
|
|
||||||
<on_reboot>restart</on_reboot>
|
|
||||||
<on_crash>destroy</on_crash>
|
|
||||||
<pm>
|
|
||||||
<suspend-to-mem enabled='no'/>
|
|
||||||
<suspend-to-disk enabled='no'/>
|
|
||||||
</pm>
|
|
||||||
<devices>
|
|
||||||
<emulator>/usr/bin/qemu-system-x86_64</emulator>
|
|
||||||
<disk type='file' device='disk'>
|
|
||||||
<driver name='qemu' type='qcow2' cache='writeback'/>
|
|
||||||
<source file='/var/lib/libvirt/images/fedora-headless.snap-2025-05-27'/>
|
|
||||||
<backingStore type='file'>
|
|
||||||
<format type='qcow2'/>
|
|
||||||
<source file='/var/lib/libvirt/images/fedora-headless.qcow2'/>
|
|
||||||
<backingStore/>
|
|
||||||
</backingStore>
|
|
||||||
<target dev='sda' bus='virtio'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
|
|
||||||
</disk>
|
|
||||||
<disk type='block' device='disk'>
|
|
||||||
<driver name='qemu' type='raw'/>
|
|
||||||
<source dev='/dev/nvme0n1'/>
|
|
||||||
<target dev='sdb' bus='virtio'/>
|
|
||||||
</disk>
|
|
||||||
<controller type='usb' index='0' model='qemu-xhci' ports='15'>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='sata' index='0'>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='0' model='pcie-root'/>
|
|
||||||
<controller type='pci' index='1' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='1' port='0x8'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0' multifunction='on'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='2' model='pcie-to-pci-bridge'>
|
|
||||||
<model name='pcie-pci-bridge'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='3' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='3' port='0x9'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='4' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='4' port='0xa'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='5' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='5' port='0xb'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x3'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='6' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='6' port='0xc'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x4'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='7' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='7' port='0xd'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x5'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='8' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='8' port='0xe'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x6'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='9' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='9' port='0xf'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x7'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='10' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='10' port='0x10'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='11' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='11' port='0x11'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='12' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='12' port='0x12'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='13' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='13' port='0x13'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='14' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='14' port='0x14'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='15' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='15' port='0x15'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='16' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='16' port='0x16'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='virtio-serial' index='0'>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='ccid' index='0'>
|
|
||||||
<address type='usb' bus='0' port='1'/>
|
|
||||||
</controller>
|
|
||||||
<filesystem type='mount' accessmode='passthrough'>
|
|
||||||
<driver type='virtiofs'/>
|
|
||||||
<source dir='/media'/>
|
|
||||||
<target dir='Media'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x08' slot='0x00' function='0x0'/>
|
|
||||||
</filesystem>
|
|
||||||
<interface type='bridge'>
|
|
||||||
<mac address='52:54:00:ae:f3:d0'/>
|
|
||||||
<source bridge='bridge0'/>
|
|
||||||
<model type='virtio'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
|
|
||||||
</interface>
|
|
||||||
<serial type='pty'>
|
|
||||||
<target type='isa-serial' port='0'>
|
|
||||||
<model name='isa-serial'/>
|
|
||||||
</target>
|
|
||||||
</serial>
|
|
||||||
<console type='pty'>
|
|
||||||
<target type='serial' port='0'/>
|
|
||||||
</console>
|
|
||||||
<input type='mouse' bus='ps2'/>
|
|
||||||
<input type='keyboard' bus='ps2'/>
|
|
||||||
<tpm model='tpm-tis'>
|
|
||||||
<backend type='emulator' version='2.0'/>
|
|
||||||
</tpm>
|
|
||||||
<audio id='1' type='none'/>
|
|
||||||
<hostdev mode='subsystem' type='pci' managed='yes'>
|
|
||||||
<source>
|
|
||||||
<address domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
|
|
||||||
</source>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x09' slot='0x00' function='0x0'/>
|
|
||||||
</hostdev>
|
|
||||||
<hostdev mode='subsystem' type='pci' managed='yes'>
|
|
||||||
<source>
|
|
||||||
<address domain='0x0000' bus='0x03' slot='0x00' function='0x1'/>
|
|
||||||
</source>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x0a' slot='0x00' function='0x0'/>
|
|
||||||
</hostdev>
|
|
||||||
<memballoon model='virtio'>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
|
|
||||||
</memballoon>
|
|
||||||
</devices>
|
|
||||||
</domain>
|
|
||||||
|
|
||||||
@@ -1,220 +0,0 @@
|
|||||||
<domain type='kvm'>
|
|
||||||
<name>fedora-headless</name>
|
|
||||||
<uuid>55feda16-51ae-446e-9c83-4c0eee1e5e00</uuid>
|
|
||||||
<title>Fedora CUDA headless</title>
|
|
||||||
<memory unit='KiB'>33554432</memory>
|
|
||||||
<currentMemory unit='KiB'>33554432</currentMemory>
|
|
||||||
<memoryBacking>
|
|
||||||
<hugepages/>
|
|
||||||
<source type='memfd'/>
|
|
||||||
<access mode='shared'/>
|
|
||||||
</memoryBacking>
|
|
||||||
<vcpu placement='static'>10</vcpu>
|
|
||||||
<cputune>
|
|
||||||
<vcpupin vcpu='0' cpuset='1'/>
|
|
||||||
<vcpupin vcpu='1' cpuset='7'/>
|
|
||||||
<vcpupin vcpu='2' cpuset='2'/>
|
|
||||||
<vcpupin vcpu='3' cpuset='8'/>
|
|
||||||
<vcpupin vcpu='4' cpuset='3'/>
|
|
||||||
<vcpupin vcpu='5' cpuset='9'/>
|
|
||||||
<vcpupin vcpu='6' cpuset='4'/>
|
|
||||||
<vcpupin vcpu='7' cpuset='10'/>
|
|
||||||
<vcpupin vcpu='8' cpuset='5'/>
|
|
||||||
<vcpupin vcpu='9' cpuset='11'/>
|
|
||||||
<emulatorpin cpuset='0,6'/>
|
|
||||||
</cputune>
|
|
||||||
<os>
|
|
||||||
<type arch='x86_64' machine='pc-q35-7.0'>hvm</type>
|
|
||||||
<loader readonly='yes' secure='no' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.fd</loader>
|
|
||||||
<nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/fedora-headless_VARS.fd</nvram>
|
|
||||||
<boot dev='hd'/>
|
|
||||||
<bootmenu enable='no'/>
|
|
||||||
</os>
|
|
||||||
<features>
|
|
||||||
<acpi/>
|
|
||||||
<apic/>
|
|
||||||
<smm state='on'/>
|
|
||||||
</features>
|
|
||||||
<cpu mode='host-passthrough' check='none' migratable='on'>
|
|
||||||
<topology sockets='1' dies='1' cores='5' threads='2'/>
|
|
||||||
</cpu>
|
|
||||||
<clock offset='localtime'>
|
|
||||||
<timer name='rtc' tickpolicy='catchup'/>
|
|
||||||
<timer name='pit' tickpolicy='delay'/>
|
|
||||||
<timer name='hpet' present='no'/>
|
|
||||||
<timer name='kvmclock' present='yes'/>
|
|
||||||
</clock>
|
|
||||||
<on_poweroff>destroy</on_poweroff>
|
|
||||||
<on_reboot>restart</on_reboot>
|
|
||||||
<on_crash>destroy</on_crash>
|
|
||||||
<pm>
|
|
||||||
<suspend-to-mem enabled='no'/>
|
|
||||||
<suspend-to-disk enabled='no'/>
|
|
||||||
</pm>
|
|
||||||
<devices>
|
|
||||||
<emulator>/usr/bin/qemu-system-x86_64</emulator>
|
|
||||||
<disk type='file' device='disk'>
|
|
||||||
<driver name='qemu' type='qcow2' cache='writeback'/>
|
|
||||||
<source file='/var/lib/libvirt/images/fedora-headless.snap-2025-05-27'/>
|
|
||||||
<backingStore type='file'>
|
|
||||||
<format type='qcow2'/>
|
|
||||||
<source file='/var/lib/libvirt/images/fedora-headless.qcow2'/>
|
|
||||||
<backingStore/>
|
|
||||||
</backingStore>
|
|
||||||
<target dev='sda' bus='virtio'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
|
|
||||||
</disk>
|
|
||||||
<controller type='usb' index='0' model='qemu-xhci' ports='15'>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='sata' index='0'>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='0' model='pcie-root'/>
|
|
||||||
<controller type='pci' index='1' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='1' port='0x8'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0' multifunction='on'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='2' model='pcie-to-pci-bridge'>
|
|
||||||
<model name='pcie-pci-bridge'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='3' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='3' port='0x9'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='4' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='4' port='0xa'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='5' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='5' port='0xb'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x3'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='6' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='6' port='0xc'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x4'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='7' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='7' port='0xd'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x5'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='8' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='8' port='0xe'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x6'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='9' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='9' port='0xf'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x7'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='10' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='10' port='0x10'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='11' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='11' port='0x11'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='12' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='12' port='0x12'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='13' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='13' port='0x13'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='14' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='14' port='0x14'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='15' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='15' port='0x15'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='16' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='16' port='0x16'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='virtio-serial' index='0'>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='ccid' index='0'>
|
|
||||||
<address type='usb' bus='0' port='1'/>
|
|
||||||
</controller>
|
|
||||||
<filesystem type='mount' accessmode='passthrough'>
|
|
||||||
<driver type='virtiofs'/>
|
|
||||||
<source dir='/media'/>
|
|
||||||
<target dir='Media'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x08' slot='0x00' function='0x0'/>
|
|
||||||
</filesystem>
|
|
||||||
<interface type='bridge'>
|
|
||||||
<mac address='52:54:00:ae:f3:d0'/>
|
|
||||||
<source bridge='bridge0'/>
|
|
||||||
<model type='virtio'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
|
|
||||||
</interface>
|
|
||||||
<serial type='pty'>
|
|
||||||
<target type='isa-serial' port='0'>
|
|
||||||
<model name='isa-serial'/>
|
|
||||||
</target>
|
|
||||||
</serial>
|
|
||||||
<console type='pty'>
|
|
||||||
<target type='serial' port='0'/>
|
|
||||||
</console>
|
|
||||||
<input type='mouse' bus='ps2'/>
|
|
||||||
<input type='keyboard' bus='ps2'/>
|
|
||||||
<tpm model='tpm-tis'>
|
|
||||||
<backend type='emulator' version='2.0'/>
|
|
||||||
</tpm>
|
|
||||||
<audio id='1' type='none'/>
|
|
||||||
<hostdev mode='subsystem' type='pci' managed='yes'>
|
|
||||||
<source>
|
|
||||||
<address domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
|
|
||||||
</source>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x09' slot='0x00' function='0x0'/>
|
|
||||||
</hostdev>
|
|
||||||
<hostdev mode='subsystem' type='pci' managed='yes'>
|
|
||||||
<source>
|
|
||||||
<address domain='0x0000' bus='0x03' slot='0x00' function='0x1'/>
|
|
||||||
</source>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x0a' slot='0x00' function='0x0'/>
|
|
||||||
</hostdev>
|
|
||||||
<hostdev mode='subsystem' type='pci' managed='yes'>
|
|
||||||
<source>
|
|
||||||
<address domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
|
|
||||||
</source>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x0c' slot='0x00' function='0x0'/>
|
|
||||||
</hostdev>
|
|
||||||
<hostdev mode='subsystem' type='pci' managed='yes'>
|
|
||||||
<source>
|
|
||||||
<address domain='0x0000' bus='0x01' slot='0x00' function='0x1'/>
|
|
||||||
</source>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x0f' slot='0x00' function='0x0'/>
|
|
||||||
</hostdev>
|
|
||||||
<hostdev mode='subsystem' type='pci' managed='yes'>
|
|
||||||
<source>
|
|
||||||
<address domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
|
|
||||||
</source>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x10' slot='0x00' function='0x0'/>
|
|
||||||
</hostdev>
|
|
||||||
<memballoon model='virtio'>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
|
|
||||||
</memballoon>
|
|
||||||
</devices>
|
|
||||||
</domain>
|
|
||||||
|
|
||||||
@@ -1,300 +0,0 @@
|
|||||||
<domain type='kvm' id='1'>
|
|
||||||
<name>windows-11</name>
|
|
||||||
<uuid>51d5d091-67cb-4113-bd8e-817e7317e1b4</uuid>
|
|
||||||
<title>Microsoft Windows 11</title>
|
|
||||||
<memory unit='KiB'>25165824</memory>
|
|
||||||
<currentMemory unit='KiB'>25165824</currentMemory>
|
|
||||||
<memoryBacking>
|
|
||||||
<hugepages/>
|
|
||||||
<source type='memfd'/>
|
|
||||||
<access mode='shared'/>
|
|
||||||
</memoryBacking>
|
|
||||||
<vcpu placement='static'>10</vcpu>
|
|
||||||
<cputune>
|
|
||||||
<vcpupin vcpu='0' cpuset='1'/>
|
|
||||||
<vcpupin vcpu='1' cpuset='7'/>
|
|
||||||
<vcpupin vcpu='2' cpuset='2'/>
|
|
||||||
<vcpupin vcpu='3' cpuset='8'/>
|
|
||||||
<vcpupin vcpu='4' cpuset='3'/>
|
|
||||||
<vcpupin vcpu='5' cpuset='9'/>
|
|
||||||
<vcpupin vcpu='6' cpuset='4'/>
|
|
||||||
<vcpupin vcpu='7' cpuset='10'/>
|
|
||||||
<vcpupin vcpu='8' cpuset='5'/>
|
|
||||||
<vcpupin vcpu='9' cpuset='11'/>
|
|
||||||
<emulatorpin cpuset='0,6'/>
|
|
||||||
</cputune>
|
|
||||||
<resource>
|
|
||||||
<partition>/machine</partition>
|
|
||||||
</resource>
|
|
||||||
<os>
|
|
||||||
<type arch='x86_64' machine='pc-q35-7.0'>hvm</type>
|
|
||||||
<loader readonly='yes' secure='yes' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader>
|
|
||||||
<nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/windows-11_VARS.fd</nvram>
|
|
||||||
<boot dev='hd'/>
|
|
||||||
<bootmenu enable='no'/>
|
|
||||||
</os>
|
|
||||||
<features>
|
|
||||||
<acpi/>
|
|
||||||
<apic/>
|
|
||||||
<hyperv mode='custom'>
|
|
||||||
<relaxed state='on'/>
|
|
||||||
<vapic state='on'/>
|
|
||||||
<spinlocks state='on' retries='8191'/>
|
|
||||||
<vendor_id state='on' value='whatever'/>
|
|
||||||
</hyperv>
|
|
||||||
<kvm>
|
|
||||||
<hidden state='on'/>
|
|
||||||
</kvm>
|
|
||||||
<smm state='on'/>
|
|
||||||
</features>
|
|
||||||
<cpu mode='host-passthrough' check='none' migratable='on'>
|
|
||||||
<topology sockets='1' dies='1' cores='5' threads='2'/>
|
|
||||||
</cpu>
|
|
||||||
<clock offset='localtime'>
|
|
||||||
<timer name='rtc' tickpolicy='catchup'/>
|
|
||||||
<timer name='pit' tickpolicy='delay'/>
|
|
||||||
<timer name='hpet' present='no'/>
|
|
||||||
<timer name='kvmclock' present='yes'/>
|
|
||||||
<timer name='hypervclock' present='yes'/>
|
|
||||||
</clock>
|
|
||||||
<on_poweroff>destroy</on_poweroff>
|
|
||||||
<on_reboot>restart</on_reboot>
|
|
||||||
<on_crash>destroy</on_crash>
|
|
||||||
<pm>
|
|
||||||
<suspend-to-mem enabled='no'/>
|
|
||||||
<suspend-to-disk enabled='no'/>
|
|
||||||
</pm>
|
|
||||||
<devices>
|
|
||||||
<emulator>/usr/bin/qemu-system-x86_64</emulator>
|
|
||||||
<disk type='file' device='disk'>
|
|
||||||
<driver name='qemu' type='qcow2' cache='writeback'/>
|
|
||||||
<source file='/var/lib/libvirt/images/windows-11.qcow2' index='2'/>
|
|
||||||
<backingStore/>
|
|
||||||
<target dev='sda' bus='virtio'/>
|
|
||||||
<alias name='virtio-disk0'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
|
|
||||||
</disk>
|
|
||||||
<disk type='file' device='cdrom'>
|
|
||||||
<driver name='qemu'/>
|
|
||||||
<target dev='hdc' bus='sata'/>
|
|
||||||
<readonly/>
|
|
||||||
<alias name='sata0-0-2'/>
|
|
||||||
<address type='drive' controller='0' bus='0' target='0' unit='2'/>
|
|
||||||
</disk>
|
|
||||||
<controller type='usb' index='0' model='qemu-xhci' ports='15'>
|
|
||||||
<alias name='usb'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='sata' index='0'>
|
|
||||||
<alias name='ide'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='0' model='pcie-root'>
|
|
||||||
<alias name='pcie.0'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='1' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='1' port='0x8'/>
|
|
||||||
<alias name='pci.1'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0' multifunction='on'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='2' model='pcie-to-pci-bridge'>
|
|
||||||
<model name='pcie-pci-bridge'/>
|
|
||||||
<alias name='pci.2'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='3' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='3' port='0x9'/>
|
|
||||||
<alias name='pci.3'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='4' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='4' port='0xa'/>
|
|
||||||
<alias name='pci.4'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='5' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='5' port='0xb'/>
|
|
||||||
<alias name='pci.5'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x3'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='6' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='6' port='0xc'/>
|
|
||||||
<alias name='pci.6'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x4'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='7' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='7' port='0xd'/>
|
|
||||||
<alias name='pci.7'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x5'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='8' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='8' port='0xe'/>
|
|
||||||
<alias name='pci.8'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x6'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='9' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='9' port='0xf'/>
|
|
||||||
<alias name='pci.9'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x7'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='10' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='10' port='0x10'/>
|
|
||||||
<alias name='pci.10'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='11' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='11' port='0x11'/>
|
|
||||||
<alias name='pci.11'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='12' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='12' port='0x12'/>
|
|
||||||
<alias name='pci.12'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='13' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='13' port='0x13'/>
|
|
||||||
<alias name='pci.13'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='14' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='14' port='0x14'/>
|
|
||||||
<alias name='pci.14'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='15' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='15' port='0x15'/>
|
|
||||||
<alias name='pci.15'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='16' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='16' port='0x16'/>
|
|
||||||
<alias name='pci.16'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='virtio-serial' index='0'>
|
|
||||||
<alias name='virtio-serial0'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='ccid' index='0'>
|
|
||||||
<alias name='ccid0'/>
|
|
||||||
<address type='usb' bus='0' port='1'/>
|
|
||||||
</controller>
|
|
||||||
<filesystem type='mount' accessmode='passthrough'>
|
|
||||||
<driver type='virtiofs'/>
|
|
||||||
<binary path='/usr/libexec/virtiofsd'/>
|
|
||||||
<source dir='/media'/>
|
|
||||||
<target dir='Media'/>
|
|
||||||
<alias name='fs0'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x08' slot='0x00' function='0x0'/>
|
|
||||||
</filesystem>
|
|
||||||
<interface type='bridge'>
|
|
||||||
<mac address='52:54:00:cd:dd:2d'/>
|
|
||||||
<source bridge='bridge0'/>
|
|
||||||
<target dev='vnet0'/>
|
|
||||||
<model type='virtio'/>
|
|
||||||
<alias name='net0'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x0e' slot='0x00' function='0x0'/>
|
|
||||||
</interface>
|
|
||||||
<input type='tablet' bus='usb'>
|
|
||||||
<alias name='input0'/>
|
|
||||||
<address type='usb' bus='0' port='2'/>
|
|
||||||
</input>
|
|
||||||
<input type='mouse' bus='ps2'>
|
|
||||||
<alias name='input1'/>
|
|
||||||
</input>
|
|
||||||
<input type='keyboard' bus='ps2'>
|
|
||||||
<alias name='input2'/>
|
|
||||||
</input>
|
|
||||||
<tpm model='tpm-tis'>
|
|
||||||
<backend type='emulator' version='2.0'/>
|
|
||||||
<alias name='tpm0'/>
|
|
||||||
</tpm>
|
|
||||||
<audio id='1' type='none'/>
|
|
||||||
<hostdev mode='subsystem' type='pci' managed='yes'>
|
|
||||||
<driver name='vfio'/>
|
|
||||||
<source>
|
|
||||||
<address domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
|
|
||||||
</source>
|
|
||||||
<alias name='hostdev0'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
|
|
||||||
</hostdev>
|
|
||||||
<hostdev mode='subsystem' type='pci' managed='yes'>
|
|
||||||
<driver name='vfio'/>
|
|
||||||
<source>
|
|
||||||
<address domain='0x0000' bus='0x03' slot='0x00' function='0x1'/>
|
|
||||||
</source>
|
|
||||||
<alias name='hostdev1'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x09' slot='0x00' function='0x0'/>
|
|
||||||
</hostdev>
|
|
||||||
<hostdev mode='subsystem' type='pci' managed='yes'>
|
|
||||||
<driver name='vfio'/>
|
|
||||||
<source>
|
|
||||||
<address domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
|
|
||||||
</source>
|
|
||||||
<alias name='hostdev2'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x10' slot='0x00' function='0x0'/>
|
|
||||||
</hostdev>
|
|
||||||
<hostdev mode='subsystem' type='pci' managed='yes'>
|
|
||||||
<driver name='vfio'/>
|
|
||||||
<source>
|
|
||||||
<address domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
|
|
||||||
</source>
|
|
||||||
<alias name='hostdev3'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x0b' slot='0x00' function='0x0'/>
|
|
||||||
</hostdev>
|
|
||||||
<hostdev mode='subsystem' type='pci' managed='yes'>
|
|
||||||
<driver name='vfio'/>
|
|
||||||
<source>
|
|
||||||
<address domain='0x0000' bus='0x01' slot='0x00' function='0x1'/>
|
|
||||||
</source>
|
|
||||||
<alias name='hostdev4'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x0f' slot='0x00' function='0x0'/>
|
|
||||||
</hostdev>
|
|
||||||
<hostdev mode='subsystem' type='usb' managed='yes'>
|
|
||||||
<source>
|
|
||||||
<vendor id='0x1462'/>
|
|
||||||
<product id='0x7c75'/>
|
|
||||||
<address bus='1' device='3'/>
|
|
||||||
</source>
|
|
||||||
<alias name='hostdev5'/>
|
|
||||||
<address type='usb' bus='0' port='3'/>
|
|
||||||
</hostdev>
|
|
||||||
<hostdev mode='subsystem' type='pci' managed='yes'>
|
|
||||||
<driver name='vfio'/>
|
|
||||||
<source>
|
|
||||||
<address domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
|
|
||||||
</source>
|
|
||||||
<alias name='hostdev6'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x0c' slot='0x00' function='0x0'/>
|
|
||||||
</hostdev>
|
|
||||||
<memballoon model='virtio'>
|
|
||||||
<alias name='balloon0'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
|
|
||||||
</memballoon>
|
|
||||||
</devices>
|
|
||||||
<seclabel type='dynamic' model='selinux' relabel='yes'>
|
|
||||||
<label>system_u:system_r:svirt_t:s0:c399,c880</label>
|
|
||||||
<imagelabel>system_u:object_r:svirt_image_t:s0:c399,c880</imagelabel>
|
|
||||||
</seclabel>
|
|
||||||
<seclabel type='dynamic' model='dac' relabel='yes'>
|
|
||||||
<label>+107:+107</label>
|
|
||||||
<imagelabel>+107:+107</imagelabel>
|
|
||||||
</seclabel>
|
|
||||||
</domain>
|
|
||||||
|
|
||||||
@@ -1,224 +0,0 @@
|
|||||||
<domain type='kvm'>
|
|
||||||
<name>windows-11</name>
|
|
||||||
<uuid>51d5d091-67cb-4113-bd8e-817e7317e1b4</uuid>
|
|
||||||
<title>Microsoft Windows 11</title>
|
|
||||||
<memory unit='KiB'>25165824</memory>
|
|
||||||
<currentMemory unit='KiB'>25165824</currentMemory>
|
|
||||||
<memoryBacking>
|
|
||||||
<hugepages/>
|
|
||||||
<source type='memfd'/>
|
|
||||||
<access mode='shared'/>
|
|
||||||
</memoryBacking>
|
|
||||||
<vcpu placement='static'>8</vcpu>
|
|
||||||
<cputune>
|
|
||||||
<vcpupin vcpu='0' cpuset='2'/>
|
|
||||||
<vcpupin vcpu='1' cpuset='8'/>
|
|
||||||
<vcpupin vcpu='2' cpuset='3'/>
|
|
||||||
<vcpupin vcpu='3' cpuset='9'/>
|
|
||||||
<vcpupin vcpu='4' cpuset='4'/>
|
|
||||||
<vcpupin vcpu='5' cpuset='10'/>
|
|
||||||
<vcpupin vcpu='6' cpuset='5'/>
|
|
||||||
<vcpupin vcpu='7' cpuset='11'/>
|
|
||||||
<emulatorpin cpuset='0,6'/>
|
|
||||||
</cputune>
|
|
||||||
<os>
|
|
||||||
<type arch='x86_64' machine='pc-q35-7.0'>hvm</type>
|
|
||||||
<loader readonly='yes' secure='yes' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader>
|
|
||||||
<nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/windows-11_VARS.fd</nvram>
|
|
||||||
<boot dev='hd'/>
|
|
||||||
<bootmenu enable='no'/>
|
|
||||||
</os>
|
|
||||||
<features>
|
|
||||||
<acpi/>
|
|
||||||
<apic/>
|
|
||||||
<hyperv mode='custom'>
|
|
||||||
<relaxed state='on'/>
|
|
||||||
<vapic state='on'/>
|
|
||||||
<spinlocks state='on' retries='8191'/>
|
|
||||||
<vendor_id state='on' value='whatever'/>
|
|
||||||
</hyperv>
|
|
||||||
<kvm>
|
|
||||||
<hidden state='on'/>
|
|
||||||
</kvm>
|
|
||||||
<smm state='on'/>
|
|
||||||
</features>
|
|
||||||
<cpu mode='host-passthrough' check='none' migratable='on'>
|
|
||||||
<topology sockets='1' dies='1' cores='4' threads='2'/>
|
|
||||||
</cpu>
|
|
||||||
<clock offset='localtime'>
|
|
||||||
<timer name='rtc' tickpolicy='catchup'/>
|
|
||||||
<timer name='pit' tickpolicy='delay'/>
|
|
||||||
<timer name='hpet' present='no'/>
|
|
||||||
<timer name='kvmclock' present='yes'/>
|
|
||||||
<timer name='hypervclock' present='yes'/>
|
|
||||||
</clock>
|
|
||||||
<on_poweroff>destroy</on_poweroff>
|
|
||||||
<on_reboot>restart</on_reboot>
|
|
||||||
<on_crash>destroy</on_crash>
|
|
||||||
<pm>
|
|
||||||
<suspend-to-mem enabled='no'/>
|
|
||||||
<suspend-to-disk enabled='no'/>
|
|
||||||
</pm>
|
|
||||||
<devices>
|
|
||||||
<emulator>/usr/bin/qemu-system-x86_64</emulator>
|
|
||||||
<disk type='file' device='disk'>
|
|
||||||
<driver name='qemu' type='qcow2' cache='writeback'/>
|
|
||||||
<source file='/var/lib/libvirt/images/windows-11.qcow2'/>
|
|
||||||
<backingStore/>
|
|
||||||
<target dev='sda' bus='virtio'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
|
|
||||||
</disk>
|
|
||||||
<disk type='block' device='disk'>
|
|
||||||
<driver name='qemu' type='raw'/>
|
|
||||||
<source dev='/dev/nvme0n1'/>
|
|
||||||
<target dev='sdb' bus='virtio'/>
|
|
||||||
</disk>
|
|
||||||
<disk type='file' device='cdrom'>
|
|
||||||
<driver name='qemu' type='raw'/>
|
|
||||||
<target dev='hdc' bus='sata'/>
|
|
||||||
<readonly/>
|
|
||||||
<address type='drive' controller='0' bus='0' target='0' unit='2'/>
|
|
||||||
</disk>
|
|
||||||
<controller type='usb' index='0' model='qemu-xhci' ports='15'>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='sata' index='0'>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='0' model='pcie-root'/>
|
|
||||||
<controller type='pci' index='1' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='1' port='0x8'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0' multifunction='on'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='2' model='pcie-to-pci-bridge'>
|
|
||||||
<model name='pcie-pci-bridge'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='3' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='3' port='0x9'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='4' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='4' port='0xa'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='5' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='5' port='0xb'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x3'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='6' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='6' port='0xc'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x4'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='7' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='7' port='0xd'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x5'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='8' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='8' port='0xe'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x6'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='9' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='9' port='0xf'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x7'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='10' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='10' port='0x10'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='11' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='11' port='0x11'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='12' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='12' port='0x12'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='13' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='13' port='0x13'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='14' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='14' port='0x14'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='15' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='15' port='0x15'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='pci' index='16' model='pcie-root-port'>
|
|
||||||
<model name='pcie-root-port'/>
|
|
||||||
<target chassis='16' port='0x16'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='virtio-serial' index='0'>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/>
|
|
||||||
</controller>
|
|
||||||
<controller type='ccid' index='0'>
|
|
||||||
<address type='usb' bus='0' port='1'/>
|
|
||||||
</controller>
|
|
||||||
<filesystem type='mount' accessmode='passthrough'>
|
|
||||||
<driver type='virtiofs'/>
|
|
||||||
<source dir='/media'/>
|
|
||||||
<target dir='Media'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x08' slot='0x00' function='0x0'/>
|
|
||||||
</filesystem>
|
|
||||||
<interface type='bridge'>
|
|
||||||
<mac address='52:54:00:cd:dd:2d'/>
|
|
||||||
<source bridge='bridge0'/>
|
|
||||||
<model type='virtio'/>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x0e' slot='0x00' function='0x0'/>
|
|
||||||
</interface>
|
|
||||||
<input type='tablet' bus='usb'>
|
|
||||||
<address type='usb' bus='0' port='2'/>
|
|
||||||
</input>
|
|
||||||
<input type='mouse' bus='ps2'/>
|
|
||||||
<input type='keyboard' bus='ps2'/>
|
|
||||||
<tpm model='tpm-tis'>
|
|
||||||
<backend type='emulator' version='2.0'/>
|
|
||||||
</tpm>
|
|
||||||
<audio id='1' type='none'/>
|
|
||||||
<hostdev mode='subsystem' type='mdev' managed='no' model='vfio-pci' display='off'>
|
|
||||||
<source>
|
|
||||||
<address uuid='5abeb24f-d6f4-4666-b495-303f15b05723'/>
|
|
||||||
</source>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0'/>
|
|
||||||
</hostdev>
|
|
||||||
<hostdev mode='subsystem' type='pci' managed='yes'>
|
|
||||||
<source>
|
|
||||||
<address domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
|
|
||||||
</source>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x10' slot='0x00' function='0x0'/>
|
|
||||||
</hostdev>
|
|
||||||
<hostdev mode='subsystem' type='pci' managed='yes'>
|
|
||||||
<source>
|
|
||||||
<address domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
|
|
||||||
</source>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x0b' slot='0x00' function='0x0'/>
|
|
||||||
</hostdev>
|
|
||||||
<hostdev mode='subsystem' type='pci' managed='yes'>
|
|
||||||
<source>
|
|
||||||
<address domain='0x0000' bus='0x01' slot='0x00' function='0x1'/>
|
|
||||||
</source>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x0f' slot='0x00' function='0x0'/>
|
|
||||||
</hostdev>
|
|
||||||
<memballoon model='virtio'>
|
|
||||||
<address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
|
|
||||||
</memballoon>
|
|
||||||
</devices>
|
|
||||||
</domain>
|
|
||||||
|
|
||||||
@@ -0,0 +1,189 @@
|
|||||||
|
hostname: vh-01.alexpires.local
|
||||||
|
ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}"
|
||||||
|
|
||||||
|
# Users
|
||||||
|
login_users:
|
||||||
|
- username: "{{ ansible_user }}"
|
||||||
|
comment: "Managed by Ansible"
|
||||||
|
sudoer: true
|
||||||
|
sudoer_root_only: true
|
||||||
|
sudoer_no_password: true
|
||||||
|
pubkey: "{{ lookup('file', 'keys/ansible_user.pub') }}"
|
||||||
|
password_disabled: true
|
||||||
|
- username: operator
|
||||||
|
comment: "Managed by Ansible"
|
||||||
|
sudoer: true
|
||||||
|
pubkey: "{{ lookup('file', 'keys/operator.pub') }}"
|
||||||
|
shell: "/bin/zsh"
|
||||||
|
password_expiration: false
|
||||||
|
|
||||||
|
# SSH Connection and security
|
||||||
|
sshd_port: 22
|
||||||
|
ssh_allowed_networks:
|
||||||
|
- "0.0.0.0/0"
|
||||||
|
sshd_admin_net: "0.0.0.0/0"
|
||||||
|
sshd_allow_groups: "{{ ansible_user }} users"
|
||||||
|
sshd_permit_root_login: "no"
|
||||||
|
sshd_password_authentication: "no"
|
||||||
|
sshd_allow_tcp_forwarding: "yes"
|
||||||
|
|
||||||
|
# Due to an issue increase the number of max auth tries
|
||||||
|
sshd_max_auth_tries: 10
|
||||||
|
|
||||||
|
# Firewall ports
|
||||||
|
ufw_enable: true
|
||||||
|
fw_allowed_ports:
|
||||||
|
- { rule: "allow", port: "22", proto: "tcp" }
|
||||||
|
- { rule: "allow", port: "9090", proto: "tcp" }
|
||||||
|
|
||||||
|
ufw_outgoing_traffic:
|
||||||
|
- 22 # SSH
|
||||||
|
- 53 # DNS
|
||||||
|
- 80 # HTTP
|
||||||
|
- 123 # NTP
|
||||||
|
- 443 # HTTPS
|
||||||
|
- 853 # DNS over TLS
|
||||||
|
|
||||||
|
ufw_default_forward_policy: "ACCEPT"
|
||||||
|
|
||||||
|
ipv4_sysctl_settings:
|
||||||
|
net.ipv4.ip_forward: 1
|
||||||
|
|
||||||
|
disable_ipv6: true
|
||||||
|
|
||||||
|
# geoip will override hosts_allow and hosts_deny (so it's disabled - CIS hardening)
|
||||||
|
custom_hosts_acls: true
|
||||||
|
|
||||||
|
# This fixes polkit issues with sudoers file (CIS hardening)
|
||||||
|
hide_pid: 0
|
||||||
|
|
||||||
|
# aide
|
||||||
|
install_aide: false
|
||||||
|
|
||||||
|
# Unattended upgrades
|
||||||
|
unattended_reboot: true
|
||||||
|
unattended_reboot_time: "04:30"
|
||||||
|
|
||||||
|
# Duo Security
|
||||||
|
duo_users: ["*", "!provision"]
|
||||||
|
duo_api_hostname: api-7cda1654.duosecurity.com
|
||||||
|
|
||||||
|
# VMs reserved CPU (for gaming and AI)
|
||||||
|
virt_vm_reserved_cpu: "1-5,7-11"
|
||||||
|
virt_raw_block_devices:
|
||||||
|
- "nvme0n1"
|
||||||
|
- "nvme0n1p1"
|
||||||
|
- "nvme0n1p2"
|
||||||
|
|
||||||
|
virt_extra_grub_args: >
|
||||||
|
i915.modeset=1 i915.enable_gvt=1 i915.enable_fbc=0
|
||||||
|
initcall_blacklist=simpledrm_platform_driver_init
|
||||||
|
rd.driver.blacklist=nouveau modprobe.blacklist=nouveau
|
||||||
|
|
||||||
|
virt_vfio_ids:
|
||||||
|
- 10de:2482 # NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
|
||||||
|
- 10de:228b # NVIDIA Corporation GA106 High Definition Audio Controller
|
||||||
|
- 10de:2504 # NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate]
|
||||||
|
- 10de:228e # NVIDIA Corporation GA106 High Definition Audio Controller
|
||||||
|
- 1b73:1100 # Fresco Logic FL1100 USB 3.0 Host Controller
|
||||||
|
|
||||||
|
virt_blacklist:
|
||||||
|
- noveau
|
||||||
|
- snd_hda_codec_hdmi
|
||||||
|
- i2c_nvidia_gpu
|
||||||
|
- mxm_wmi
|
||||||
|
|
||||||
|
virt_machines:
|
||||||
|
- name: windows-11
|
||||||
|
title: "Microsoft Windows 11"
|
||||||
|
uuid: "51d5d091-67cb-4113-bd8e-817e7317e1b4"
|
||||||
|
autostart: true
|
||||||
|
memory: 25165824
|
||||||
|
cores: 4
|
||||||
|
threads: 2
|
||||||
|
physical_cpus: "2-8,3-9,4-10,5-11"
|
||||||
|
reserved_cpus: "0,6"
|
||||||
|
enable_hyperv: true
|
||||||
|
cdrom: true
|
||||||
|
console: false
|
||||||
|
audio: true
|
||||||
|
secure_boot: true
|
||||||
|
tpm: true
|
||||||
|
tablet: true
|
||||||
|
disk_file: "windows-11.qcow2"
|
||||||
|
mac_address: "52:54:00:cd:dd:2d"
|
||||||
|
block_devs:
|
||||||
|
- block_dev: "/dev/nvme0n1"
|
||||||
|
target_dev: "sdb"
|
||||||
|
host_devs:
|
||||||
|
# Intel MDev device for GVT-g
|
||||||
|
- type: "mdev"
|
||||||
|
source:
|
||||||
|
uuid: "5abeb24f-d6f4-4666-b495-303f15b05723"
|
||||||
|
address: { type: 'pci', domain: '0x0000', bus: '0x07', slot: '0x00', function: '0x0' }
|
||||||
|
# Fresco Logic FL1100 USB 3.0 Host Controller
|
||||||
|
- type: "pci"
|
||||||
|
source:
|
||||||
|
address:
|
||||||
|
domain: "0x0000"
|
||||||
|
bus: "0x06"
|
||||||
|
slot: "0x00"
|
||||||
|
function: "0x0"
|
||||||
|
address: { type: 'pci', domain: '0x0000', bus: '0x10', slot: '0x00', function: '0x0' }
|
||||||
|
# NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
|
||||||
|
- type: "pci"
|
||||||
|
source:
|
||||||
|
address:
|
||||||
|
domain: "0x0000"
|
||||||
|
bus: "0x01"
|
||||||
|
slot: "0x00"
|
||||||
|
function: "0x0"
|
||||||
|
address: { type: 'pci', domain: '0x0000', bus: '0x0b', slot: '0x00', function: '0x0' }
|
||||||
|
# NVIDIA Corporation GA106 High Definition Audio Controller
|
||||||
|
- type: "pci"
|
||||||
|
source:
|
||||||
|
address:
|
||||||
|
domain: "0x0000"
|
||||||
|
bus: "0x01"
|
||||||
|
slot: "0x00"
|
||||||
|
function: "0x1"
|
||||||
|
address: { type: 'pci', domain: '0x0000', bus: '0x0f', slot: '0x00', function: '0x0' }
|
||||||
|
|
||||||
|
- name: fedora-headless
|
||||||
|
title: "Fedora CUDA headless"
|
||||||
|
uuid: "55feda16-51ae-446e-9c83-4c0eee1e5e00"
|
||||||
|
autostart: true
|
||||||
|
memory: 33554432
|
||||||
|
cores: 1
|
||||||
|
threads: 2
|
||||||
|
physical_cpus: "1-7"
|
||||||
|
reserved_cpus: "0,6"
|
||||||
|
cdrom: false
|
||||||
|
console: true
|
||||||
|
audio: false
|
||||||
|
secure_boot: false
|
||||||
|
tpm: true
|
||||||
|
disk_file: "fedora-headless.qcow2"
|
||||||
|
mac_address: "52:54:00:ae:f3:d0"
|
||||||
|
block_devs:
|
||||||
|
- block_dev: "/dev/nvme0n1"
|
||||||
|
target_dev: "sdb"
|
||||||
|
host_devs:
|
||||||
|
# NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate]
|
||||||
|
- type: "pci"
|
||||||
|
source:
|
||||||
|
address:
|
||||||
|
domain: "0x0000"
|
||||||
|
bus: "0x03"
|
||||||
|
slot: "0x00"
|
||||||
|
function: "0x0"
|
||||||
|
address: { type: 'pci',domain: '0x0000',bus: '0x09',slot: '0x00',function: '0x0' }
|
||||||
|
# NVIDIA Corporation GA106 High Definition Audio Controller
|
||||||
|
- type: "pci"
|
||||||
|
source:
|
||||||
|
address:
|
||||||
|
domain: "0x0000"
|
||||||
|
bus: "0x03"
|
||||||
|
slot: "0x00"
|
||||||
|
function: "0x1"
|
||||||
|
address: { type: 'pci',domain: '0x0000',bus: '0x0a',slot: '0x00',function: '0x0' }
|
||||||
@@ -1,6 +1,6 @@
|
|||||||
---
|
---
|
||||||
- name: Duo Security
|
- name: Duo Security
|
||||||
hosts: public
|
hosts: 2fa
|
||||||
gather_facts: true
|
gather_facts: true
|
||||||
|
|
||||||
roles:
|
roles:
|
||||||
|
|||||||
@@ -1,35 +1,16 @@
|
|||||||
- name: Setup GPU passthrough host (Fedora + QEMU/KVM)
|
- name: Setup GPU passthrough host (Fedora + QEMU/KVM)
|
||||||
hosts: localhost
|
hosts: virtualization
|
||||||
become: true
|
become: true
|
||||||
vars:
|
vars:
|
||||||
host_reserved_cpu: "0-1"
|
|
||||||
gaming_vm_cpus: "2-9"
|
|
||||||
ai_vm_cpus: "10-11"
|
|
||||||
vfio_ids:
|
|
||||||
- 10de:2482 # NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
|
|
||||||
- 10de:228b # NVIDIA Corporation GA106 High Definition Audio Controller
|
|
||||||
- 10de:2504 # NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate]
|
|
||||||
- 10de:228e # NVIDIA Corporation GA106 High Definition Audio Controller
|
|
||||||
- 1b73:1100 # Fresco Logic FL1100 USB 3.0 Host Controller
|
|
||||||
# - 144d:a808 # Samsung Electronics Co Ltd NVMe SSD Controller SM981/PM981/PM983
|
|
||||||
grub_config_file: "/etc/default/grub"
|
grub_config_file: "/etc/default/grub"
|
||||||
grub_cmdline_args: >
|
grub_cmdline_args: >
|
||||||
rhgb quiet intel_iommu=on iommu=pt
|
rhgb quiet intel_iommu=on iommu=pt
|
||||||
isolcpus=1-5,7-11 nohz_full=1-5,7-11 rcu_nocbs=1-5,7-11
|
isolcpus={{ virt_vm_reserved_cpu }} nohz_full={{ virt_vm_reserved_cpu }} rcu_nocbs={{ virt_vm_reserved_cpu }}
|
||||||
i915.modeset=1 i915.enable_gvt=1 i915.enable_fbc=0
|
|
||||||
initcall_blacklist=simpledrm_platform_driver_init
|
|
||||||
rd.driver.blacklist=nouveau modprobe.blacklist=nouveau
|
|
||||||
snd_hda_codec_hdmi.blacklist=1 rd.driver.pre=vfio-pci audit=off
|
snd_hda_codec_hdmi.blacklist=1 rd.driver.pre=vfio-pci audit=off
|
||||||
|
default_hugepagesz=1G hugepagesz=1G hugepages=8 mitigations=off loglevel=3 {{ virt_extra_grub_args | default("") | trim}}
|
||||||
win_partition: "/dev/nvme0n1p1"
|
|
||||||
ai_partition: "/dev/nvme0n1p2"
|
|
||||||
partitions:
|
|
||||||
- { dev: "/dev/nvme0n1p1", label: "win-nvme" }
|
|
||||||
- { dev: "/dev/nvme0n1p2", label: "ai-nvme" }
|
|
||||||
|
|
||||||
tasks:
|
tasks:
|
||||||
|
- name: Install required packages
|
||||||
- name: Install virtualization packages
|
|
||||||
ansible.builtin.dnf:
|
ansible.builtin.dnf:
|
||||||
name:
|
name:
|
||||||
- qemu-kvm
|
- qemu-kvm
|
||||||
@@ -38,6 +19,9 @@
|
|||||||
- virt-manager
|
- virt-manager
|
||||||
- bridge-utils
|
- bridge-utils
|
||||||
- pciutils
|
- pciutils
|
||||||
|
- tuned
|
||||||
|
- python3-lxml
|
||||||
|
- python3-libvirt
|
||||||
state: present
|
state: present
|
||||||
|
|
||||||
- name: Enable and start libvirtd
|
- name: Enable and start libvirtd
|
||||||
@@ -52,24 +36,22 @@
|
|||||||
regexp: '^GRUB_CMDLINE_LINUX='
|
regexp: '^GRUB_CMDLINE_LINUX='
|
||||||
line: 'GRUB_CMDLINE_LINUX="{{ grub_cmdline_args | trim }}"'
|
line: 'GRUB_CMDLINE_LINUX="{{ grub_cmdline_args | trim }}"'
|
||||||
backrefs: true
|
backrefs: true
|
||||||
|
notify: Rebuild GRUB config
|
||||||
|
|
||||||
- name: Add VFIO PCI device IDs to modprobe
|
- name: Add VFIO PCI device IDs to modprobe
|
||||||
ansible.builtin.copy:
|
ansible.builtin.copy:
|
||||||
dest: /etc/modprobe.d/vfio.conf
|
dest: /etc/modprobe.d/vfio.conf
|
||||||
content: |
|
content: |
|
||||||
options vfio-pci ids={{ vfio_ids | join(',') }}
|
options vfio-pci ids={{ virt_vfio_ids | join(',') }}
|
||||||
install snd_hda_codec_hdmi /bin/false
|
install snd_hda_codec_hdmi /bin/false
|
||||||
mode: '0644'
|
mode: '0644'
|
||||||
|
|
||||||
- name: Blacklist Nouveau and other drivers
|
- name: Blacklist Nouveau and other drivers
|
||||||
ansible.builtin.copy:
|
ansible.builtin.template:
|
||||||
|
src: blacklist.conf.j2
|
||||||
dest: /etc/modprobe.d/ansible-blacklist.conf
|
dest: /etc/modprobe.d/ansible-blacklist.conf
|
||||||
content: |
|
|
||||||
blacklist noveau
|
|
||||||
blacklist snd_hda_codec_hdmi
|
|
||||||
blacklist i2c_nvidia_gpu
|
|
||||||
blacklist mxm_wmi
|
|
||||||
mode: '0644'
|
mode: '0644'
|
||||||
|
when: virt_blacklist is defined
|
||||||
|
|
||||||
- name: Add vfio modules to initramfs config
|
- name: Add vfio modules to initramfs config
|
||||||
ansible.builtin.copy:
|
ansible.builtin.copy:
|
||||||
@@ -77,15 +59,14 @@
|
|||||||
content: |
|
content: |
|
||||||
add_drivers+=" vfio vfio_iommu_type1 vfio_pci "
|
add_drivers+=" vfio vfio_iommu_type1 vfio_pci "
|
||||||
mode: '0644'
|
mode: '0644'
|
||||||
|
notify: Rebuild initramfs
|
||||||
|
|
||||||
- name: Rebuild initramfs
|
- name: Configure hugepages
|
||||||
changed_when: false
|
ansible.posix.sysctl:
|
||||||
ansible.builtin.command: dracut -f
|
name: vm.nr_hugepages
|
||||||
|
value: "{{ hugepages_count | default('2048') }}"
|
||||||
- name: Rebuild GRUB config
|
state: present
|
||||||
changed_when: false
|
reload: true
|
||||||
ansible.builtin.command: grub2-mkconfig -o /boot/grub2/grub.cfg
|
|
||||||
when: ansible_facts['distribution'] == "Fedora"
|
|
||||||
|
|
||||||
- name: Enable KVM modules at boot
|
- name: Enable KVM modules at boot
|
||||||
ansible.builtin.copy:
|
ansible.builtin.copy:
|
||||||
@@ -98,40 +79,62 @@
|
|||||||
vfio_iommu_type1
|
vfio_iommu_type1
|
||||||
mode: '0644'
|
mode: '0644'
|
||||||
|
|
||||||
|
- name: Set I/O scheduler to 'none' for NVMes
|
||||||
|
ansible.builtin.copy:
|
||||||
|
dest: /etc/udev/rules.d/60-ioscheduler.rules
|
||||||
|
content: |
|
||||||
|
ACTION=="add|change", KERNEL=="nvme[0-9]*", ATTR{queue/scheduler}="none"
|
||||||
|
mode: '0644'
|
||||||
|
notify:
|
||||||
|
- Reload udev rules
|
||||||
|
- Trigger udev to apply changes
|
||||||
|
|
||||||
|
- name: Activate virtual-host tuned profile
|
||||||
|
ansible.builtin.command: tuned-adm profile virtual-host
|
||||||
|
changed_when: false
|
||||||
|
|
||||||
|
- name: Set permissions for partition passthrough
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "/dev/{{ item }}"
|
||||||
|
owner: qemu
|
||||||
|
group: kvm
|
||||||
|
mode: '0660'
|
||||||
|
loop: "{{ virt_raw_block_devices }}"
|
||||||
|
|
||||||
|
- name: Create udev rules for persistent access
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: 99-qemu-nvme.rules.j2
|
||||||
|
dest: /etc/udev/rules.d/99-qemu-nvme.rules
|
||||||
|
mode: '0644'
|
||||||
|
notify:
|
||||||
|
- Reload udev rules
|
||||||
|
- Trigger udev to apply changes
|
||||||
|
|
||||||
|
- name: Create or update virtual machine
|
||||||
|
vars:
|
||||||
|
vm: "{{ item }}"
|
||||||
|
loop: "{{ virt_machines }}"
|
||||||
|
community.libvirt.virt:
|
||||||
|
autostart: "{{ vm.autostart | default(false) }}"
|
||||||
|
name: "{{ vm.name }}"
|
||||||
|
state: running
|
||||||
|
command: define
|
||||||
|
xml: "{{ lookup('template', 'domain.xml.j2') }}"
|
||||||
|
|
||||||
|
- name: Ensure virtual machines are running
|
||||||
|
vars:
|
||||||
|
vm: "{{ item }}"
|
||||||
|
loop: "{{ virt_machines }}"
|
||||||
|
community.libvirt.virt:
|
||||||
|
name: "{{ vm.name }}"
|
||||||
|
state: running
|
||||||
|
|
||||||
- name: Notify user to reboot for changes
|
- name: Notify user to reboot for changes
|
||||||
ansible.builtin.debug:
|
ansible.builtin.debug:
|
||||||
msg: |
|
msg: |
|
||||||
Reboot your system to apply IOMMU, CPU isolation, and VFIO settings.
|
Reboot your system to apply IOMMU, CPU isolation, and VFIO settings.
|
||||||
After reboot, verify using: `dmesg | grep -i vfio` and `lspci -nnk`
|
After reboot, verify using: `dmesg | grep -i vfio` and `lspci -nnk`
|
||||||
|
|
||||||
- name: Ensure partitions are unmounted
|
|
||||||
ansible.posix.mount:
|
|
||||||
path: "/mnt/{{ item.label }}"
|
|
||||||
src: "{{ item.dev }}"
|
|
||||||
state: absent
|
|
||||||
fstype: auto
|
|
||||||
loop: "{{ partitions }}"
|
|
||||||
|
|
||||||
- name: Set permissions for partition passthrough
|
|
||||||
ansible.builtin.file:
|
|
||||||
path: "{{ item.dev }}"
|
|
||||||
owner: qemu
|
|
||||||
group: kvm
|
|
||||||
mode: '0660'
|
|
||||||
loop: "{{ partitions }}"
|
|
||||||
|
|
||||||
- name: Create udev rules for persistent access
|
|
||||||
ansible.builtin.copy:
|
|
||||||
dest: /etc/udev/rules.d/99-qemu-nvme.rules
|
|
||||||
content: |
|
|
||||||
KERNEL=="nvme0n1", OWNER="qemu", GROUP="kvm", MODE="0660"
|
|
||||||
KERNEL=="nvme0n1p1", OWNER="qemu", GROUP="kvm", MODE="0660"
|
|
||||||
KERNEL=="nvme0n1p2", OWNER="qemu", GROUP="kvm", MODE="0660"
|
|
||||||
mode: '0644'
|
|
||||||
notify:
|
|
||||||
- Reload udev rules
|
|
||||||
- Trigger udev to apply changes
|
|
||||||
|
|
||||||
handlers:
|
handlers:
|
||||||
- name: Reload udev rules
|
- name: Reload udev rules
|
||||||
changed_when: false
|
changed_when: false
|
||||||
@@ -140,3 +143,12 @@
|
|||||||
- name: Trigger udev to apply changes
|
- name: Trigger udev to apply changes
|
||||||
changed_when: false
|
changed_when: false
|
||||||
ansible.builtin.command: udevadm trigger
|
ansible.builtin.command: udevadm trigger
|
||||||
|
|
||||||
|
- name: Rebuild initramfs
|
||||||
|
changed_when: false
|
||||||
|
ansible.builtin.command: dracut -f
|
||||||
|
|
||||||
|
- name: Rebuild GRUB config
|
||||||
|
changed_when: false
|
||||||
|
ansible.builtin.command: grub2-mkconfig -o /boot/grub2/grub.cfg
|
||||||
|
when: ansible_facts['distribution'] == "Fedora"
|
||||||
@@ -2,3 +2,5 @@
|
|||||||
collections:
|
collections:
|
||||||
- ansible.posix
|
- ansible.posix
|
||||||
- community.general
|
- community.general
|
||||||
|
- containers.podman
|
||||||
|
- community.libvirt
|
||||||
|
|||||||
@@ -12,7 +12,18 @@
|
|||||||
- CCE-80785-9
|
- CCE-80785-9
|
||||||
- systemd
|
- systemd
|
||||||
|
|
||||||
- name: Disable systemd ctrl-alt-del - RedHat family
|
- name: Remove existing symlink for ctrl-alt-del.target if it exists
|
||||||
|
become: true
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: /etc/systemd/system/ctrl-alt-del.target
|
||||||
|
state: absent
|
||||||
|
when: ansible_os_family == "RedHat"
|
||||||
|
tags:
|
||||||
|
- ctrl-alt-del
|
||||||
|
- CCE-80785-9
|
||||||
|
- systemd
|
||||||
|
|
||||||
|
- name: Mask ctrl-alt-del.target to disable Ctrl+Alt+Del
|
||||||
become: true
|
become: true
|
||||||
ansible.builtin.systemd:
|
ansible.builtin.systemd:
|
||||||
name: ctrl-alt-del.target
|
name: ctrl-alt-del.target
|
||||||
@@ -25,4 +36,4 @@
|
|||||||
- ctrl-alt-del
|
- ctrl-alt-del
|
||||||
- CCE-80785-9
|
- CCE-80785-9
|
||||||
- systemd
|
- systemd
|
||||||
...
|
|
||||||
|
|||||||
@@ -5,13 +5,17 @@
|
|||||||
name: "{{ item }}"
|
name: "{{ item }}"
|
||||||
state: absent
|
state: absent
|
||||||
remove: true
|
remove: true
|
||||||
|
loop: "{{ delete_users }}"
|
||||||
register: remove_users
|
register: remove_users
|
||||||
with_items:
|
ignore_errors: true
|
||||||
- "{{ delete_users }}"
|
tags:
|
||||||
failed_when: >
|
- users
|
||||||
remove_users is not success and
|
|
||||||
not ("not removing" in remove_users.msg or
|
- name: Show warning for users that could not be removed
|
||||||
"not found" in remove_users.msg)
|
debug:
|
||||||
|
msg: "Could not remove user '{{ item.item }}'. Error: {{ item.msg | default('unknown error') }}"
|
||||||
|
loop: "{{ remove_users.results | selectattr('failed', 'equalto', true) | list }}"
|
||||||
|
when: remove_users is defined
|
||||||
tags:
|
tags:
|
||||||
- users
|
- users
|
||||||
|
|
||||||
|
|||||||
@@ -47,9 +47,9 @@
|
|||||||
- name: Add Duo Source (RedHat)
|
- name: Add Duo Source (RedHat)
|
||||||
become: true
|
become: true
|
||||||
ansible.builtin.yum_repository:
|
ansible.builtin.yum_repository:
|
||||||
name: Duo Security
|
name: duo-security
|
||||||
description: Duo Security Repository
|
description: Duo Security Repository
|
||||||
baseurl: https://pkg.duosecurity.com/RHEL/$releasever/$basearch
|
baseurl: https://pkg.duosecurity.com/Fedora/$releasever/$basearch
|
||||||
gpgcheck: true
|
gpgcheck: true
|
||||||
gpgkey: https://duo.com/DUO-GPG-PUBLIC-KEY.asc
|
gpgkey: https://duo.com/DUO-GPG-PUBLIC-KEY.asc
|
||||||
enabled: true
|
enabled: true
|
||||||
@@ -57,7 +57,7 @@
|
|||||||
- name: Install Duo Unix Application Integration
|
- name: Install Duo Unix Application Integration
|
||||||
become: true
|
become: true
|
||||||
ansible.builtin.dnf:
|
ansible.builtin.dnf:
|
||||||
name: duo-unix
|
name: duo_unix
|
||||||
state: present
|
state: present
|
||||||
|
|
||||||
- name: Install Duo config
|
- name: Install Duo config
|
||||||
|
|||||||
@@ -11,17 +11,20 @@
|
|||||||
password: "{{ lookup('env', 'USER_PASSWORD_' + (item.username | upper)) | password_hash('sha512', user_password_salt) }}"
|
password: "{{ lookup('env', 'USER_PASSWORD_' + (item.username | upper)) | password_hash('sha512', user_password_salt) }}"
|
||||||
state: "{{ 'absent' if item.enabled is defined and not item.enabled else 'present' }}"
|
state: "{{ 'absent' if item.enabled is defined and not item.enabled else 'present' }}"
|
||||||
shell: "{{ item.shell if item.shell is defined else '/bin/bash' }}"
|
shell: "{{ item.shell if item.shell is defined else '/bin/bash' }}"
|
||||||
|
groups: "{{ item.groups | default(omit) }}"
|
||||||
|
uid: "{{ item.uid | default(omit) }}"
|
||||||
loop: "{{ login_users }}"
|
loop: "{{ login_users }}"
|
||||||
|
|
||||||
|
|
||||||
- name: Disable password expiration
|
- name: Disable password expiration
|
||||||
ansible.builtin.command: chage -M -1 "{{ item.username }}"
|
ansible.builtin.command: chage -M -1 "{{ item.username }}"
|
||||||
become: yes
|
become: true
|
||||||
when: item.password_expiration is defined and not item.password_expiration
|
when: item.password_expiration is defined and not item.password_expiration
|
||||||
loop: "{{ login_users }}"
|
loop: "{{ login_users }}"
|
||||||
|
|
||||||
- name: Disable password login
|
- name: Disable password login
|
||||||
ansible.builtin.command: passwd -d "{{ item.username }}"
|
ansible.builtin.command: passwd -d "{{ item.username }}"
|
||||||
become: yes
|
become: true
|
||||||
when: item.password_disabled is defined and item.password_disabled
|
when: item.password_disabled is defined and item.password_disabled
|
||||||
loop: "{{ login_users }}"
|
loop: "{{ login_users }}"
|
||||||
|
|
||||||
|
|||||||
@@ -0,0 +1,3 @@
|
|||||||
|
{% for dev in virt_raw_block_devices %}
|
||||||
|
KERNEL=="{{ dev }}", OWNER="qemu", GROUP="kvm", MODE="0660"
|
||||||
|
{% endfor %}
|
||||||
@@ -0,0 +1,3 @@
|
|||||||
|
{% for driver in virt_blacklist %}
|
||||||
|
blacklist {{ driver }}
|
||||||
|
{% endfor %}
|
||||||
@@ -0,0 +1,255 @@
|
|||||||
|
<domain type='kvm'>
|
||||||
|
<name>{{ vm.name }}</name>
|
||||||
|
<uuid>{{ vm.uuid }}</uuid>
|
||||||
|
<title>{{ vm.title }}</title>
|
||||||
|
<memory unit='KiB'>{{ vm.memory }}</memory>
|
||||||
|
<currentMemory unit='KiB'>{{ vm.memory }}</currentMemory>
|
||||||
|
<memoryBacking>
|
||||||
|
<hugepages/>
|
||||||
|
<source type='memfd'/>
|
||||||
|
<access mode='shared'/>
|
||||||
|
</memoryBacking>
|
||||||
|
<vcpu placement='static'>{{ vm.cores * vm.threads }}</vcpu>
|
||||||
|
<cputune>
|
||||||
|
{% set pairs = vm.physical_cpus.split(',') %}
|
||||||
|
{% set ns = namespace(vcpu=0) %}
|
||||||
|
{% for pair in pairs %}
|
||||||
|
{% set parts = pair.split('-') %}
|
||||||
|
<vcpupin vcpu='{{ ns.vcpu }}' cpuset='{{ parts[0] }}'/>
|
||||||
|
{% set ns.vcpu = ns.vcpu + 1 %}
|
||||||
|
<vcpupin vcpu='{{ ns.vcpu }}' cpuset='{{ parts[1] }}'/>
|
||||||
|
{% set ns.vcpu = ns.vcpu + 1 %}
|
||||||
|
{% endfor %}
|
||||||
|
<emulatorpin cpuset='{{ vm.reserved_cpus }}'/>
|
||||||
|
</cputune>
|
||||||
|
<os>
|
||||||
|
<type arch='x86_64' machine='pc-q35-7.0'>hvm</type>
|
||||||
|
<loader readonly='yes' secure='{% if vm.secure_boot %}yes{% else %}no{% endif %}' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE{% if vm.secure_boot %}.secboot{% endif %}.fd</loader>
|
||||||
|
<nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd'>/var/lib/libvirt/qemu/nvram/{{ vm.name }}_VARS.fd</nvram>
|
||||||
|
<boot dev='hd'/>
|
||||||
|
<bootmenu enable='no'/>
|
||||||
|
</os>
|
||||||
|
<features>
|
||||||
|
<acpi/>
|
||||||
|
<apic/>
|
||||||
|
{% if vm.enable_hyperv is defined %}
|
||||||
|
{% if vm.enable_hyperv | default(false) %}
|
||||||
|
<hyperv mode='custom'>
|
||||||
|
<relaxed state='on'/>
|
||||||
|
<vapic state='on'/>
|
||||||
|
<spinlocks state='on' retries='8191'/>
|
||||||
|
<vendor_id state='on' value='{{ vm.hyperv_vendor_id | default("whatever") }}'/>
|
||||||
|
</hyperv>
|
||||||
|
{% endif %}
|
||||||
|
{% endif %}
|
||||||
|
<smm state='on'/>
|
||||||
|
</features>
|
||||||
|
<cpu mode='host-passthrough' check='none' migratable='on'>
|
||||||
|
<topology sockets='1' dies='1' cores='{{ vm.cores }}' threads='{{ vm.threads }}'/>
|
||||||
|
</cpu>
|
||||||
|
<clock offset='localtime'>
|
||||||
|
<timer name='rtc' tickpolicy='catchup'/>
|
||||||
|
<timer name='pit' tickpolicy='delay'/>
|
||||||
|
<timer name='hpet' present='no'/>
|
||||||
|
<timer name='kvmclock' present='yes'/>
|
||||||
|
{% if vm.enable_hyperv is defined %}
|
||||||
|
{% if vm.enable_hyperv | default(false) %}
|
||||||
|
<timer name='hypervclock' present='yes'/>
|
||||||
|
{% endif %}
|
||||||
|
{% endif %}
|
||||||
|
</clock>
|
||||||
|
<on_poweroff>destroy</on_poweroff>
|
||||||
|
<on_reboot>restart</on_reboot>
|
||||||
|
<on_crash>destroy</on_crash>
|
||||||
|
<pm>
|
||||||
|
<suspend-to-mem enabled='no'/>
|
||||||
|
<suspend-to-disk enabled='no'/>
|
||||||
|
</pm>
|
||||||
|
<devices>
|
||||||
|
<emulator>{{ vm.emulator | default("/usr/bin/qemu-system-x86_64") }}</emulator>
|
||||||
|
<disk type='file' device='disk'>
|
||||||
|
<driver name='qemu' type='qcow2' cache='writeback'/>
|
||||||
|
<source file='/var/lib/libvirt/images/{{ vm.disk_file }}'/>
|
||||||
|
<backingStore />
|
||||||
|
<target dev='sda' bus='virtio'/>
|
||||||
|
<address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0' />
|
||||||
|
</disk>
|
||||||
|
{% for block_dev in vm.block_devs %}
|
||||||
|
<disk type='block' device='disk'>
|
||||||
|
<driver name='qemu' type='raw'/>
|
||||||
|
<source dev='{{ block_dev.block_dev }}'/>
|
||||||
|
<target dev='{{ block_dev.target_dev }}' bus='virtio'/>
|
||||||
|
</disk>
|
||||||
|
{% endfor %}
|
||||||
|
{% if vm.cdrom %}
|
||||||
|
<disk type='file' device='cdrom'>
|
||||||
|
<driver name='qemu' type='raw'/>
|
||||||
|
<target dev='hdc' bus='sata'/>
|
||||||
|
<readonly/>
|
||||||
|
<address type='drive' controller='0' bus='0' target='0' unit='2'/>
|
||||||
|
</disk>
|
||||||
|
{% endif %}
|
||||||
|
<controller type='usb' index='0' model='qemu-xhci' ports='15'>
|
||||||
|
<address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0' />
|
||||||
|
</controller>
|
||||||
|
<controller type='sata' index='0'>
|
||||||
|
<address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2' />
|
||||||
|
</controller>
|
||||||
|
<controller type='pci' index='0' model='pcie-root' />
|
||||||
|
<controller type='pci' index='1' model='pcie-root-port'>
|
||||||
|
<model name='pcie-root-port' />
|
||||||
|
<target chassis='1' port='0x8' />
|
||||||
|
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'
|
||||||
|
multifunction='on' />
|
||||||
|
</controller>
|
||||||
|
<controller type='pci' index='2' model='pcie-to-pci-bridge'>
|
||||||
|
<model name='pcie-pci-bridge' />
|
||||||
|
<address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0' />
|
||||||
|
</controller>
|
||||||
|
<controller type='pci' index='3' model='pcie-root-port'>
|
||||||
|
<model name='pcie-root-port' />
|
||||||
|
<target chassis='3' port='0x9' />
|
||||||
|
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1' />
|
||||||
|
</controller>
|
||||||
|
<controller type='pci' index='4' model='pcie-root-port'>
|
||||||
|
<model name='pcie-root-port' />
|
||||||
|
<target chassis='4' port='0xa' />
|
||||||
|
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2' />
|
||||||
|
</controller>
|
||||||
|
<controller type='pci' index='5' model='pcie-root-port'>
|
||||||
|
<model name='pcie-root-port' />
|
||||||
|
<target chassis='5' port='0xb' />
|
||||||
|
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x3' />
|
||||||
|
</controller>
|
||||||
|
<controller type='pci' index='6' model='pcie-root-port'>
|
||||||
|
<model name='pcie-root-port' />
|
||||||
|
<target chassis='6' port='0xc' />
|
||||||
|
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x4' />
|
||||||
|
</controller>
|
||||||
|
<controller type='pci' index='7' model='pcie-root-port'>
|
||||||
|
<model name='pcie-root-port' />
|
||||||
|
<target chassis='7' port='0xd' />
|
||||||
|
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x5' />
|
||||||
|
</controller>
|
||||||
|
<controller type='pci' index='8' model='pcie-root-port'>
|
||||||
|
<model name='pcie-root-port' />
|
||||||
|
<target chassis='8' port='0xe' />
|
||||||
|
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x6' />
|
||||||
|
</controller>
|
||||||
|
<controller type='pci' index='9' model='pcie-root-port'>
|
||||||
|
<model name='pcie-root-port' />
|
||||||
|
<target chassis='9' port='0xf' />
|
||||||
|
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x7' />
|
||||||
|
</controller>
|
||||||
|
<controller type='pci' index='10' model='pcie-root-port'>
|
||||||
|
<model name='pcie-root-port' />
|
||||||
|
<target chassis='10' port='0x10' />
|
||||||
|
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'
|
||||||
|
multifunction='on' />
|
||||||
|
</controller>
|
||||||
|
<controller type='pci' index='11' model='pcie-root-port'>
|
||||||
|
<model name='pcie-root-port' />
|
||||||
|
<target chassis='11' port='0x11' />
|
||||||
|
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1' />
|
||||||
|
</controller>
|
||||||
|
<controller type='pci' index='12' model='pcie-root-port'>
|
||||||
|
<model name='pcie-root-port' />
|
||||||
|
<target chassis='12' port='0x12' />
|
||||||
|
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2' />
|
||||||
|
</controller>
|
||||||
|
<controller type='pci' index='13' model='pcie-root-port'>
|
||||||
|
<model name='pcie-root-port' />
|
||||||
|
<target chassis='13' port='0x13' />
|
||||||
|
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3' />
|
||||||
|
</controller>
|
||||||
|
<controller type='pci' index='14' model='pcie-root-port'>
|
||||||
|
<model name='pcie-root-port' />
|
||||||
|
<target chassis='14' port='0x14' />
|
||||||
|
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4' />
|
||||||
|
</controller>
|
||||||
|
<controller type='pci' index='15' model='pcie-root-port'>
|
||||||
|
<model name='pcie-root-port' />
|
||||||
|
<target chassis='15' port='0x15' />
|
||||||
|
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5' />
|
||||||
|
</controller>
|
||||||
|
<controller type='pci' index='16' model='pcie-root-port'>
|
||||||
|
<model name='pcie-root-port' />
|
||||||
|
<target chassis='16' port='0x16' />
|
||||||
|
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6' />
|
||||||
|
</controller>
|
||||||
|
<controller type='virtio-serial' index='0'>
|
||||||
|
<address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0' />
|
||||||
|
</controller>
|
||||||
|
{% if vm.smartcard is defined %}
|
||||||
|
{% if vm.smartcard | default(false) %}
|
||||||
|
<controller type='ccid' index='0'>
|
||||||
|
<alias name='ccid0'/>
|
||||||
|
<address type='usb' bus='0' port='1'/>
|
||||||
|
</controller>
|
||||||
|
{% endif %}
|
||||||
|
{% endif %}
|
||||||
|
{% if vm.virtio_fs is defined %}
|
||||||
|
{% if vm.virtio_fs | default(false) %}
|
||||||
|
<filesystem type='mount' accessmode='passthrough'>
|
||||||
|
<driver type='virtiofs'/>
|
||||||
|
<source dir='{{ vm.virtio_fs.source }}'/>
|
||||||
|
<target dir='{{ vm.virtio_fs.target }}'/>
|
||||||
|
</filesystem>
|
||||||
|
{% endif %}
|
||||||
|
{% endif %}
|
||||||
|
<interface type='bridge'>
|
||||||
|
<mac address='{{ vm.mac_address }}'/>
|
||||||
|
<source bridge='{{ vm.net_bridge | default("bridge0") }}'/>
|
||||||
|
<model type='virtio'/>
|
||||||
|
<address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0' />
|
||||||
|
</interface>
|
||||||
|
{% if vm.tablet is defined %}
|
||||||
|
{% if vm.tablet | default(false) %}
|
||||||
|
<input type='tablet' bus='usb'/>
|
||||||
|
{% endif %}
|
||||||
|
{% endif %}
|
||||||
|
{% if vm.console %}
|
||||||
|
<serial type='pty'>
|
||||||
|
<target type='isa-serial' port='0'>
|
||||||
|
<model name='isa-serial'/>
|
||||||
|
</target>
|
||||||
|
</serial>
|
||||||
|
<console type='pty'>
|
||||||
|
<target type='serial' port='0'/>
|
||||||
|
</console>
|
||||||
|
{% endif %}
|
||||||
|
<input type='mouse' bus='ps2'/>
|
||||||
|
<input type='keyboard' bus='ps2'/>
|
||||||
|
{% if vm.tpm %}
|
||||||
|
<tpm model='tpm-tis'>
|
||||||
|
<backend type='emulator' version='2.0'/>
|
||||||
|
</tpm>
|
||||||
|
{% endif %}
|
||||||
|
{% if vm.audio %}
|
||||||
|
<audio id='1' type='none'/>
|
||||||
|
{% endif %}
|
||||||
|
{% for dev in vm.host_devs %}
|
||||||
|
{% if dev.type == 'mdev' %}
|
||||||
|
<hostdev mode='subsystem' type='mdev' managed='no' model='{{ dev.model | default('vfio-pci') }}' display='{{ dev.display | default('off') }}'>
|
||||||
|
<source>
|
||||||
|
<address uuid='{{ dev.source.uuid }}'/>
|
||||||
|
</source>
|
||||||
|
{% elif dev.type == 'pci' %}
|
||||||
|
<hostdev mode='subsystem' type='pci' managed='yes'>
|
||||||
|
<source>
|
||||||
|
<address domain='{{ dev.source.address.domain }}' bus='{{ dev.source.address.bus }}'
|
||||||
|
slot='{{ dev.source.address.slot }}' function='{{ dev.source.address.function }}'/>
|
||||||
|
</source>
|
||||||
|
{% endif %}
|
||||||
|
{% if dev.address is defined %}
|
||||||
|
<address {% for key, value in dev.address.items() %}
|
||||||
|
{{ key }}='{{ value }}'{% if not loop.last %} {% endif %}
|
||||||
|
{% endfor %}/>
|
||||||
|
{% endif %}
|
||||||
|
</hostdev>
|
||||||
|
{% endfor %}
|
||||||
|
<memballoon model='virtio'>
|
||||||
|
<address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/>
|
||||||
|
</memballoon>
|
||||||
|
</devices>
|
||||||
|
</domain>
|
||||||
@@ -5,6 +5,7 @@ dev-01.alexpires.dev
|
|||||||
[hardening]
|
[hardening]
|
||||||
prod-01.alexpires.me
|
prod-01.alexpires.me
|
||||||
dev-01.alexpires.dev
|
dev-01.alexpires.dev
|
||||||
|
vh-01.alexpires.dev
|
||||||
|
|
||||||
[ubuntu]
|
[ubuntu]
|
||||||
prod-01.alexpires.me
|
prod-01.alexpires.me
|
||||||
@@ -15,6 +16,7 @@ prod-01.alexpires.me
|
|||||||
|
|
||||||
[private]
|
[private]
|
||||||
dev-01.alexpires.dev
|
dev-01.alexpires.dev
|
||||||
|
vh-01.alexpires.dev
|
||||||
|
|
||||||
[gitea]
|
[gitea]
|
||||||
prod-01.alexpires.me
|
prod-01.alexpires.me
|
||||||
@@ -48,3 +50,11 @@ prod-01.alexpires.me
|
|||||||
|
|
||||||
[trivy]
|
[trivy]
|
||||||
prod-01.alexpires.me
|
prod-01.alexpires.me
|
||||||
|
|
||||||
|
[virtualization]
|
||||||
|
vh-01.alexpires.dev
|
||||||
|
|
||||||
|
[2fa]
|
||||||
|
prod-01.alexpires.me
|
||||||
|
dev-01.alexpires.dev
|
||||||
|
vh-01.alexpires.dev
|
||||||
|
|||||||
@@ -1,33 +1,38 @@
|
|||||||
import time
|
import time
|
||||||
import os
|
import os
|
||||||
|
|
||||||
RAPL_PATH = "/sys/class/powercap/intel-rapl:0/energy_uj"
|
RAPL_PATH = "/sys/class/powercap/intel-rapl:0/energy_uj"
|
||||||
|
INTERVAL_SEC = 1.0 # configurable via command-line argument or env var
|
||||||
|
|
||||||
def read_energy():
|
def read_energy(path):
|
||||||
try:
|
try:
|
||||||
with open(RAPL_PATH, "r") as f:
|
with open(path, "r") as f:
|
||||||
return int(f.read().strip())
|
return int(f.read().strip())
|
||||||
except FileNotFoundError:
|
except FileNotFoundError:
|
||||||
print(f"Error: {RAPL_PATH} not found.")
|
raise RuntimeError(f"RAPL support not available: {path}")
|
||||||
exit(1)
|
|
||||||
|
|
||||||
def calculate_power(interval=1.0):
|
def calculate_power(energy_before, energy_after, interval_sec):
|
||||||
print(f"Monitoring CPU package power every {interval} second(s)... (Ctrl+C to stop)")
|
delta_uj = energy_after - energy_before
|
||||||
while True:
|
power_watts = (delta_uj / 1_000_000) / interval_sec
|
||||||
energy_before = read_energy()
|
return f"{power_watts:.2f} Watts"
|
||||||
time.sleep(interval)
|
|
||||||
energy_after = read_energy()
|
|
||||||
|
|
||||||
delta_uj = energy_after - energy_before
|
|
||||||
power_watts = (delta_uj / 1_000_000) / interval
|
|
||||||
|
|
||||||
print(f"Power Usage: {power_watts:.2f} Watts")
|
|
||||||
|
|
||||||
if __name__ == "__main__":
|
if __name__ == "__main__":
|
||||||
if os.geteuid() != 0:
|
if os.geteuid() != 0:
|
||||||
print("Please run this script as root.")
|
print("Please run this script as root.")
|
||||||
exit(1)
|
exit(1)
|
||||||
|
|
||||||
try:
|
try:
|
||||||
calculate_power(interval=1.0)
|
# RAPL support check
|
||||||
|
with open(RAPL_PATH, "r") as f:
|
||||||
|
_ = int(f.read().strip())
|
||||||
|
|
||||||
|
while True:
|
||||||
|
energy_before = read_energy(RAPL_PATH)
|
||||||
|
time.sleep(INTERVAL_SEC)
|
||||||
|
energy_after = read_energy(RAPL_PATH)
|
||||||
|
|
||||||
|
power_reading = calculate_power(energy_before, energy_after, INTERVAL_SEC)
|
||||||
|
print(f"Power Usage: {power_reading}")
|
||||||
|
|
||||||
except KeyboardInterrupt:
|
except KeyboardInterrupt:
|
||||||
print("\nStopped.")
|
print("\nStopped.")
|
||||||
Reference in New Issue
Block a user