alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

- Implemented samba service

Browse Source 
- Improved firewall rules
This commit is contained in:
Alexandre Pires
2025-06-06 23:49:38 +02:00
parent 3ea65f060f
commit d3b8aff1ae
13 changed files with 285 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/host_vars/dev-01.alexpires.dev.yml
+28 -4
View File
@@ -18,8 +18,9 @@ login_users:
# SSH Connection and security
sshd_port: 22
ssh_allowed_networks:
- "0.0.0.0/0"
sshd_admin_net: "0.0.0.0/0"
- "10.5.5.5/32" # Wireguard VPN (Laptop)
- "10.19.4.0/24" # local network
sshd_admin_net: "10.19.4.0/24" # local network
sshd_allow_groups: "{{ ansible_user }} users"
sshd_permit_root_login: "no"
sshd_password_authentication: "no"
@@ -31,8 +32,13 @@ sshd_max_auth_tries: 10
# Firewall ports
ufw_enable: true
fw_allowed_ports:
- { rule: "allow", port: "22", proto: "tcp" }
- { rule: "allow", port: "443", proto: "tcp" }
- { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop)
- { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network
- { rule: "allow", port: "16443", proto: "tcp", from: "10.5.5.5/32" } # Kubernetes API (Laptop)
- { rule: "allow", port: "16443", proto: "tcp", from: "10.19.4.0/24" } # Kubernetes API (local network)
- { rule: "allow", port: "139", proto: "tcp", from: "10.19.4.0/24" } # Samba (local network)
- { rule: "allow", port: "445", proto: "tcp", from: "10.19.4.0/24" } # Samba (local network)
- { rule: "allow", port: "443", proto: "tcp", from: "10.5.5.2/32" } # Wireguard VPN (Kokoro-FastAPI)
ufw_outgoing_traffic:
- 22 # SSH
@@ -73,6 +79,24 @@ fail2ban_jails:
# aide
install_aide: false
misc_modules_blocklist:
- bluetooth
- bnep
- btusb
- can
- cpia2
- firewire-core
- floppy
- ksmbd
- n_hdlc
- net-pf-31
- pcspkr
- soundcore
- thunderbolt
- usb-midi
- uvcvideo
- v4l2_common
# Unattended upgrades
unattended_reboot: true
unattended_reboot_time: "04:30"
ansible/host_vars/gpu-01.alexpires.dev.yml
+8 -5
View File
@@ -19,8 +19,9 @@ login_users:
# SSH Connection and security
sshd_port: 22
ssh_allowed_networks:
- "0.0.0.0/0"
sshd_admin_net: "0.0.0.0/0"
- "10.5.5.5/32" # Wireguard VPN (Laptop)
- "10.19.4.0/24" # local network
sshd_admin_net: "10.19.4.0/24" # local network
sshd_allow_groups: "{{ ansible_user }} users"
sshd_permit_root_login: "no"
sshd_password_authentication: "no"
@@ -34,9 +35,11 @@ packages_blocklist: []
# Firewall ports
ufw_enable: true
fw_allowed_ports:
- { rule: "allow", port: "22", proto: "tcp" }
- { rule: "allow", port: "11434", proto: "tcp" }
- { rule: "allow", port: "8880", proto: "tcp" }
- { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop)
- { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network
- { rule: "allow", port: "11434", proto: "tcp", from: "10.19.4.0/24" } # Ollama (local network)
- { rule: "allow", port: "11434", proto: "tcp", from: "10.5.5.5/32" } # Ollama (Laptop)
- { rule: "allow", port: "8880", proto: "tcp", from: "10.19.4.0/24" } # Kokoro-FastAPI (local network)
ufw_outgoing_traffic:
- 22 # SSH
ansible/host_vars/prod-01.alexpires.me.yml
-4
View File
@@ -46,12 +46,8 @@ fw_allowed_ports:
- { rule: "allow", port: "21116", proto: "tcp" }
- { rule: "allow", port: "21116", proto: "udp" }
- { rule: "allow", port: "21117", proto: "tcp" }
- { rule: "allow", port: "16443", proto: "tcp", from: "10.1.0.0/16" }
- { rule: "allow", port: "10254", proto: "tcp", from: "10.1.0.0/16" }
# Access to the Kube API Server from the Office
- { rule: "allow", port: "16443", proto: "tcp", from: "188.82.170.183" }
# VPN to Portugal
- { rule: "allow", port: "10254", proto: "tcp", from: "147.78.131.194" }
ufw_outgoing_traffic:
- 22 # SSH
ansible/host_vars/vh-01.alexpires.dev.yml
+56 -12
View File
@@ -20,8 +20,9 @@ login_users:
# SSH Connection and security
sshd_port: 22
ssh_allowed_networks:
- "0.0.0.0/0"
sshd_admin_net: "0.0.0.0/0"
- "10.5.5.5/32" # Wireguard VPN (Laptop)
- "10.19.4.0/24" # local network
sshd_admin_net: "10.19.4.0/24" # local network
sshd_allow_groups: "{{ ansible_user }} users"
sshd_permit_root_login: "no"
sshd_password_authentication: "no"
@@ -33,7 +34,8 @@ sshd_max_auth_tries: 10
# Firewall ports
ufw_enable: true
fw_allowed_ports:
- { rule: "allow", port: "22", proto: "tcp" }
- { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop)
- { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network
- { rule: "allow", port: "9090", proto: "tcp" }
ufw_outgoing_traffic:
@@ -76,9 +78,9 @@ virt_raw_block_devices:
- "nvme0n1p2"
virt_extra_grub_args: >
i915.modeset=1 i915.enable_gvt=1 i915.enable_fbc=0
initcall_blacklist=simpledrm_platform_driver_init
rd.driver.blacklist=nouveau modprobe.blacklist=nouveau
i915.modeset=1 i915.enable_gvt=1 i915.enable_fbc=0
initcall_blacklist=simpledrm_platform_driver_init
rd.driver.blacklist=nouveau modprobe.blacklist=nouveau
virt_vfio_ids:
- 10de:2482 # NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
@@ -120,7 +122,14 @@ virt_machines:
- type: "mdev"
source:
uuid: "5abeb24f-d6f4-4666-b495-303f15b05723"
address: { type: 'pci', domain: '0x0000', bus: '0x07', slot: '0x00', function: '0x0' }
address:
{
type: "pci",
domain: "0x0000",
bus: "0x07",
slot: "0x00",
function: "0x0",
}
# Fresco Logic FL1100 USB 3.0 Host Controller
- type: "pci"
source:
@@ -129,7 +138,14 @@ virt_machines:
bus: "0x06"
slot: "0x00"
function: "0x0"
address: { type: 'pci', domain: '0x0000', bus: '0x10', slot: '0x00', function: '0x0' }
address:
{
type: "pci",
domain: "0x0000",
bus: "0x10",
slot: "0x00",
function: "0x0",
}
# NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
- type: "pci"
source:
@@ -138,7 +154,14 @@ virt_machines:
bus: "0x01"
slot: "0x00"
function: "0x0"
address: { type: 'pci', domain: '0x0000', bus: '0x0b', slot: '0x00', function: '0x0' }
address:
{
type: "pci",
domain: "0x0000",
bus: "0x0b",
slot: "0x00",
function: "0x0",
}
# NVIDIA Corporation GA106 High Definition Audio Controller
- type: "pci"
source:
@@ -147,7 +170,14 @@ virt_machines:
bus: "0x01"
slot: "0x00"
function: "0x1"
address: { type: 'pci', domain: '0x0000', bus: '0x0f', slot: '0x00', function: '0x0' }
address:
{
type: "pci",
domain: "0x0000",
bus: "0x0f",
slot: "0x00",
function: "0x0",
}
- name: fedora-headless
title: "Fedora CUDA headless"
@@ -177,7 +207,14 @@ virt_machines:
bus: "0x03"
slot: "0x00"
function: "0x0"
address: { type: 'pci',domain: '0x0000',bus: '0x09',slot: '0x00',function: '0x0' }
address:
{
type: "pci",
domain: "0x0000",
bus: "0x09",
slot: "0x00",
function: "0x0",
}
# NVIDIA Corporation GA106 High Definition Audio Controller
- type: "pci"
source:
@@ -186,4 +223,11 @@ virt_machines:
bus: "0x03"
slot: "0x00"
function: "0x1"
address: { type: 'pci',domain: '0x0000',bus: '0x0a',slot: '0x00',function: '0x0' }
address:
{
type: "pci",
domain: "0x0000",
bus: "0x0a",
slot: "0x00",
function: "0x0",
}
terraform/apps/dev-01/apps.tf
+6
View File
@@ -4,3 +4,9 @@ module "open-webui" {
persistent_folder = local.persistent_folder
fqdn = local.open_webui_fqdn
}
module "samba" {
source = "../../modules/apps/samba"
shared_folder = local.samba_shared_folder
}
terraform/apps/dev-01/config.tf
+3
View File
@@ -6,4 +6,7 @@ locals {
primary_domain = "alexpires.me"
open_webui_fqdn = "ai.${local.primary_domain}"
internal_issuer = "internal-ca"
# samba
samba_shared_folder = "/mnt/usb"
}
terraform/apps/prod-01/config.tf
-6
View File
@@ -115,12 +115,6 @@ locals {
# upstream = "http://10.19.4.136:8000"
# rewrite = "^/tools/gitea/(.*)$ /$1 break"
# },
{
private = true
path = "/providers/ollama"
upstream = "http://10.19.4.106:11434"
rewrite = "^/providers/ollama/(.*)$ /$1 break"
},
{
path = "/"
headers = {
terraform/modules/apps/nginx-reverse-proxy/main.tf
-21
View File
@@ -306,27 +306,6 @@ resource "kubernetes_deployment" "reverse_proxy" {
}
}
readiness_probe {
http_get {
path = "/"
port = 8080
}
initial_delay_seconds = 5
period_seconds = 10
}
liveness_probe {
http_get {
path = "/"
port = 8080
}
initial_delay_seconds = 5
period_seconds = 10
failure_threshold = 10
timeout_seconds = 5
success_threshold = 1
}
security_context {
allow_privilege_escalation = false
}
terraform/modules/apps/open-webui/main.tf
+1 -1
View File
@@ -54,7 +54,7 @@ resource "kubernetes_deployment" "openwebui" {
}
strategy {
type = "Recreate"
type = "RollingUpdate"
}
template {
terraform/modules/apps/samba/config.tf
+4
View File
@@ -0,0 +1,4 @@
locals {
samba_version = var.tag
}
terraform/modules/apps/samba/main.tf
+147
View File
@@ -0,0 +1,147 @@
resource "kubernetes_namespace" "samba" {
metadata {
name = "samba"
}
}
resource "kubernetes_service_account" "samba" {
metadata {
name = "samba-sa"
namespace = kubernetes_namespace.samba.metadata[0].name
}
automount_service_account_token = false
}
resource "kubernetes_secret" "samba_secrets" {
metadata {
name = "samba-credentials"
namespace = kubernetes_namespace.samba.metadata[0].name
}
data = {
USERNAME = var.samba_username
PASSWORD = var.samba_password
}
}
resource "kubernetes_deployment" "samba" {
metadata {
name = "samba"
namespace = kubernetes_namespace.samba.metadata[0].name
labels = {
samba = "samba"
}
}
spec {
replicas = 1
selector {
match_labels = {
samba = "samba"
}
}
strategy {
type = "Recreate"
}
template {
metadata {
labels = {
samba = "samba"
}
}
spec {
service_account_name = kubernetes_service_account.samba.metadata[0].name
automount_service_account_token = false
container {
name = "samba"
image = "dockurr/samba:${local.samba_version}"
security_context {
allow_privilege_escalation = false
}
port {
name = "smb-1"
container_port = 445
host_port = 445
protocol = "TCP"
}
port {
name = "smb-2"
container_port = 139
host_port = 139
protocol = "TCP"
}
env {
name = "USER"
value_from {
secret_key_ref {
name = kubernetes_secret.samba_secrets.metadata[0].name
key = "USERNAME"
}
}
}
env {
name = "PASS"
value_from {
secret_key_ref {
name = kubernetes_secret.samba_secrets.metadata[0].name
key = "PASSWORD"
}
}
}
volume_mount {
name = "storage"
mount_path = "/storage"
}
}
volume {
name = "storage"
host_path {
path = var.shared_folder
}
}
}
}
}
}
resource "kubernetes_service" "samba" {
metadata {
name = "samba-ports"
namespace = kubernetes_namespace.samba.metadata[0].name
}
spec {
selector = {
samba = "samba"
}
port {
name = "smb"
port = 445
target_port = 445
}
type = "LoadBalancer"
}
lifecycle {
ignore_changes = [
metadata[0].annotations
]
}
}
terraform/modules/apps/samba/provider.tf
+9
View File
@@ -0,0 +1,9 @@
terraform {
required_version = "~>1.8"
required_providers {
kubernetes = {
source = "hashicorp/kubernetes"
version = "2.36.0"
}
}
}
terraform/modules/apps/samba/variables.tf
+23
View File
@@ -0,0 +1,23 @@
variable "tag" {
description = "The version of app to install"
type = string
default = "latest"
}
variable "shared_folder" {
description = "Path to the shared folder on the host"
type = string
}
variable "samba_username" {
description = "Username for Samba access"
type = string
default = "samba"
}
variable "samba_password" {
description = "Password for Samba access"
type = string
default = "samba"
sensitive = true
}