diff --git a/ansible/host_vars/dev-01.alexpires.dev.yml b/ansible/host_vars/dev-01.alexpires.dev.yml index f063bb5..15febd0 100644 --- a/ansible/host_vars/dev-01.alexpires.dev.yml +++ b/ansible/host_vars/dev-01.alexpires.dev.yml @@ -18,8 +18,9 @@ login_users: # SSH Connection and security sshd_port: 22 ssh_allowed_networks: - - "0.0.0.0/0" -sshd_admin_net: "0.0.0.0/0" + - "10.5.5.5/32" # Wireguard VPN (Laptop) + - "10.19.4.0/24" # local network +sshd_admin_net: "10.19.4.0/24" # local network sshd_allow_groups: "{{ ansible_user }} users" sshd_permit_root_login: "no" sshd_password_authentication: "no" @@ -31,8 +32,13 @@ sshd_max_auth_tries: 10 # Firewall ports ufw_enable: true fw_allowed_ports: - - { rule: "allow", port: "22", proto: "tcp" } - - { rule: "allow", port: "443", proto: "tcp" } + - { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop) + - { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network + - { rule: "allow", port: "16443", proto: "tcp", from: "10.5.5.5/32" } # Kubernetes API (Laptop) + - { rule: "allow", port: "16443", proto: "tcp", from: "10.19.4.0/24" } # Kubernetes API (local network) + - { rule: "allow", port: "139", proto: "tcp", from: "10.19.4.0/24" } # Samba (local network) + - { rule: "allow", port: "445", proto: "tcp", from: "10.19.4.0/24" } # Samba (local network) + - { rule: "allow", port: "443", proto: "tcp", from: "10.5.5.2/32" } # Wireguard VPN (Kokoro-FastAPI) ufw_outgoing_traffic: - 22 # SSH @@ -73,6 +79,24 @@ fail2ban_jails: # aide install_aide: false +misc_modules_blocklist: + - bluetooth + - bnep + - btusb + - can + - cpia2 + - firewire-core + - floppy + - ksmbd + - n_hdlc + - net-pf-31 + - pcspkr + - soundcore + - thunderbolt + - usb-midi + - uvcvideo + - v4l2_common + # Unattended upgrades unattended_reboot: true unattended_reboot_time: "04:30" diff --git a/ansible/host_vars/gpu-01.alexpires.dev.yml b/ansible/host_vars/gpu-01.alexpires.dev.yml index 2b383db..f2c7221 100644 --- a/ansible/host_vars/gpu-01.alexpires.dev.yml +++ b/ansible/host_vars/gpu-01.alexpires.dev.yml @@ -19,8 +19,9 @@ login_users: # SSH Connection and security sshd_port: 22 ssh_allowed_networks: - - "0.0.0.0/0" -sshd_admin_net: "0.0.0.0/0" + - "10.5.5.5/32" # Wireguard VPN (Laptop) + - "10.19.4.0/24" # local network +sshd_admin_net: "10.19.4.0/24" # local network sshd_allow_groups: "{{ ansible_user }} users" sshd_permit_root_login: "no" sshd_password_authentication: "no" @@ -34,9 +35,11 @@ packages_blocklist: [] # Firewall ports ufw_enable: true fw_allowed_ports: - - { rule: "allow", port: "22", proto: "tcp" } - - { rule: "allow", port: "11434", proto: "tcp" } - - { rule: "allow", port: "8880", proto: "tcp" } + - { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop) + - { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network + - { rule: "allow", port: "11434", proto: "tcp", from: "10.19.4.0/24" } # Ollama (local network) + - { rule: "allow", port: "11434", proto: "tcp", from: "10.5.5.5/32" } # Ollama (Laptop) + - { rule: "allow", port: "8880", proto: "tcp", from: "10.19.4.0/24" } # Kokoro-FastAPI (local network) ufw_outgoing_traffic: - 22 # SSH diff --git a/ansible/host_vars/prod-01.alexpires.me.yml b/ansible/host_vars/prod-01.alexpires.me.yml index 1a6a0c3..4399d0c 100644 --- a/ansible/host_vars/prod-01.alexpires.me.yml +++ b/ansible/host_vars/prod-01.alexpires.me.yml @@ -46,12 +46,8 @@ fw_allowed_ports: - { rule: "allow", port: "21116", proto: "tcp" } - { rule: "allow", port: "21116", proto: "udp" } - { rule: "allow", port: "21117", proto: "tcp" } - - { rule: "allow", port: "16443", proto: "tcp", from: "10.1.0.0/16" } - - { rule: "allow", port: "10254", proto: "tcp", from: "10.1.0.0/16" } # Access to the Kube API Server from the Office - { rule: "allow", port: "16443", proto: "tcp", from: "188.82.170.183" } - # VPN to Portugal - - { rule: "allow", port: "10254", proto: "tcp", from: "147.78.131.194" } ufw_outgoing_traffic: - 22 # SSH diff --git a/ansible/host_vars/vh-01.alexpires.dev.yml b/ansible/host_vars/vh-01.alexpires.dev.yml index e1909da..6f12207 100644 --- a/ansible/host_vars/vh-01.alexpires.dev.yml +++ b/ansible/host_vars/vh-01.alexpires.dev.yml @@ -20,8 +20,9 @@ login_users: # SSH Connection and security sshd_port: 22 ssh_allowed_networks: - - "0.0.0.0/0" -sshd_admin_net: "0.0.0.0/0" + - "10.5.5.5/32" # Wireguard VPN (Laptop) + - "10.19.4.0/24" # local network +sshd_admin_net: "10.19.4.0/24" # local network sshd_allow_groups: "{{ ansible_user }} users" sshd_permit_root_login: "no" sshd_password_authentication: "no" @@ -33,7 +34,8 @@ sshd_max_auth_tries: 10 # Firewall ports ufw_enable: true fw_allowed_ports: - - { rule: "allow", port: "22", proto: "tcp" } + - { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop) + - { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network - { rule: "allow", port: "9090", proto: "tcp" } ufw_outgoing_traffic: @@ -76,9 +78,9 @@ virt_raw_block_devices: - "nvme0n1p2" virt_extra_grub_args: > - i915.modeset=1 i915.enable_gvt=1 i915.enable_fbc=0 - initcall_blacklist=simpledrm_platform_driver_init - rd.driver.blacklist=nouveau modprobe.blacklist=nouveau + i915.modeset=1 i915.enable_gvt=1 i915.enable_fbc=0 + initcall_blacklist=simpledrm_platform_driver_init + rd.driver.blacklist=nouveau modprobe.blacklist=nouveau virt_vfio_ids: - 10de:2482 # NVIDIA Corporation GA104 [GeForce RTX 3070 Ti] @@ -120,7 +122,14 @@ virt_machines: - type: "mdev" source: uuid: "5abeb24f-d6f4-4666-b495-303f15b05723" - address: { type: 'pci', domain: '0x0000', bus: '0x07', slot: '0x00', function: '0x0' } + address: + { + type: "pci", + domain: "0x0000", + bus: "0x07", + slot: "0x00", + function: "0x0", + } # Fresco Logic FL1100 USB 3.0 Host Controller - type: "pci" source: @@ -129,7 +138,14 @@ virt_machines: bus: "0x06" slot: "0x00" function: "0x0" - address: { type: 'pci', domain: '0x0000', bus: '0x10', slot: '0x00', function: '0x0' } + address: + { + type: "pci", + domain: "0x0000", + bus: "0x10", + slot: "0x00", + function: "0x0", + } # NVIDIA Corporation GA104 [GeForce RTX 3070 Ti] - type: "pci" source: @@ -138,7 +154,14 @@ virt_machines: bus: "0x01" slot: "0x00" function: "0x0" - address: { type: 'pci', domain: '0x0000', bus: '0x0b', slot: '0x00', function: '0x0' } + address: + { + type: "pci", + domain: "0x0000", + bus: "0x0b", + slot: "0x00", + function: "0x0", + } # NVIDIA Corporation GA106 High Definition Audio Controller - type: "pci" source: @@ -147,7 +170,14 @@ virt_machines: bus: "0x01" slot: "0x00" function: "0x1" - address: { type: 'pci', domain: '0x0000', bus: '0x0f', slot: '0x00', function: '0x0' } + address: + { + type: "pci", + domain: "0x0000", + bus: "0x0f", + slot: "0x00", + function: "0x0", + } - name: fedora-headless title: "Fedora CUDA headless" @@ -177,7 +207,14 @@ virt_machines: bus: "0x03" slot: "0x00" function: "0x0" - address: { type: 'pci',domain: '0x0000',bus: '0x09',slot: '0x00',function: '0x0' } + address: + { + type: "pci", + domain: "0x0000", + bus: "0x09", + slot: "0x00", + function: "0x0", + } # NVIDIA Corporation GA106 High Definition Audio Controller - type: "pci" source: @@ -186,4 +223,11 @@ virt_machines: bus: "0x03" slot: "0x00" function: "0x1" - address: { type: 'pci',domain: '0x0000',bus: '0x0a',slot: '0x00',function: '0x0' } + address: + { + type: "pci", + domain: "0x0000", + bus: "0x0a", + slot: "0x00", + function: "0x0", + } diff --git a/terraform/apps/dev-01/apps.tf b/terraform/apps/dev-01/apps.tf index 18264b6..29b1cd9 100644 --- a/terraform/apps/dev-01/apps.tf +++ b/terraform/apps/dev-01/apps.tf @@ -4,3 +4,9 @@ module "open-webui" { persistent_folder = local.persistent_folder fqdn = local.open_webui_fqdn } + +module "samba" { + source = "../../modules/apps/samba" + + shared_folder = local.samba_shared_folder +} diff --git a/terraform/apps/dev-01/config.tf b/terraform/apps/dev-01/config.tf index d2f9ba9..7049e10 100644 --- a/terraform/apps/dev-01/config.tf +++ b/terraform/apps/dev-01/config.tf @@ -6,4 +6,7 @@ locals { primary_domain = "alexpires.me" open_webui_fqdn = "ai.${local.primary_domain}" internal_issuer = "internal-ca" + + # samba + samba_shared_folder = "/mnt/usb" } diff --git a/terraform/apps/prod-01/config.tf b/terraform/apps/prod-01/config.tf index b3606bf..ea73cc8 100644 --- a/terraform/apps/prod-01/config.tf +++ b/terraform/apps/prod-01/config.tf @@ -115,12 +115,6 @@ locals { # upstream = "http://10.19.4.136:8000" # rewrite = "^/tools/gitea/(.*)$ /$1 break" # }, - { - private = true - path = "/providers/ollama" - upstream = "http://10.19.4.106:11434" - rewrite = "^/providers/ollama/(.*)$ /$1 break" - }, { path = "/" headers = { diff --git a/terraform/modules/apps/nginx-reverse-proxy/main.tf b/terraform/modules/apps/nginx-reverse-proxy/main.tf index 08b3eec..a590ca7 100644 --- a/terraform/modules/apps/nginx-reverse-proxy/main.tf +++ b/terraform/modules/apps/nginx-reverse-proxy/main.tf @@ -306,27 +306,6 @@ resource "kubernetes_deployment" "reverse_proxy" { } } - readiness_probe { - http_get { - path = "/" - port = 8080 - } - initial_delay_seconds = 5 - period_seconds = 10 - } - - liveness_probe { - http_get { - path = "/" - port = 8080 - } - initial_delay_seconds = 5 - period_seconds = 10 - failure_threshold = 10 - timeout_seconds = 5 - success_threshold = 1 - } - security_context { allow_privilege_escalation = false } diff --git a/terraform/modules/apps/open-webui/main.tf b/terraform/modules/apps/open-webui/main.tf index 005f5d1..e71dfa9 100644 --- a/terraform/modules/apps/open-webui/main.tf +++ b/terraform/modules/apps/open-webui/main.tf @@ -54,7 +54,7 @@ resource "kubernetes_deployment" "openwebui" { } strategy { - type = "Recreate" + type = "RollingUpdate" } template { diff --git a/terraform/modules/apps/samba/config.tf b/terraform/modules/apps/samba/config.tf new file mode 100644 index 0000000..0c23084 --- /dev/null +++ b/terraform/modules/apps/samba/config.tf @@ -0,0 +1,4 @@ +locals { + samba_version = var.tag +} + diff --git a/terraform/modules/apps/samba/main.tf b/terraform/modules/apps/samba/main.tf new file mode 100644 index 0000000..e328b2a --- /dev/null +++ b/terraform/modules/apps/samba/main.tf @@ -0,0 +1,147 @@ +resource "kubernetes_namespace" "samba" { + metadata { + name = "samba" + } +} + +resource "kubernetes_service_account" "samba" { + + metadata { + name = "samba-sa" + namespace = kubernetes_namespace.samba.metadata[0].name + } + + automount_service_account_token = false +} + +resource "kubernetes_secret" "samba_secrets" { + metadata { + name = "samba-credentials" + namespace = kubernetes_namespace.samba.metadata[0].name + } + + data = { + USERNAME = var.samba_username + PASSWORD = var.samba_password + } +} + +resource "kubernetes_deployment" "samba" { + metadata { + name = "samba" + namespace = kubernetes_namespace.samba.metadata[0].name + labels = { + samba = "samba" + } + } + + spec { + replicas = 1 + + selector { + match_labels = { + samba = "samba" + } + } + + strategy { + type = "Recreate" + } + + template { + metadata { + labels = { + samba = "samba" + } + } + + spec { + service_account_name = kubernetes_service_account.samba.metadata[0].name + automount_service_account_token = false + + container { + name = "samba" + image = "dockurr/samba:${local.samba_version}" + + + security_context { + allow_privilege_escalation = false + } + + port { + name = "smb-1" + container_port = 445 + host_port = 445 + protocol = "TCP" + } + + port { + name = "smb-2" + container_port = 139 + host_port = 139 + protocol = "TCP" + } + + env { + name = "USER" + value_from { + secret_key_ref { + name = kubernetes_secret.samba_secrets.metadata[0].name + key = "USERNAME" + } + } + } + + env { + name = "PASS" + value_from { + secret_key_ref { + name = kubernetes_secret.samba_secrets.metadata[0].name + key = "PASSWORD" + } + } + } + + volume_mount { + name = "storage" + mount_path = "/storage" + } + } + + volume { + name = "storage" + host_path { + path = var.shared_folder + } + } + } + } + } +} + +resource "kubernetes_service" "samba" { + metadata { + name = "samba-ports" + namespace = kubernetes_namespace.samba.metadata[0].name + } + + spec { + selector = { + samba = "samba" + } + + port { + name = "smb" + port = 445 + target_port = 445 + } + + type = "LoadBalancer" + } + + lifecycle { + ignore_changes = [ + metadata[0].annotations + ] + } +} diff --git a/terraform/modules/apps/samba/provider.tf b/terraform/modules/apps/samba/provider.tf new file mode 100644 index 0000000..2eaa508 --- /dev/null +++ b/terraform/modules/apps/samba/provider.tf @@ -0,0 +1,9 @@ +terraform { + required_version = "~>1.8" + required_providers { + kubernetes = { + source = "hashicorp/kubernetes" + version = "2.36.0" + } + } +} diff --git a/terraform/modules/apps/samba/variables.tf b/terraform/modules/apps/samba/variables.tf new file mode 100644 index 0000000..ef44149 --- /dev/null +++ b/terraform/modules/apps/samba/variables.tf @@ -0,0 +1,23 @@ +variable "tag" { + description = "The version of app to install" + type = string + default = "latest" +} + +variable "shared_folder" { + description = "Path to the shared folder on the host" + type = string +} + +variable "samba_username" { + description = "Username for Samba access" + type = string + default = "samba" +} + +variable "samba_password" { + description = "Password for Samba access" + type = string + default = "samba" + sensitive = true +}