alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

- Implemented samba service

Browse Source 
- Improved firewall rules
This commit is contained in:
Alexandre Pires
2025-06-06 23:49:38 +02:00
parent 3ea65f060f
commit d3b8aff1ae
13 changed files with 285 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/host_vars/vh-01.alexpires.dev.yml
+56 -12
View File
@@ -20,8 +20,9 @@ login_users:
# SSH Connection and security
sshd_port: 22
ssh_allowed_networks:
- "0.0.0.0/0"
sshd_admin_net: "0.0.0.0/0"
- "10.5.5.5/32" # Wireguard VPN (Laptop)
- "10.19.4.0/24" # local network
sshd_admin_net: "10.19.4.0/24" # local network
sshd_allow_groups: "{{ ansible_user }} users"
sshd_permit_root_login: "no"
sshd_password_authentication: "no"
@@ -33,7 +34,8 @@ sshd_max_auth_tries: 10
# Firewall ports
ufw_enable: true
fw_allowed_ports:
- { rule: "allow", port: "22", proto: "tcp" }
- { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop)
- { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network
- { rule: "allow", port: "9090", proto: "tcp" }
ufw_outgoing_traffic:
@@ -76,9 +78,9 @@ virt_raw_block_devices:
- "nvme0n1p2"
virt_extra_grub_args: >
i915.modeset=1 i915.enable_gvt=1 i915.enable_fbc=0
initcall_blacklist=simpledrm_platform_driver_init
rd.driver.blacklist=nouveau modprobe.blacklist=nouveau
i915.modeset=1 i915.enable_gvt=1 i915.enable_fbc=0
initcall_blacklist=simpledrm_platform_driver_init
rd.driver.blacklist=nouveau modprobe.blacklist=nouveau
virt_vfio_ids:
- 10de:2482 # NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
@@ -120,7 +122,14 @@ virt_machines:
- type: "mdev"
source:
uuid: "5abeb24f-d6f4-4666-b495-303f15b05723"
address: { type: 'pci', domain: '0x0000', bus: '0x07', slot: '0x00', function: '0x0' }
address:
{
type: "pci",
domain: "0x0000",
bus: "0x07",
slot: "0x00",
function: "0x0",
}
# Fresco Logic FL1100 USB 3.0 Host Controller
- type: "pci"
source:
@@ -129,7 +138,14 @@ virt_machines:
bus: "0x06"
slot: "0x00"
function: "0x0"
address: { type: 'pci', domain: '0x0000', bus: '0x10', slot: '0x00', function: '0x0' }
address:
{
type: "pci",
domain: "0x0000",
bus: "0x10",
slot: "0x00",
function: "0x0",
}
# NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
- type: "pci"
source:
@@ -138,7 +154,14 @@ virt_machines:
bus: "0x01"
slot: "0x00"
function: "0x0"
address: { type: 'pci', domain: '0x0000', bus: '0x0b', slot: '0x00', function: '0x0' }
address:
{
type: "pci",
domain: "0x0000",
bus: "0x0b",
slot: "0x00",
function: "0x0",
}
# NVIDIA Corporation GA106 High Definition Audio Controller
- type: "pci"
source:
@@ -147,7 +170,14 @@ virt_machines:
bus: "0x01"
slot: "0x00"
function: "0x1"
address: { type: 'pci', domain: '0x0000', bus: '0x0f', slot: '0x00', function: '0x0' }
address:
{
type: "pci",
domain: "0x0000",
bus: "0x0f",
slot: "0x00",
function: "0x0",
}
- name: fedora-headless
title: "Fedora CUDA headless"
@@ -177,7 +207,14 @@ virt_machines:
bus: "0x03"
slot: "0x00"
function: "0x0"
address: { type: 'pci',domain: '0x0000',bus: '0x09',slot: '0x00',function: '0x0' }
address:
{
type: "pci",
domain: "0x0000",
bus: "0x09",
slot: "0x00",
function: "0x0",
}
# NVIDIA Corporation GA106 High Definition Audio Controller
- type: "pci"
source:
@@ -186,4 +223,11 @@ virt_machines:
bus: "0x03"
slot: "0x00"
function: "0x1"
address: { type: 'pci',domain: '0x0000',bus: '0x0a',slot: '0x00',function: '0x0' }
address:
{
type: "pci",
domain: "0x0000",
bus: "0x0a",
slot: "0x00",
function: "0x0",
}