- Implemented samba service

- Improved firewall rules

ansible/host_vars/dev-01.alexpires.dev.yml

@@ -18,8 +18,9 @@ login_users:
 # SSH Connection and security
 sshd_port: 22
 ssh_allowed_networks:
-  - "0.0.0.0/0"
+  - "10.5.5.5/32" # Wireguard VPN (Laptop)
-sshd_admin_net: "0.0.0.0/0"
+  - "10.19.4.0/24" # local network
+sshd_admin_net: "10.19.4.0/24" # local network
 sshd_allow_groups: "{{ ansible_user }} users"
 sshd_permit_root_login: "no"
 sshd_password_authentication: "no"
@@ -31,8 +32,13 @@ sshd_max_auth_tries: 10
 # Firewall ports
 ufw_enable: true
 fw_allowed_ports:
-  - { rule: "allow", port: "22", proto: "tcp" }
+  - { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop)
-  - { rule: "allow", port: "443", proto: "tcp" }
+  - { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network
+  - { rule: "allow", port: "16443", proto: "tcp", from: "10.5.5.5/32" } # Kubernetes API (Laptop)
+  - { rule: "allow", port: "16443", proto: "tcp", from: "10.19.4.0/24" } # Kubernetes API (local network)
+  - { rule: "allow", port: "139", proto: "tcp", from: "10.19.4.0/24" } # Samba (local network)
+  - { rule: "allow", port: "445", proto: "tcp", from: "10.19.4.0/24" } # Samba (local network)
+  - { rule: "allow", port: "443", proto: "tcp", from: "10.5.5.2/32" } # Wireguard VPN (Kokoro-FastAPI)
 
 ufw_outgoing_traffic:
   - 22 # SSH
@@ -73,6 +79,24 @@ fail2ban_jails:
 # aide
 install_aide: false
 
+misc_modules_blocklist:
+  - bluetooth
+  - bnep
+  - btusb
+  - can
+  - cpia2
+  - firewire-core
+  - floppy
+  - ksmbd
+  - n_hdlc
+  - net-pf-31
+  - pcspkr
+  - soundcore
+  - thunderbolt
+  - usb-midi
+  - uvcvideo
+  - v4l2_common
+
 # Unattended upgrades
 unattended_reboot: true
 unattended_reboot_time: "04:30"

ansible/host_vars/gpu-01.alexpires.dev.yml

@@ -19,8 +19,9 @@ login_users:
 # SSH Connection and security
 sshd_port: 22
 ssh_allowed_networks:
-  - "0.0.0.0/0"
+  - "10.5.5.5/32" # Wireguard VPN (Laptop)
-sshd_admin_net: "0.0.0.0/0"
+  - "10.19.4.0/24" # local network
+sshd_admin_net: "10.19.4.0/24" # local network
 sshd_allow_groups: "{{ ansible_user }} users"
 sshd_permit_root_login: "no"
 sshd_password_authentication: "no"
@@ -34,9 +35,11 @@ packages_blocklist: []
 # Firewall ports
 ufw_enable: true
 fw_allowed_ports:
-  - { rule: "allow", port: "22", proto: "tcp" }
+  - { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop)
-  - { rule: "allow", port: "11434", proto: "tcp" }
+  - { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network
-  - { rule: "allow", port: "8880", proto: "tcp" }
+  - { rule: "allow", port: "11434", proto: "tcp", from: "10.19.4.0/24" } # Ollama (local network)
+  - { rule: "allow", port: "11434", proto: "tcp", from: "10.5.5.5/32" } # Ollama (Laptop)
+  - { rule: "allow", port: "8880", proto: "tcp", from: "10.19.4.0/24" } # Kokoro-FastAPI (local network)
 
 ufw_outgoing_traffic:
   - 22 # SSH

ansible/host_vars/prod-01.alexpires.me.yml

@@ -46,12 +46,8 @@ fw_allowed_ports:
   - { rule: "allow", port: "21116", proto: "tcp" }
   - { rule: "allow", port: "21116", proto: "udp" }
   - { rule: "allow", port: "21117", proto: "tcp" }
-  - { rule: "allow", port: "16443", proto: "tcp", from: "10.1.0.0/16" }
-  - { rule: "allow", port: "10254", proto: "tcp", from: "10.1.0.0/16" }
   # Access to the Kube API Server from the Office
   - { rule: "allow", port: "16443", proto: "tcp", from: "188.82.170.183" }
-  # VPN to Portugal
-  - { rule: "allow", port: "10254", proto: "tcp", from: "147.78.131.194" }
 
 ufw_outgoing_traffic:
   - 22 # SSH

ansible/host_vars/vh-01.alexpires.dev.yml

@@ -20,8 +20,9 @@ login_users:
 # SSH Connection and security
 sshd_port: 22
 ssh_allowed_networks:
-  - "0.0.0.0/0"
+  - "10.5.5.5/32" # Wireguard VPN (Laptop)
-sshd_admin_net: "0.0.0.0/0"
+  - "10.19.4.0/24" # local network
+sshd_admin_net: "10.19.4.0/24" # local network
 sshd_allow_groups: "{{ ansible_user }} users"
 sshd_permit_root_login: "no"
 sshd_password_authentication: "no"
@@ -33,7 +34,8 @@ sshd_max_auth_tries: 10
 # Firewall ports
 ufw_enable: true
 fw_allowed_ports:
-  - { rule: "allow", port: "22", proto: "tcp" }
+  - { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop)
+  - { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network
   - { rule: "allow", port: "9090", proto: "tcp" }
 
 ufw_outgoing_traffic:
@@ -120,7 +122,14 @@ virt_machines:
       - type: "mdev"
         source:
           uuid: "5abeb24f-d6f4-4666-b495-303f15b05723"
-        address: { type: 'pci', domain: '0x0000', bus: '0x07', slot: '0x00', function: '0x0' }
+        address:
+          {
+            type: "pci",
+            domain: "0x0000",
+            bus: "0x07",
+            slot: "0x00",
+            function: "0x0",
+          }
       # Fresco Logic FL1100 USB 3.0 Host Controller
       - type: "pci"
         source:
@@ -129,7 +138,14 @@ virt_machines:
             bus: "0x06"
             slot: "0x00"
             function: "0x0"
-        address: { type: 'pci', domain: '0x0000', bus: '0x10', slot: '0x00', function: '0x0' }
+        address:
+          {
+            type: "pci",
+            domain: "0x0000",
+            bus: "0x10",
+            slot: "0x00",
+            function: "0x0",
+          }
       # NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
       - type: "pci"
         source:
@@ -138,7 +154,14 @@ virt_machines:
             bus: "0x01"
             slot: "0x00"
             function: "0x0"
-        address: { type: 'pci', domain: '0x0000', bus: '0x0b', slot: '0x00', function: '0x0' }
+        address:
+          {
+            type: "pci",
+            domain: "0x0000",
+            bus: "0x0b",
+            slot: "0x00",
+            function: "0x0",
+          }
       # NVIDIA Corporation GA106 High Definition Audio Controller
       - type: "pci"
         source:
@@ -147,7 +170,14 @@ virt_machines:
             bus: "0x01"
             slot: "0x00"
             function: "0x1"
-        address: { type: 'pci', domain: '0x0000', bus: '0x0f', slot: '0x00', function: '0x0' }
+        address:
+          {
+            type: "pci",
+            domain: "0x0000",
+            bus: "0x0f",
+            slot: "0x00",
+            function: "0x0",
+          }
 
   - name: fedora-headless
     title: "Fedora CUDA headless"
@@ -177,7 +207,14 @@ virt_machines:
             bus: "0x03"
             slot: "0x00"
             function: "0x0"
-        address: { type: 'pci',domain: '0x0000',bus: '0x09',slot: '0x00',function: '0x0' }
+        address:
+          {
+            type: "pci",
+            domain: "0x0000",
+            bus: "0x09",
+            slot: "0x00",
+            function: "0x0",
+          }
       # NVIDIA Corporation GA106 High Definition Audio Controller
       - type: "pci"
         source:
@@ -186,4 +223,11 @@ virt_machines:
             bus: "0x03"
             slot: "0x00"
             function: "0x1"
-        address: { type: 'pci',domain: '0x0000',bus: '0x0a',slot: '0x00',function: '0x0' }
+        address:
+          {
+            type: "pci",
+            domain: "0x0000",
+            bus: "0x0a",
+            slot: "0x00",
+            function: "0x0",
+          }

terraform/apps/dev-01/apps.tf

@@ -4,3 +4,9 @@ module "open-webui" {
   persistent_folder = local.persistent_folder
   fqdn              = local.open_webui_fqdn
 }
+
+module "samba" {
+  source = "../../modules/apps/samba"
+
+  shared_folder = local.samba_shared_folder
+}

terraform/apps/dev-01/config.tf

@@ -6,4 +6,7 @@ locals {
   primary_domain  = "alexpires.me"
   open_webui_fqdn = "ai.${local.primary_domain}"
   internal_issuer = "internal-ca"
+
+  # samba
+  samba_shared_folder = "/mnt/usb"
 }

terraform/apps/prod-01/config.tf

@@ -115,12 +115,6 @@ locals {
         #   upstream = "http://10.19.4.136:8000"
         #   rewrite  = "^/tools/gitea/(.*)$ /$1 break"
         # },
-        {
-          private  = true
-          path     = "/providers/ollama"
-          upstream = "http://10.19.4.106:11434"
-          rewrite  = "^/providers/ollama/(.*)$ /$1 break"
-        },
         {
           path = "/"
           headers = {

terraform/modules/apps/nginx-reverse-proxy/main.tf

@@ -306,27 +306,6 @@ resource "kubernetes_deployment" "reverse_proxy" {
             }
           }
 
-          readiness_probe {
-            http_get {
-              path = "/"
-              port = 8080
-            }
-            initial_delay_seconds = 5
-            period_seconds        = 10
-          }
-
-          liveness_probe {
-            http_get {
-              path = "/"
-              port = 8080
-            }
-            initial_delay_seconds = 5
-            period_seconds        = 10
-            failure_threshold     = 10
-            timeout_seconds       = 5
-            success_threshold     = 1
-          }
-
           security_context {
             allow_privilege_escalation = false
           }

terraform/modules/apps/open-webui/main.tf

@@ -54,7 +54,7 @@ resource "kubernetes_deployment" "openwebui" {
     }
 
     strategy {
-      type = "Recreate"
+      type = "RollingUpdate"
     }
 
     template {

terraform/modules/apps/samba/config.tf

@@ -0,0 +1,4 @@
+locals {
+  samba_version = var.tag
+}
+

terraform/modules/apps/samba/main.tf

@@ -0,0 +1,147 @@
+resource "kubernetes_namespace" "samba" {
+  metadata {
+    name = "samba"
+  }
+}
+
+resource "kubernetes_service_account" "samba" {
+
+  metadata {
+    name      = "samba-sa"
+    namespace = kubernetes_namespace.samba.metadata[0].name
+  }
+
+  automount_service_account_token = false
+}
+
+resource "kubernetes_secret" "samba_secrets" {
+  metadata {
+    name      = "samba-credentials"
+    namespace = kubernetes_namespace.samba.metadata[0].name
+  }
+
+  data = {
+    USERNAME = var.samba_username
+    PASSWORD = var.samba_password
+  }
+}
+
+resource "kubernetes_deployment" "samba" {
+  metadata {
+    name      = "samba"
+    namespace = kubernetes_namespace.samba.metadata[0].name
+    labels = {
+      samba = "samba"
+    }
+  }
+
+  spec {
+    replicas = 1
+
+    selector {
+      match_labels = {
+        samba = "samba"
+      }
+    }
+
+    strategy {
+      type = "Recreate"
+    }
+
+    template {
+      metadata {
+        labels = {
+          samba = "samba"
+        }
+      }
+
+      spec {
+        service_account_name            = kubernetes_service_account.samba.metadata[0].name
+        automount_service_account_token = false
+
+        container {
+          name  = "samba"
+          image = "dockurr/samba:${local.samba_version}"
+
+
+          security_context {
+            allow_privilege_escalation = false
+          }
+
+          port {
+            name           = "smb-1"
+            container_port = 445
+            host_port      = 445
+            protocol       = "TCP"
+          }
+
+          port {
+            name           = "smb-2"
+            container_port = 139
+            host_port      = 139
+            protocol       = "TCP"
+          }
+
+          env {
+            name = "USER"
+            value_from {
+              secret_key_ref {
+                name = kubernetes_secret.samba_secrets.metadata[0].name
+                key  = "USERNAME"
+              }
+            }
+          }
+
+          env {
+            name = "PASS"
+            value_from {
+              secret_key_ref {
+                name = kubernetes_secret.samba_secrets.metadata[0].name
+                key  = "PASSWORD"
+              }
+            }
+          }
+
+          volume_mount {
+            name       = "storage"
+            mount_path = "/storage"
+          }
+        }
+
+        volume {
+          name = "storage"
+          host_path {
+            path = var.shared_folder
+          }
+        }
+      }
+    }
+  }
+}
+
+resource "kubernetes_service" "samba" {
+  metadata {
+    name      = "samba-ports"
+    namespace = kubernetes_namespace.samba.metadata[0].name
+  }
+
+  spec {
+    selector = {
+      samba = "samba"
+    }
+
+    port {
+      name        = "smb"
+      port        = 445
+      target_port = 445
+    }
+
+    type = "LoadBalancer"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      metadata[0].annotations
+    ]
+  }
+}

terraform/modules/apps/samba/provider.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = "~>1.8"
+  required_providers {
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "2.36.0"
+    }
+  }
+}

terraform/modules/apps/samba/variables.tf

@@ -0,0 +1,23 @@
+variable "tag" {
+  description = "The version of app to install"
+  type        = string
+  default     = "latest"
+}
+
+variable "shared_folder" {
+  description = "Path to the shared folder on the host"
+  type        = string
+}
+
+variable "samba_username" {
+  description = "Username for Samba access"
+  type        = string
+  default     = "samba"
+}
+
+variable "samba_password" {
+  description = "Password for Samba access"
+  type        = string
+  default     = "samba"
+  sensitive   = true
+}