hostname: gpu-01.lab.alexpires.me ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}" network_interface: enp7s0 # Users login_users: - username: "{{ ansible_user }}" comment: "Managed by Ansible" sudoer: true sudoer_root_only: true sudoer_no_password: true pubkey: "{{ lookup('file', 'keys/ansible_user.pub') }}" password_disabled: true - username: operator comment: "Managed by Ansible" sudoer: true pubkey: "{{ lookup('file', 'keys/operator.pub') }}" password_expiration: false # SSH Connection and security sshd_port: 22 ssh_allowed_networks: - "10.5.5.5/32" # Wireguard VPN (Laptop) - "10.19.4.0/24" # local network sshd_admin_net: "10.19.4.0/24" # local network sshd_allow_groups: "{{ ansible_user }} users" sshd_permit_root_login: "no" sshd_password_authentication: "no" sshd_allow_tcp_forwarding: "yes" # Due to an issue increase the number of max auth tries sshd_max_auth_tries: 10 packages_blocklist: [] # Firewall ports ufw_enable: true fw_allowed_ports: - { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop) - { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network - { rule: "allow", port: "11434", proto: "tcp", from: "10.19.4.0/24" } # Ollama (local network) - { rule: "allow", port: "11434", proto: "tcp", from: "10.5.5.5/32" } # Ollama (Laptop) - { rule: "allow", port: "8880", proto: "tcp", from: "10.19.4.0/24" } # Kokoro-FastAPI (local network) - { rule: "allow", port: "8880", proto: "tcp", from: "10.5.5.5/32" } # Kokoro-FastAPI (Laptop) - { rule: "allow", port: "8188", proto: "tcp", from: "10.19.4.0/24" } # ComfyUI (local network) - { rule: "allow", port: "8999", proto: "tcp", from: "10.19.4.0/24" } # ComfyUI - SimpleHttpServer (local network) - { rule: "allow", port: "8012", proto: "tcp", from: "10.19.4.0/24" } # Qwen2 (local network) - { rule: "allow", port: "8012", proto: "tcp", from: "10.5.5.5/32" } # Qwen2 (Laptop) - { rule: "allow", port: "9091", proto: "tcp", from: "10.19.4.0/24" } # Prometheus (local network) - { rule: "allow", port: "9091", proto: "tcp", from: "10.5.5.5/32" } # Prometheus (Laptop) ufw_outgoing_traffic: - 22 # SSH - 53 # DNS - 80 # HTTP - 123 # NTP - 443 # HTTPS - 853 # DNS over TLS - 139 # Samba - 445 # Samba ufw_default_forward_policy: "ACCEPT" fw_loopback_traffic_deny: false ipv4_sysctl_settings: net.ipv4.ip_forward: 1 disable_ipv6: true # geoip will override hosts_allow and hosts_deny (so it's disabled - CIS hardening) custom_hosts_acls: true # This fixes polkit issues with sudoers file (CIS hardening) hide_pid: 0 # CIS by default changes compilers permissions, Nvidia KMod needs to be build compilers: # aide install_aide: false # Unattended upgrades unattended_reboot: true unattended_reboot_time: "04:30" # Duo Security duo_users: ["*", "!provision", "!comfyui", "!kokoro", "!ollama"] duo_api_hostname: api-7cda1654.duosecurity.com # podman services settings podman_user_pubkey: "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAHHOPBR9p9kq5Cqzpe4cr3jHnweaYrHPXv5sXNzt+sCXP54uc5rWUBhxW2OQVvQzJ47dEVhEKi4WSC7LcuKS2G5AQDzWXNiasHvYIYQU3F/EknVCZnsiXYqXphYkJA6rJCNRnISZCIC1mocq6PB7J08ONdRFCvjfUBuVRT8BNGXNmQ/zQ==" # ComfyUI settings comfyui_home: "/mnt/data/comfyui" comfyui_user_pubkey: "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAHHOPBR9p9kq5Cqzpe4cr3jHnweaYrHPXv5sXNzt+sCXP54uc5rWUBhxW2OQVvQzJ47dEVhEKi4WSC7LcuKS2G5AQDzWXNiasHvYIYQU3F/EknVCZnsiXYqXphYkJA6rJCNRnISZCIC1mocq6PB7J08ONdRFCvjfUBuVRT8BNGXNmQ/zQ==" # Kokoro FastAPI settings (we don't set home because it is not expected to use a lot a disk space) kokoro_user_pubkey: "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAHHOPBR9p9kq5Cqzpe4cr3jHnweaYrHPXv5sXNzt+sCXP54uc5rWUBhxW2OQVvQzJ47dEVhEKi4WSC7LcuKS2G5AQDzWXNiasHvYIYQU3F/EknVCZnsiXYqXphYkJA6rJCNRnISZCIC1mocq6PB7J08ONdRFCvjfUBuVRT8BNGXNmQ/zQ==" # Let's Encrypt / Certbot cloudns_auth_id: "{{ lookup('env', 'CLOUDNS_AUTH_ID') }}" cloudns_auth_password: "{{ lookup('env', 'CLOUDNS_PASSWORD') }}" cloudns_nameserver: "109.201.133.111" certbot_email: c.alexandre.pires@alexpires.me certbot_domains: - "gpu-01.lab.alexpires.me" certbot_cockpit_domain: "gpu-01.lab.alexpires.me" # Llama.cpp server settings llama_server_home: "/mnt/data/llamacpp" llama_server_user_pubkey: "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAHHOPBR9p9kq5Cqzpe4cr3jHnweaYrHPXv5sXNzt+sCXP54uc5rWUBhxW2OQVvQzJ47dEVhEKi4WSC7LcuKS2G5AQDzWXNiasHvYIYQU3F/EknVCZnsiXYqXphYkJA6rJCNRnISZCIC1mocq6PB7J08ONdRFCvjfUBuVRT8BNGXNmQ/zQ==" llama_server_port: 11434 llama_server_devices: - "nvidia.com/gpu=all" - "/dev/kfd:/dev/kfd:rw" - "/dev/dri:/dev/dri:rw" llama_server_models: # TODO: replace revision values with pinned commit SHAs for strict reproducibility. - name: "gpt-oss-20b-q4-0" model_id: "unsloth/gpt-oss-20b-GGUF" quant: "Q4_0" revision: "main" - name: "gpt-oss-20b-q8-0" model_id: "unsloth/gpt-oss-20b-GGUF" quant: "Q8_0" revision: "main" - name: "gemma-4-12b-q8-0" model_id: "unsloth/gemma-4-12b-it-GGUF" quant: "Q8_0" revision: "main" preset: ctx-size: 98304 - name: "gemma-4-26b-a4b-ud-iq4-xs" model_id: "unsloth/gemma-4-26B-A4B-it-GGUF" quant: "UD-IQ4_XS" revision: "main" preset: ctx-size: 98304 - name: "gemma-4-31b-iq4-xs" model_id: "unsloth/gemma-4-31B-it-GGUF" quant: "IQ4_XS" revision: "main" preset: ctx-size: 98304 - name: "qwen3-5-9b-iq4-xs" model_id: "unsloth/Qwen3.5-9B-GGUF" quant: "IQ4_XS" revision: "main" preset: ctx-size: 98304 - name: "qwen3-5-9b-q8-0" model_id: "unsloth/Qwen3.5-9B-GGUF" quant: "Q8_0" revision: "main" preset: ctx-size: 98304 - name: "qwen3-5-27b-mtp-iq4-xs" model_id: "unsloth/Qwen3.5-27B-MTP-GGUF" quant: "IQ4_XS" revision: "main" preset: ctx-size: 98304 - name: "qwen3-5-35b-a3b-ud-iq4-xs" model_id: "unsloth/Qwen3.5-35B-A3B-GGUF" quant: "UD-IQ4_XS" revision: "main" preset: ctx-size: 98304 - name: "qwen3-5-35b-a3b-q4-k-m" model_id: "unsloth/Qwen3.5-35B-A3B-GGUF" quant: "Q4_K_M" revision: "main" preset: ctx-size: 98304 - name: "qwen3-6-27b-mtp-q4-0" model_id: "unsloth/Qwen3.6-27B-MTP-GGUF" quant: "Q4_0" revision: "main" preset: ctx-size: 98304 - name: "qwen3-6-27b-mtp-ud-q4-0-k-xl" model_id: "unsloth/Qwen3.6-27B-MTP-GGUF" quant: "UD-Q4_K_XL" revision: "main" preset: ctx-size: 98304 - name: "qwen3-6-27b-mtp-ud-q4-xl" model_id: "unsloth/Qwen3.6-27B-MTP-GGUF" quant: "UD-Q4_K_XL" revision: "main" preset: ctx-size: 98304 - name: "qwen3-6-35b-a3b-mtp-ud-iq4-xs" model_id: "unsloth/Qwen3.6-35B-A3B-MTP-GGUF" quant: "UD-IQ4_XS" revision: "main" preset: ctx-size: 98304 - name: "qwen3-6-35b-a3b-mtp-ud-q4-m" model_id: "unsloth/Qwen3.6-35B-A3B-MTP-GGUF" quant: "UD-Q4_K_M" revision: "main" preset: ctx-size: 98304 - name: "qwen3-6-35b-a3b-ud-q4-k-m" model_id: "unsloth/Qwen3.6-35B-A3B-GGUF" quant: "UD-Q4_K_M" revision: "main" preset: ctx-size: 98304 - name: "qwen3-6-35b-a3b-claude47-distilled-iq4-xs" model_id: "lordx64/Qwen3.6-35B-A3B-Claude-4.7-Opus-Reasoning-Distilled-IQ4_XS-GGUF" quant: "IQ4_XS" revision: "main" preset: ctx-size: 98304 - name: "ministral-3-14b-instruct-iq4-xs" model_id: "unsloth/Ministral-3-14B-Instruct-2512-GGUF" quant: "IQ4_XS" revision: "main" preset: ctx-size: 98304 - name: "granite-4-1-30b-iq4-xs" model_id: "unsloth/granite-4.1-30b-GGUF" quant: "IQ4_XS" revision: "main" preset: ctx-size: 98304 - name: "devstral-small-2-24b-instruct-iq4-xs" model_id: "unsloth/Devstral-Small-2-24B-Instruct-2512-GGUF" quant: "IQ4_XS" revision: "main" llama_server_argv_extra: [ "-t", 10, "-np", -1, "-b", 1024, "-ub", 512, "-fa", "on", "-ctk", "q4_0", "-ctv", "q8_0", "-cram", -1, "-sm", "layer", "-dev", "Vulkan1,Vulkan2", "-ts", "12,16", "-fit", "off", "-mg", 1, "--mmap", ] auto_suspend_enabled: true auto_suspend_check_interval: 1min auto_suspend_idle_timeout_cycles: 10 auto_suspend_cpu_idle_threshold: 90.0 # # Optional global model preset options applied under [*] in models.ini. # # Keys map to llama.cpp CLI args without leading dashes, short args, or LLAMA_ARG_* env names. # llama_server_preset_global: # ctx-size: 98304 # n-gpu-layers: all