alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity
Files
33cccdf396b7a8e1e20e3d33c54e8dfc93a7cf14
a13labs.infra/ansible/host_vars/vh-01.lab.alexpires.me.yml
T
alexandre.pires 4825ad1495 - Added windows llama proxy 
- Added terraform-mcp
- Added S3 storage to gitea
- Changed context size for windows LLMs
- Changed number of cores for VMs, added P2000 support
2026-06-29 14:31:28 +02:00

517 lines
13 KiB
YAML
Raw Blame History

hostname: vh-01.lab.alexpires.me
ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}"
packages_blocklist:
- apport*
- autofs
- beep
- git
- pastebinit
- popularity-contest
- prelink
- rpcbind
- rsh*
- talk*
- telnet*
- tftp*
- whoopsie
- xinetd
- yp-tools
- ypbind
misc_modules_blocklist:
- bluetooth
- bnep
- btusb
- can
- cpia2
- firewire-core
- floppy
- ksmbd
- n_hdlc
- net-pf-31
- pcspkr
- soundcore
- usb-midi
- uvcvideo
- v4l2_common
# Users
login_users:
- username: "{{ ansible_user }}"
comment: "Managed by Ansible"
sudoer: true
sudoer_root_only: true
sudoer_no_password: true
pubkey: "{{ lookup('file', 'keys/ansible_user.pub') }}"
password_disabled: true
- username: operator
comment: "Managed by Ansible"
sudoer: true
pubkey: "{{ lookup('file', 'keys/operator.pub') }}"
shell: "/bin/zsh"
password_expiration: false
# SSH Connection and security
sshd_port: 22
ssh_allowed_networks:
- "10.5.5.5/32" # Wireguard VPN (Laptop)
- "10.19.4.0/24" # local network
sshd_admin_net: "10.19.4.0/24" # local network
sshd_allow_groups: "{{ ansible_user }} users"
sshd_permit_root_login: "no"
sshd_password_authentication: "no"
sshd_allow_tcp_forwarding: "yes"
# Due to an issue increase the number of max auth tries
sshd_max_auth_tries: 10
# Firewall ports
ufw_enable: true
fw_allowed_ports:
- { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop)
- { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network
- { rule: "allow", port: "9090", proto: "tcp", from: "10.19.4.0/24" } # local network
ufw_outgoing_traffic:
- 22 # SSH
- 53 # DNS
- 80 # HTTP
- 123 # NTP
- 443 # HTTPS
- 853 # DNS over TLS
ufw_default_forward_policy: "ACCEPT"
ipv4_sysctl_settings:
net.ipv4.ip_forward: 1
disable_ipv6: true
# Network Bridge Configuration
bridge_name: "br0"
bridge_interface: "{{ ansible_default_ipv4.interface }}" # Auto-detect primary interface
bridge_ipv4_address: "10.19.4.254/24" # Adjust to your static IP
bridge_ipv4_gateway: "10.19.4.1"
bridge_ipv4_dns: "10.19.4.1,1.1.1.1"
bridge_ipv4_domain: "lab.alexpires.me"
# geoip will override hosts_allow and hosts_deny (so it's disabled - CIS hardening)
custom_hosts_acls: true
# This fixes polkit issues with sudoers file (CIS hardening)
hide_pid: 0
# aide
install_aide: false
# Unattended upgrades
unattended_reboot: false
unattended_reboot_time: "04:30"
# Duo Security
duo_users: ["*", "!provision"]
duo_api_hostname: api-7cda1654.duosecurity.com
# VMs reserved CPU )
virt_vm_reserved_cpu: "1-7,9-15"
virt_raw_block_devices: []
# Devices to unbind for VFIO passthrough (This are devices that will be unbound at boot with vfio-bind.sh)
virt_vfio_devices:
- { dev: "0000:08:00.0", vendor: "1b73", device: "1100" } # Fresco Logic FL1100 USB 3.0 Host Controller
- { dev: "0000:05:00.0", vendor: "c0a9", device: "5415" } # Micron/Crucial Technology T500 NVMe PCIe SSD
virt_extra_grub_args: >
rd.driver.blacklist=nouveau modprobe.blacklist=nouveau ipv6.disable=1 audit=1 audit_backlog_limit=8192 usbcore.autosuspend=-1
virt_vfio_ids:
- 10de:1430 # NVIDIA Corporation M2000 [Maxwell GM107GL]
- 10de:0fba # NVIDIA Corporation M2000 High Definition Audio Controller
- 10de:1c30 # NVIDIA Corporation P2000 [NVIDIA Corporation GP106GL]
- 10de:10f1 # NVIDIA Corporation P2000 High Definition Audio Controller
- 1b73:1100 # Fresco Logic FL1100 USB 3.0 Host Controller
- c0a9:5415 # Micron/Crucial Technology T500 NVMe PCIe SSD
virt_blacklist:
- noveau
- snd_hda_codec_hdmi
- i2c_nvidia_gpu
- mxm_wmi
virt_machines:
- name: win10pro
title: "Microsoft Windows 10 Pro"
uuid: "51d5d091-67cb-4113-bd8e-817e7317e1b4"
autostart: false
memory: 16
cores: 4
threads: 2
physical_cpus: "4-12,5-13,6-14,7-15"
reserved_cpus: "0,8"
enable_hyperv: true
cdrom: true
console: false
audio: true
secure_boot: true
tpm: true
tablet: true
net_bridge: br0
disk_file: "win10pro.qcow2"
mac_address: "52:54:00:cd:dd:2d"
block_devs: []
guest_agent: true
host_devs:
# Micron/Crucial Technology T500 NVMe PCIe SSD
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x05"
slot: "0x00"
function: "0x0"
address:
type: "pci"
domain: "0x0000"
bus: "0x11"
slot: "0x00"
function: "0x0"
# Fresco Logic FL1100 USB 3.0 Host Controller
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x08"
slot: "0x00"
function: "0x0"
address:
type: "pci"
domain: "0x0000"
bus: "0x10"
slot: "0x00"
function: "0x0"
# NVIDIA Corporation M2000 [Maxwell GM107GL]
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x03"
slot: "0x00"
function: "0x0"
address:
type: "pci"
domain: "0x0000"
bus: "0x0b"
slot: "0x00"
function: "0x0"
# NVIDIA Corporation M2000 High Definition Audio Controller
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x03"
slot: "0x00"
function: "0x1"
address:
type: "pci"
domain: "0x0000"
bus: "0x0f"
slot: "0x00"
function: "0x0"
- name: win11home
title: "Microsoft Windows 11 Home"
uuid: "51d5d091-67cb-4113-bd8e-817e7317e1b5"
autostart: false
memory: 16
cores: 4
threads: 2
physical_cpus: "4-12,5-13,6-14,7-15"
reserved_cpus: "0,8"
enable_hyperv: true
cdrom: true
console: false
audio: true
secure_boot: true
tpm: true
tablet: true
net_bridge: br0
disk_file: "win11home.qcow2"
mac_address: "52:54:00:cd:dd:2e"
block_devs: []
guest_agent: true
host_devs:
# Micron/Crucial Technology T500 NVMe PCIe SSD
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x05"
slot: "0x00"
function: "0x0"
address:
type: "pci"
domain: "0x0000"
bus: "0x11"
slot: "0x00"
function: "0x0"
# Fresco Logic FL1100 USB 3.0 Host Controller
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x08"
slot: "0x00"
function: "0x0"
address:
type: "pci"
domain: "0x0000"
bus: "0x10"
slot: "0x00"
function: "0x0"
# NVIDIA Corporation M2000 [Maxwell GM107GL]
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x03"
slot: "0x00"
function: "0x0"
address:
type: "pci"
domain: "0x0000"
bus: "0x0b"
slot: "0x00"
function: "0x0"
# NVIDIA Corporation M2000 High Definition Audio Controller
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x03"
slot: "0x00"
function: "0x1"
address:
type: "pci"
domain: "0x0000"
bus: "0x0f"
slot: "0x00"
function: "0x0"
- name: win2019server
title: "Microsoft Windows Server 2019"
uuid: "51d5d091-67cb-4113-bd8e-817e7317e1b6"
autostart: false
memory: 16
cores: 4
threads: 2
physical_cpus: "4-12,5-13,6-14,7-15"
reserved_cpus: "0,8"
enable_hyperv: true
cdrom: true
console: false
audio: true
secure_boot: true
tpm: true
tablet: true
net_bridge: br0
disk_file: "win2019server.qcow2"
mac_address: "52:54:00:cd:dd:2f"
block_devs: []
guest_agent: true
host_devs:
# Micron/Crucial Technology T500 NVMe PCIe SSD
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x05"
slot: "0x00"
function: "0x0"
address:
type: "pci"
domain: "0x0000"
bus: "0x11"
slot: "0x00"
function: "0x0"
# Fresco Logic FL1100 USB 3.0 Host Controller
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x08"
slot: "0x00"
function: "0x0"
address:
type: "pci"
domain: "0x0000"
bus: "0x10"
slot: "0x00"
function: "0x0"
# NVIDIA Corporation M2000 [Maxwell GM107GL]
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x03"
slot: "0x00"
function: "0x0"
address:
type: "pci"
domain: "0x0000"
bus: "0x0b"
slot: "0x00"
function: "0x0"
# NVIDIA Corporation M2000 High Definition Audio Controller
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x03"
slot: "0x00"
function: "0x1"
address:
type: "pci"
domain: "0x0000"
bus: "0x0f"
slot: "0x00"
function: "0x0"
- name: win2022server
title: "Microsoft Windows Server 2022"
uuid: "51d5d091-67cb-4113-bd8e-817e7317e1b7"
autostart: false
memory: 16
cores: 4
threads: 2
physical_cpus: "4-12,5-13,6-14,7-15"
reserved_cpus: "0,8"
enable_hyperv: true
cdrom: true
console: false
audio: true
secure_boot: true
tpm: true
tablet: true
net_bridge: br0
disk_file: "win2022server.qcow2"
mac_address: "52:54:00:cd:dd:2e"
block_devs: []
guest_agent: true
host_devs:
# Micron/Crucial Technology T500 NVMe PCIe SSD
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x05"
slot: "0x00"
function: "0x0"
address:
type: "pci"
domain: "0x0000"
bus: "0x11"
slot: "0x00"
function: "0x0"
# Fresco Logic FL1100 USB 3.0 Host Controller
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x08"
slot: "0x00"
function: "0x0"
address:
type: "pci"
domain: "0x0000"
bus: "0x10"
slot: "0x00"
function: "0x0"
# NVIDIA Corporation M2000 [Maxwell GM107GL]
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x03"
slot: "0x00"
function: "0x0"
address:
type: "pci"
domain: "0x0000"
bus: "0x0b"
slot: "0x00"
function: "0x0"
# NVIDIA Corporation M2000 High Definition Audio Controller
- type: "pci"
source:
address:
domain: "0x0000"
bus: "0x03"
slot: "0x00"
function: "0x1"
address:
type: "pci"
domain: "0x0000"
bus: "0x0f"
slot: "0x00"
function: "0x0"
- name: dev-01
title: "Lab Kubernetes VM"
uuid: "55feda16-51ae-446e-9c83-4c0eee1e5e00"
cloud_image_url: "http://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img"
cloud_image_sha256: "2b5f90ffe8180def601c021c874e55d8303e8bcbfc66fee2b94414f43ac5eb1f"
disk_size: 80G
cloud_init: true
autostart: true
memory: 8
cores: 2
threads: 2
physical_cpus: "2-10,3-11"
reserved_cpus: "0,8"
cdrom: true
console: true
audio: false
secure_boot: true
tpm: true
net_bridge: br0
disk_file: "dev-01.qcow2"
mac_address: "52:54:00:ae:f3:d0"
block_devs: []
host_devs: []
guest_agent: true
virtio_fs:
- source: "/mnt/srv"
target: "srv"
- source: "/mnt/md0"
target: "md0"
user_data: |
#cloud-config
hostname: dev-01
fqdn: dev-01.lab.alexpires.me
manage_etc_hosts: true
users:
- name: provision
sudo: ALL=(ALL) NOPASSWD:ALL
shell: /bin/bash
lock_passwd: true
ssh_authorized_keys:
- {{ lookup('file', 'keys/localnetwork.pub') | trim }}
ssh_pwauth: false
disable_root: true
package_upgrade: true
packages:
- qemu-guest-agent
runcmd:
- systemctl enable qemu-guest-agent
- systemctl start qemu-guest-agent
# Let's Encrypt / Certbot
cloudns_auth_id: "{{ lookup('env', 'CLOUDNS_AUTH_ID') }}"
cloudns_auth_password: "{{ lookup('env', 'CLOUDNS_PASSWORD') }}"
cloudns_nameserver: "109.201.133.111"
certbot_email: c.alexandre.pires@alexpires.me
certbot_domains:
- "vh-01.lab.alexpires.me"
certbot_cockpit_domain: "vh-01.lab.alexpires.me"
Reference in New Issue View Git Blame Copy Permalink