alexandre.pires
01bf71f8d2
- Introduced a new Cloudns issuer configuration for cert-manager. - Created separate tasks for DNS-01 and HTTP-01 challenge issuers. - Updated cert-manager tasks to include Cloudns provider and manage secrets. - Refactored existing LetsEncrypt issuer registration to use new task structure. - Added necessary Kubernetes resources for Cloudns integration, including RBAC and certificates. - Updated Terraform configurations to support new DNS records and service changes. - Adjusted deployment strategies for CoreDNS and Open WebUI applications.
241 lines
6.0 KiB
YAML
241 lines
6.0 KiB
YAML
hostname: vh-01.lab.alexpires.me
|
|
ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}"
|
|
|
|
# Users
|
|
login_users:
|
|
- username: "{{ ansible_user }}"
|
|
comment: "Managed by Ansible"
|
|
sudoer: true
|
|
sudoer_root_only: true
|
|
sudoer_no_password: true
|
|
pubkey: "{{ lookup('file', 'keys/ansible_user.pub') }}"
|
|
password_disabled: true
|
|
- username: operator
|
|
comment: "Managed by Ansible"
|
|
sudoer: true
|
|
pubkey: "{{ lookup('file', 'keys/operator.pub') }}"
|
|
shell: "/bin/zsh"
|
|
password_expiration: false
|
|
|
|
# SSH Connection and security
|
|
sshd_port: 22
|
|
ssh_allowed_networks:
|
|
- "10.5.5.5/32" # Wireguard VPN (Laptop)
|
|
- "10.19.4.0/24" # local network
|
|
sshd_admin_net: "10.19.4.0/24" # local network
|
|
sshd_allow_groups: "{{ ansible_user }} users"
|
|
sshd_permit_root_login: "no"
|
|
sshd_password_authentication: "no"
|
|
sshd_allow_tcp_forwarding: "yes"
|
|
|
|
# Due to an issue increase the number of max auth tries
|
|
sshd_max_auth_tries: 10
|
|
|
|
# Firewall ports
|
|
ufw_enable: true
|
|
fw_allowed_ports:
|
|
- { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop)
|
|
- { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network
|
|
- { rule: "allow", port: "9090", proto: "tcp" }
|
|
|
|
ufw_outgoing_traffic:
|
|
- 22 # SSH
|
|
- 53 # DNS
|
|
- 80 # HTTP
|
|
- 123 # NTP
|
|
- 443 # HTTPS
|
|
- 853 # DNS over TLS
|
|
|
|
ufw_default_forward_policy: "ACCEPT"
|
|
|
|
ipv4_sysctl_settings:
|
|
net.ipv4.ip_forward: 1
|
|
|
|
disable_ipv6: true
|
|
|
|
# geoip will override hosts_allow and hosts_deny (so it's disabled - CIS hardening)
|
|
custom_hosts_acls: true
|
|
|
|
# This fixes polkit issues with sudoers file (CIS hardening)
|
|
hide_pid: 0
|
|
|
|
# aide
|
|
install_aide: false
|
|
|
|
# Unattended upgrades
|
|
unattended_reboot: true
|
|
unattended_reboot_time: "04:30"
|
|
|
|
# Duo Security
|
|
duo_users: ["*", "!provision"]
|
|
duo_api_hostname: api-7cda1654.duosecurity.com
|
|
|
|
# VMs reserved CPU (for gaming and AI)
|
|
virt_vm_reserved_cpu: "1-5,7-11"
|
|
virt_raw_block_devices:
|
|
- "nvme0n1"
|
|
- "nvme0n1p1"
|
|
- "nvme0n1p2"
|
|
|
|
virt_extra_grub_args: >
|
|
i915.modeset=1 i915.enable_gvt=1 i915.enable_fbc=0
|
|
initcall_blacklist=simpledrm_platform_driver_init
|
|
rd.driver.blacklist=nouveau modprobe.blacklist=nouveau
|
|
|
|
virt_vfio_ids:
|
|
- 10de:2482 # NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
|
|
- 10de:228b # NVIDIA Corporation GA106 High Definition Audio Controller
|
|
- 10de:2504 # NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate]
|
|
- 10de:228e # NVIDIA Corporation GA106 High Definition Audio Controller
|
|
- 1b73:1100 # Fresco Logic FL1100 USB 3.0 Host Controller
|
|
|
|
virt_blacklist:
|
|
- noveau
|
|
- snd_hda_codec_hdmi
|
|
- i2c_nvidia_gpu
|
|
- mxm_wmi
|
|
|
|
virt_machines:
|
|
- name: windows-11
|
|
title: "Microsoft Windows 11"
|
|
uuid: "51d5d091-67cb-4113-bd8e-817e7317e1b4"
|
|
autostart: true
|
|
memory: 25165824
|
|
cores: 4
|
|
threads: 2
|
|
physical_cpus: "2-8,3-9,4-10,5-11"
|
|
reserved_cpus: "0,6"
|
|
enable_hyperv: true
|
|
cdrom: true
|
|
console: false
|
|
audio: true
|
|
secure_boot: true
|
|
tpm: true
|
|
tablet: true
|
|
disk_file: "windows-11.qcow2"
|
|
mac_address: "52:54:00:cd:dd:2d"
|
|
block_devs:
|
|
- block_dev: "/dev/nvme0n1"
|
|
target_dev: "sdb"
|
|
host_devs:
|
|
# Intel MDev device for GVT-g
|
|
- type: "mdev"
|
|
source:
|
|
uuid: "5abeb24f-d6f4-4666-b495-303f15b05723"
|
|
address:
|
|
{
|
|
type: "pci",
|
|
domain: "0x0000",
|
|
bus: "0x07",
|
|
slot: "0x00",
|
|
function: "0x0",
|
|
}
|
|
# Fresco Logic FL1100 USB 3.0 Host Controller
|
|
- type: "pci"
|
|
source:
|
|
address:
|
|
domain: "0x0000"
|
|
bus: "0x06"
|
|
slot: "0x00"
|
|
function: "0x0"
|
|
address:
|
|
{
|
|
type: "pci",
|
|
domain: "0x0000",
|
|
bus: "0x10",
|
|
slot: "0x00",
|
|
function: "0x0",
|
|
}
|
|
# NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
|
|
- type: "pci"
|
|
source:
|
|
address:
|
|
domain: "0x0000"
|
|
bus: "0x01"
|
|
slot: "0x00"
|
|
function: "0x0"
|
|
address:
|
|
{
|
|
type: "pci",
|
|
domain: "0x0000",
|
|
bus: "0x0b",
|
|
slot: "0x00",
|
|
function: "0x0",
|
|
}
|
|
# NVIDIA Corporation GA106 High Definition Audio Controller
|
|
- type: "pci"
|
|
source:
|
|
address:
|
|
domain: "0x0000"
|
|
bus: "0x01"
|
|
slot: "0x00"
|
|
function: "0x1"
|
|
address:
|
|
{
|
|
type: "pci",
|
|
domain: "0x0000",
|
|
bus: "0x0f",
|
|
slot: "0x00",
|
|
function: "0x0",
|
|
}
|
|
|
|
- name: fedora-headless
|
|
title: "Fedora CUDA headless"
|
|
uuid: "55feda16-51ae-446e-9c83-4c0eee1e5e00"
|
|
autostart: true
|
|
memory: 33554432
|
|
cores: 1
|
|
threads: 2
|
|
physical_cpus: "1-7"
|
|
reserved_cpus: "0,6"
|
|
cdrom: false
|
|
console: true
|
|
audio: false
|
|
secure_boot: false
|
|
tpm: true
|
|
disk_file: "fedora-headless.qcow2"
|
|
mac_address: "52:54:00:ae:f3:d0"
|
|
block_devs:
|
|
- block_dev: "/dev/nvme0n1"
|
|
target_dev: "sdb"
|
|
host_devs:
|
|
# NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate]
|
|
- type: "pci"
|
|
source:
|
|
address:
|
|
domain: "0x0000"
|
|
bus: "0x03"
|
|
slot: "0x00"
|
|
function: "0x0"
|
|
address:
|
|
{
|
|
type: "pci",
|
|
domain: "0x0000",
|
|
bus: "0x09",
|
|
slot: "0x00",
|
|
function: "0x0",
|
|
}
|
|
# NVIDIA Corporation GA106 High Definition Audio Controller
|
|
- type: "pci"
|
|
source:
|
|
address:
|
|
domain: "0x0000"
|
|
bus: "0x03"
|
|
slot: "0x00"
|
|
function: "0x1"
|
|
address:
|
|
{
|
|
type: "pci",
|
|
domain: "0x0000",
|
|
bus: "0x0a",
|
|
slot: "0x00",
|
|
function: "0x0",
|
|
}
|
|
|
|
cloudns_auth_id: "{{ lookup('env', 'CLOUDNS_AUTH_ID') }}"
|
|
cloudns_auth_password: "{{ lookup('env', 'CLOUDNS_PASSWORD') }}"
|
|
cloudns_nameserver: "109.201.133.111"
|
|
certbot_email: c.alexandre.pires@alexpires.me
|
|
certbot_domains:
|
|
- "vh-01.lab.alexpires.me"
|