alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity
Files
8724360fb249f683b4e46e7980355589e578a388
a13labs.infra/ansible/host_vars/gpu-01.lab.alexpires.me.yml
T
alexandre.pires 8724360fb2 Enhance infrastructure and application configurations 
- Updated AGENTS.md to include new directories for execution plans and implemented feature reports.
- Modified Ansible host variables for dev-02 and gpu-01 to change API endpoints and add new configurations for Scaleway.
- Adjusted firewall rules in gpu-01 to allow HTTPS traffic instead of the previous Ollama port.
- Added OAuth2 proxy configurations to gpu-01 for enhanced security.
- Removed deprecated open-webui module from Terraform app configurations.
- Updated Terraform configurations to reflect changes in local variables and removed unused secrets.
- Created a new sectool.json file for CloudNS integration with Bitwarden.
- Enhanced SELinux configurations for nginx to allow connections to any port and added oauth2-proxy port.
2026-07-12 16:28:45 -04:00

285 lines
8.9 KiB
YAML
Raw Blame History

hostname: gpu-01.lab.alexpires.me
ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}"
network_interface: enp7s0
# Users
login_users:
- username: "{{ ansible_user }}"
comment: "Managed by Ansible"
sudoer: true
sudoer_root_only: true
sudoer_no_password: true
pubkey: "{{ lookup('file', 'keys/ansible_user.pub') }}"
password_disabled: true
- username: operator
comment: "Managed by Ansible"
sudoer: true
pubkey: "{{ lookup('file', 'keys/operator.pub') }}"
password_expiration: false
# SSH Connection and security
sshd_port: 22
ssh_allowed_networks:
- "10.5.5.5/32" # Wireguard VPN (Laptop)
- "10.19.4.0/24" # local network
sshd_admin_net: "10.19.4.0/24" # local network
sshd_allow_groups: "{{ ansible_user }} users"
sshd_permit_root_login: "no"
sshd_password_authentication: "no"
sshd_allow_tcp_forwarding: "yes"
# Due to an issue increase the number of max auth tries
sshd_max_auth_tries: 10
packages_blocklist: []
# Firewall ports
ufw_enable: true
fw_allowed_ports:
- { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop)
- { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network
- { rule: "allow", port: "443", proto: "tcp", from: "10.19.4.0/24" } # HTTPS (nginx reverse proxy)
- { rule: "allow", port: "443", proto: "tcp", from: "10.5.5.5/32" } # HTTPS (nginx reverse proxy, VPN)
- { rule: "allow", port: "8880", proto: "tcp", from: "10.19.4.0/24" } # Kokoro-FastAPI (local network)
- { rule: "allow", port: "8880", proto: "tcp", from: "10.5.5.5/32" } # Kokoro-FastAPI (Laptop)
- { rule: "allow", port: "8188", proto: "tcp", from: "10.19.4.0/24" } # ComfyUI (local network)
- { rule: "allow", port: "8999", proto: "tcp", from: "10.19.4.0/24" } # ComfyUI - SimpleHttpServer (local network)
- { rule: "allow", port: "8012", proto: "tcp", from: "10.19.4.0/24" } # Qwen2 (local network)
- { rule: "allow", port: "8012", proto: "tcp", from: "10.5.5.5/32" } # Qwen2 (Laptop)
- { rule: "allow", port: "9091", proto: "tcp", from: "10.19.4.0/24" } # Prometheus (local network)
- { rule: "allow", port: "9091", proto: "tcp", from: "10.5.5.5/32" } # Prometheus (Laptop)
ufw_outgoing_traffic:
- 22 # SSH
- 53 # DNS
- 80 # HTTP
- 123 # NTP
- 443 # HTTPS
- 853 # DNS over TLS
- 139 # Samba
- 445 # Samba
ufw_default_forward_policy: "ACCEPT"
fw_loopback_traffic_deny: false
ipv4_sysctl_settings:
net.ipv4.ip_forward: 1
disable_ipv6: true
# geoip will override hosts_allow and hosts_deny (so it's disabled - CIS hardening)
custom_hosts_acls: true
# This fixes polkit issues with sudoers file (CIS hardening)
hide_pid: 0
# CIS by default changes compilers permissions, Nvidia KMod needs to be build
compilers:
# aide
install_aide: false
# Unattended upgrades
unattended_reboot: true
unattended_reboot_time: "04:30"
# Duo Security
duo_users: ["*", "!provision", "!comfyui", "!kokoro", "!ollama"]
duo_api_hostname: api-7cda1654.duosecurity.com
# podman services settings
podman_user_pubkey: "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAHHOPBR9p9kq5Cqzpe4cr3jHnweaYrHPXv5sXNzt+sCXP54uc5rWUBhxW2OQVvQzJ47dEVhEKi4WSC7LcuKS2G5AQDzWXNiasHvYIYQU3F/EknVCZnsiXYqXphYkJA6rJCNRnISZCIC1mocq6PB7J08ONdRFCvjfUBuVRT8BNGXNmQ/zQ=="
# ComfyUI settings
comfyui_home: "/mnt/data/comfyui"
comfyui_user_pubkey: "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAHHOPBR9p9kq5Cqzpe4cr3jHnweaYrHPXv5sXNzt+sCXP54uc5rWUBhxW2OQVvQzJ47dEVhEKi4WSC7LcuKS2G5AQDzWXNiasHvYIYQU3F/EknVCZnsiXYqXphYkJA6rJCNRnISZCIC1mocq6PB7J08ONdRFCvjfUBuVRT8BNGXNmQ/zQ=="
# Kokoro FastAPI settings (we don't set home because it is not expected to use a lot a disk space)
kokoro_user_pubkey: "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAHHOPBR9p9kq5Cqzpe4cr3jHnweaYrHPXv5sXNzt+sCXP54uc5rWUBhxW2OQVvQzJ47dEVhEKi4WSC7LcuKS2G5AQDzWXNiasHvYIYQU3F/EknVCZnsiXYqXphYkJA6rJCNRnISZCIC1mocq6PB7J08ONdRFCvjfUBuVRT8BNGXNmQ/zQ=="
# Let's Encrypt / Certbot
cloudns_auth_id: "{{ lookup('env', 'CLOUDNS_AUTH_ID') }}"
cloudns_auth_password: "{{ lookup('env', 'CLOUDNS_PASSWORD') }}"
cloudns_nameserver: "109.201.133.111"
certbot_email: c.alexandre.pires@alexpires.me
certbot_domains:
- "gpu-01.lab.alexpires.me"
certbot_cockpit_domain: "gpu-01.lab.alexpires.me"
# Llama.cpp server settings
llama_server_home: "/mnt/data/llamacpp"
llama_server_user_pubkey: "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAHHOPBR9p9kq5Cqzpe4cr3jHnweaYrHPXv5sXNzt+sCXP54uc5rWUBhxW2OQVvQzJ47dEVhEKi4WSC7LcuKS2G5AQDzWXNiasHvYIYQU3F/EknVCZnsiXYqXphYkJA6rJCNRnISZCIC1mocq6PB7J08ONdRFCvjfUBuVRT8BNGXNmQ/zQ=="
llama_server_port: 11434
llama_server_bind: "127.0.0.1"
llama_server_devices:
- "nvidia.com/gpu=all"
- "/dev/kfd:/dev/kfd:rw"
- "/dev/dri:/dev/dri:rw"
llama_server_models:
# # TODO: replace revision values with pinned commit SHAs for strict reproducibility.
- name: "gemma-4-12b-q8-0"
model_id: "unsloth/gemma-4-12b-it-GGUF"
quant: "Q8_0"
revision: "main"
# preset:
# ctx-size: 98304
- name: "gemma-4-26b-a4b-ud-iq4-xs"
model_id: "unsloth/gemma-4-26B-A4B-it-GGUF"
quant: "UD-IQ4_XS"
revision: "main"
# preset:
# ctx-size: 98304
- name: "gemma-4-31b-iq4-xs"
model_id: "unsloth/gemma-4-31B-it-GGUF"
quant: "IQ4_XS"
revision: "main"
# preset:
# ctx-size: 98304
- name: "gpt-oss-20b-q4-0"
model_id: "unsloth/gpt-oss-20b-GGUF"
quant: "Q4_0"
revision: "main"
- name: "gpt-oss-20b-q8-0"
model_id: "unsloth/gpt-oss-20b-GGUF"
quant: "Q8_0"
revision: "main"
- name: "qwen3-5-27b-q4-k-m"
model_id: "unsloth/Qwen3.5-27B-GGUF"
quant: "Q4_K_M"
revision: "main"
# preset:
# ctx-size: 98304
- name: "qwen3-5-35b-a3b-q4-k-m"
model_id: "unsloth/Qwen3.5-35B-A3B-GGUF"
quant: "Q4_K_M"
revision: "main"
# preset:
# ctx-size: 98304
- name: "qwen3-5-9b-q8-0"
model_id: "unsloth/Qwen3.5-9B-GGUF"
quant: "Q8_0"
revision: "main"
# preset:
# ctx-size: 98304
- name: "qwen3-6-27b-q4-k-m"
model_id: "unsloth/Qwen3.6-27B-GGUF"
quant: "Q4_K_M"
revision: "main"
# preset:
# ctx-size: 98304
- name: "qwen3-6-35b-a3b-ud-q4-k-m"
model_id: "unsloth/Qwen3.6-35B-A3B-GGUF"
quant: "UD-Q4_K_M"
revision: "main"
# preset:
# ctx-size: 98304
- name: "qwen3-6-27b-mtp-q4-0"
model_id: "unsloth/Qwen3.6-27B-MTP-GGUF"
quant: "Q4_0"
revision: "main"
preset:
temperature: 0.6
top_p: 0.95
top_k: 20
min_p: 0.0
presence_penalty: 0.0
repeat_penalty: 1.0
# ctx-size: 98304
- name: "qwen3-6-35b-a3b-mtp-ud-q4-m"
model_id: "unsloth/Qwen3.6-35B-A3B-MTP-GGUF"
quant: "UD-Q4_K_M"
revision: "main"
preset:
temperature: 0.6
top_p: 0.95
top_k: 20
min_p: 0.0
presence_penalty: 0.0
repeat_penalty: 1.0
# ctx-size: 98304
llama_server_argv_extra:
[
"--api-key",
"{{ lookup('env', 'OPEN_WEBUI_API_KEY', default='') }}",
"-t",
10,
"-np",
-1,
"-b",
1024,
"-ub",
512,
"-fa",
"on",
"-ctk",
"q8_0",
"-ctv",
"q4_0",
"-cram",
-1,
"-sm",
"layer",
"-dev",
"Vulkan1,Vulkan2",
"-ts",
"12,16",
"-fit",
"off",
"-mg",
1,
"--timeout",
1800,
"--mmap",
"--spec-type",
"draft-mtp",
"--spec-draft-n-max",
2,
"--swa-full",
"--cache-reuse",
256
]
auto_suspend_enabled: true
auto_suspend_check_interval: 1min
auto_suspend_idle_timeout_cycles: 10
auto_suspend_cpu_idle_threshold: 90.0
# # Optional global model preset options applied under [*] in models.ini.
# # Keys map to llama.cpp CLI args without leading dashes, short args, or LLAMA_ARG_* env names.
# llama_server_preset_global:
# ctx-size: 98304
# n-gpu-layers: all
# nginx_proxy: TLS + OAuth2/OIDC SSO for llm.lab.alexpires.me
nginx_proxy_certbot_email: "c.alexandre.pires@alexpires.me"
nginx_proxy_oauth2_proxy_enabled: true
nginx_proxy_oauth2_proxy_provider: "oidc"
nginx_proxy_oauth2_proxy_provider_url: "https://code.alexpires.me"
nginx_proxy_oauth2_proxy_redirect_urls:
- "https://llm.lab.alexpires.me/oauth2/callback"
nginx_proxy_oauth2_proxy_email_domains:
- "*"
nginx_proxy_oauth2_proxy_cookie_secret: "{{ lookup('env', 'OAUTH2_PROXY_COOKIE_SECRET', default='') }}"
nginx_proxy_oauth2_proxy_client_id: "{{ lookup('env', 'OAUTH2_PROXY_CLIENT_ID', default='') }}"
nginx_proxy_oauth2_proxy_client_secret: "{{ lookup('env', 'OAUTH2_PROXY_CLIENT_SECRET', default='') }}"
nginx_proxy_sites:
- name: llm
server_name: "llm.lab.alexpires.me"
upstream:
host: "127.0.0.1"
port: 11434
websocket: true
extra_locations:
- path: /api/
config:
proxy_pass: "http://127.0.0.1:11434/"
proxy_buffering: "off"
proxy_read_timeout: "1800s"
proxy_send_timeout: "1800s"
proxy_http_version: "1.1"
proxy_set_header Upgrade: "$http_upgrade"
proxy_set_header Connection: "$connection_upgrade"
Reference in New Issue View Git Blame Copy Permalink