alexandre.pires
8724360fb2
- Updated AGENTS.md to include new directories for execution plans and implemented feature reports. - Modified Ansible host variables for dev-02 and gpu-01 to change API endpoints and add new configurations for Scaleway. - Adjusted firewall rules in gpu-01 to allow HTTPS traffic instead of the previous Ollama port. - Added OAuth2 proxy configurations to gpu-01 for enhanced security. - Removed deprecated open-webui module from Terraform app configurations. - Updated Terraform configurations to reflect changes in local variables and removed unused secrets. - Created a new sectool.json file for CloudNS integration with Bitwarden. - Enhanced SELinux configurations for nginx to allow connections to any port and added oauth2-proxy port.
337 lines
10 KiB
YAML
337 lines
10 KiB
YAML
---
|
|
- name: Validate llama_server_models schema
|
|
ansible.builtin.assert:
|
|
that:
|
|
- llama_server_models is iterable
|
|
fail_msg: "llama_server_models must be a list"
|
|
|
|
- name: Create group
|
|
become: true
|
|
ansible.builtin.group:
|
|
name: "{{ llama_server_group }}"
|
|
system: true
|
|
|
|
- name: Create user
|
|
become: true
|
|
ansible.builtin.user:
|
|
name: "{{ llama_server_user }}"
|
|
groups: "{{ podman_extra_groups | default([]) }}"
|
|
shell: /bin/bash
|
|
home: "{{ llama_server_home }}"
|
|
group: "{{ llama_server_group }}"
|
|
|
|
- name: Disable password login for user
|
|
ansible.builtin.command: passwd -d "{{ llama_server_user }}"
|
|
become: true
|
|
changed_when: false
|
|
|
|
- name: Create user home
|
|
become: true
|
|
ansible.builtin.file:
|
|
path: "{{ llama_server_home }}"
|
|
state: directory
|
|
owner: "{{ llama_server_user }}"
|
|
group: "{{ llama_server_group }}"
|
|
mode: "0750"
|
|
|
|
- name: Set fact podman_binary (Debian family)
|
|
ansible.builtin.set_fact:
|
|
podman_binary: /usr/bin/podman
|
|
when: ansible_os_family == 'Debian'
|
|
|
|
- name: Set fact podman_binary (Red Hat family)
|
|
ansible.builtin.set_fact:
|
|
podman_binary: /usr/sbin/podman
|
|
when: ansible_os_family == 'RedHat'
|
|
|
|
- name: Create required folders
|
|
become: true
|
|
ansible.builtin.file:
|
|
path: "{{ llama_server_home }}/{{ item }}"
|
|
state: directory
|
|
owner: "{{ llama_server_user }}"
|
|
group: "{{ llama_server_group }}"
|
|
mode: "0750"
|
|
loop:
|
|
- models
|
|
- .cache
|
|
- .cache/llamacpp
|
|
|
|
- name: "Add SSH Authorized key"
|
|
become: true
|
|
ansible.posix.authorized_key:
|
|
user: "{{ llama_server_user }}"
|
|
key: "{{ llama_server_pubkey }}"
|
|
state: "{{ 'present' if llama_server_pubkey is defined and llama_server_pubkey != '' else 'absent' }}"
|
|
when: llama_server_pubkey is defined and llama_server_pubkey != ""
|
|
|
|
- name: SELinux tasks (RedHat only)
|
|
when: ansible_os_family == 'RedHat'
|
|
become: true
|
|
block:
|
|
- name: Persistently set SELinux context
|
|
community.general.sefcontext:
|
|
target: "{{ llama_server_home }}(/.*)?"
|
|
setype: user_home_dir_t
|
|
state: present
|
|
|
|
- name: Persistently set SELinux context (ssh authorized keys)
|
|
community.general.sefcontext:
|
|
target: "{{ llama_server_home }}/.ssh/authorized_keys"
|
|
setype: ssh_home_t
|
|
state: present
|
|
when: llama_server_pubkey is defined and llama_server_pubkey != ""
|
|
|
|
- name: Apply SELinux context
|
|
ansible.builtin.command: restorecon -Rv {{ llama_server_home }}
|
|
changed_when: false
|
|
|
|
- name: Enable sudo access to llama user (temporary)
|
|
become: true
|
|
ansible.builtin.lineinfile:
|
|
path: "/etc/sudoers.d/ansible_{{ llama_server_user }}_tmp"
|
|
create: true
|
|
mode: "0440"
|
|
line: "{{ ansible_facts['user_id'] }} ALL=({{ llama_server_user }}) NOPASSWD: ALL"
|
|
validate: "visudo -cf %s"
|
|
|
|
- name: Enable lingering for llama user
|
|
become: true
|
|
ansible.builtin.command: loginctl enable-linger {{ llama_server_user }}
|
|
register: linger_status
|
|
changed_when: >-
|
|
'created' in linger_status.stdout or
|
|
(linger_status.rc == 0 and not
|
|
('linger file already exists' in linger_status.stderr or
|
|
'linger file does not exist' in linger_status.stderr))
|
|
failed_when:
|
|
- linger_status.rc != 0 and not
|
|
('linger file already exists' in linger_status.stderr)
|
|
|
|
- name: Get current user's UID
|
|
ansible.builtin.command: id -u {{ llama_server_user }}
|
|
changed_when: false
|
|
register: uid
|
|
|
|
- name: Get current user's GID
|
|
ansible.builtin.command: id -g {{ llama_server_user }}
|
|
changed_when: false
|
|
register: gid
|
|
|
|
- name: Run tasks as podman user
|
|
become: true
|
|
become_user: "{{ llama_server_user }}"
|
|
block:
|
|
- name: Pull the requested images
|
|
containers.podman.podman_image:
|
|
name: "{{ llama_server_image }}"
|
|
tag: "{{ llama_server_tag }}"
|
|
state: present
|
|
|
|
- name: Create pods
|
|
containers.podman.podman_container:
|
|
name: "llamacpp"
|
|
image: "{{ llama_server_image }}:{{ llama_server_tag }}"
|
|
state: started
|
|
device: "{{ llama_server_devices | default(omit) }}"
|
|
env: "{{ llama_server_env | default(omit) }}"
|
|
ports: "{{ llama_server_bind }}:{{ llama_server_port }}:8080/tcp"
|
|
volumes:
|
|
- "{{ llama_server_home }}/models:/models:Z"
|
|
- "{{ llama_server_home }}/.cache:/app/.cache:Z"
|
|
command: >-
|
|
{{
|
|
[
|
|
'--metrics',
|
|
'--models-preset',
|
|
'/models/.router/models.ini',
|
|
'--models-max',
|
|
(llama_server_models_max | string)
|
|
]
|
|
+ (llama_server_argv_extra | default([]))
|
|
}}
|
|
|
|
cmd_args:
|
|
- "--userns=keep-id"
|
|
- "--security-opt=label=disable"
|
|
|
|
- name: Create systemd service file for pods
|
|
become: true
|
|
ansible.builtin.template:
|
|
src: podman.service.j2
|
|
dest: "/etc/systemd/system/podman-llamacpp.service"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
- name: Reload systemd daemon
|
|
become: true
|
|
ansible.builtin.systemd:
|
|
daemon_reload: true
|
|
|
|
- name: Enable containers at boot
|
|
become: true
|
|
ansible.builtin.systemd:
|
|
name: "podman-llamacpp"
|
|
enabled: true
|
|
state: "started"
|
|
|
|
- name: Install Python packages required for llama server model sync
|
|
become: true
|
|
ansible.builtin.package:
|
|
name: "{{ __llama_sync_system_packages__ }}"
|
|
state: present
|
|
vars:
|
|
__llama_sync_system_packages__: >-
|
|
{{
|
|
{
|
|
'Debian': ['python3-pip', 'python3-packaging', 'python3-venv'],
|
|
'RedHat': ['python3-pip', 'python3-packaging'],
|
|
'Archlinux': ['python-pip', 'python-packaging']
|
|
}[ansible_os_family]
|
|
}}
|
|
|
|
- name: Install Hugging Face hub client in llama server sync virtualenv
|
|
become: true
|
|
become_user: "{{ llama_server_user }}"
|
|
ansible.builtin.pip:
|
|
name:
|
|
- pip
|
|
- setuptools
|
|
- packaging
|
|
- huggingface_hub>=0.32.0
|
|
state: present
|
|
virtualenv: "{{ llama_server_home }}/.router/.venv"
|
|
virtualenv_command: "python3 -m venv"
|
|
|
|
- name: Create llama server router model directories
|
|
become: true
|
|
ansible.builtin.file:
|
|
path: "{{ item.path }}"
|
|
state: directory
|
|
owner: "{{ llama_server_user }}"
|
|
group: "{{ llama_server_group }}"
|
|
mode: "{{ item.mode }}"
|
|
loop:
|
|
- { path: "{{ llama_server_home }}/models", mode: "0750" }
|
|
- { path: "{{ llama_server_home }}/models/managed", mode: "0750" }
|
|
- { path: "{{ llama_server_home }}/models/managed-links", mode: "0750" }
|
|
- { path: "{{ llama_server_home }}/models/.router", mode: "0750" }
|
|
|
|
- name: Copy llama server Hugging Face sync helper
|
|
become: true
|
|
ansible.builtin.copy:
|
|
src: scripts/linux/llama_hf_sync.py
|
|
dest: "{{ llama_server_home }}/models/.router/llama_hf_sync.py"
|
|
owner: "{{ llama_server_user }}"
|
|
group: "{{ llama_server_group }}"
|
|
mode: "0750"
|
|
|
|
- name: Write desired llama server model manifest input
|
|
become: true
|
|
ansible.builtin.copy:
|
|
content: "{{ llama_server_models | to_nice_json }}"
|
|
dest: "{{ llama_server_home }}/models/.router/desired-models.json"
|
|
owner: "{{ llama_server_user }}"
|
|
group: "{{ llama_server_group }}"
|
|
mode: "0640"
|
|
|
|
- name: Write global llama server preset options
|
|
become: true
|
|
ansible.builtin.copy:
|
|
content: "{{ llama_server_preset_global | to_nice_json }}"
|
|
dest: "{{ llama_server_home }}/models/.router/preset-global.json"
|
|
owner: "{{ llama_server_user }}"
|
|
group: "{{ llama_server_group }}"
|
|
mode: "0640"
|
|
|
|
- name: Set arguments for llama server model sync
|
|
ansible.builtin.set_fact:
|
|
__llama_preset_file__:
|
|
- "{{ llama_server_home }}/.router/.venv/bin/python"
|
|
- "{{ llama_server_home }}/models/.router/llama_hf_sync.py"
|
|
- "--models-file"
|
|
- "{{ llama_server_home }}/models/.router/desired-models.json"
|
|
- "--managed-dir"
|
|
- "{{ llama_server_home }}/models/managed"
|
|
- "--links-dir"
|
|
- "{{ llama_server_home }}/models/managed-links"
|
|
- "--manifest-file"
|
|
- "{{ llama_server_home }}/models/.router/manifest.json"
|
|
- "--preset-file"
|
|
- "{{ llama_server_home }}/models/.router/models.ini"
|
|
- "--preset-global-file"
|
|
- "{{ llama_server_home }}/models/.router/preset-global.json"
|
|
- "--container-links-dir"
|
|
- "/models/managed-links"
|
|
|
|
- name: Run llama server model sync from Hugging Face
|
|
vars:
|
|
__llama_sync_argv__: >-
|
|
{{ __llama_preset_file__
|
|
+ (['--prune'] if llama_server_models_prune_enabled | default(true) else [])
|
|
+ (['--dry-run'] if llama_server_models_dry_run | default(false) else [])
|
|
}}
|
|
become: true
|
|
become_user: "{{ llama_server_user }}"
|
|
ansible.builtin.command:
|
|
argv: "{{ __llama_sync_argv__ }}"
|
|
environment:
|
|
HF_TOKEN: "{{ lookup('env', 'HF_TOKEN') | default('', true) }}"
|
|
register: __llama_sync_output__
|
|
changed_when: false
|
|
|
|
- name: Parse llama server sync output
|
|
ansible.builtin.set_fact:
|
|
__llama_sync_result__: "{{ __llama_sync_output__.stdout | from_json }}"
|
|
|
|
- name: Stat llama router preset file (when not in dry-run mode)
|
|
become: true
|
|
become_user: "{{ llama_server_user }}"
|
|
ansible.builtin.stat:
|
|
path: "{{ llama_server_home }}/models/.router/models.ini"
|
|
register: __llama_preset_stat__
|
|
when: not (llama_server_models_dry_run | default(false))
|
|
|
|
- name: Ensure router preset file exists when not in dry-run mode
|
|
ansible.builtin.assert:
|
|
that:
|
|
- __llama_preset_stat__.stat.exists
|
|
fail_msg: "llama router preset file was not created"
|
|
when: not (llama_server_models_dry_run | default(false))
|
|
|
|
- name: Query llama router model list
|
|
ansible.builtin.uri:
|
|
url: "http://127.0.0.1:{{ llama_server_port | default(11434) }}/models?reload=1"
|
|
method: GET
|
|
status_code: 200
|
|
register: __llama_router_models__
|
|
changed_when: false
|
|
when:
|
|
- llama_server_models_sync_enabled | default(true)
|
|
- not (llama_server_models_dry_run | default(false))
|
|
|
|
- name: Validate expected model aliases are available in router
|
|
ansible.builtin.assert:
|
|
that:
|
|
- item.name in (__llama_router_models__.json.data | map(attribute='id') | list)
|
|
fail_msg: "Model name '{{ item.name }}' not present in llama router /models output"
|
|
loop: "{{ __llama_sync_result__.models | default([]) }}"
|
|
loop_control:
|
|
label: "{{ item.name }}"
|
|
when:
|
|
- llama_server_models_sync_enabled | default(true)
|
|
- not (llama_server_models_dry_run | default(false))
|
|
|
|
- name: Include Llama Exporter setup
|
|
when: llama_server_exporter_enabled | default(true) | bool
|
|
ansible.builtin.include_tasks: llama_exporter.yml
|
|
tags:
|
|
- roles::llama_server::llama_exporter
|
|
|
|
- name: Remove temporary sudo access
|
|
become: true
|
|
ansible.builtin.file:
|
|
path: "/etc/sudoers.d/ansible_{{ llama_server_user }}_tmp"
|
|
state: absent
|