alexandre.pires
b692627317
- Create host variable file for vh-01.alexpires.dev with user, SSH, firewall, and VM configurations. - Update playbook_duo_security.yml to target the 2fa group. - Introduce playbook_virt_host.yml for setting up GPU passthrough on Fedora with QEMU/KVM. - Add required collections to requirements.yml for Podman and Libvirt. - Modify ctrlaltdel.yml to remove existing symlink for ctrl-alt-del.target before masking it. - Enhance users.yml to show warnings for users that could not be removed. - Update Duo Security role to use the correct repository and package names. - Improve login role to handle user UID and group assignments. - Create udev rules template for NVMe devices. - Add blacklist template for VFIO drivers. - Implement domain XML template for virtual machines with detailed configurations. - Update inventory to include vh-01.alexpires.dev in relevant groups. - Refactor cpu_power_monitor.py for improved error handling and modularity.
190 lines
5.1 KiB
YAML
190 lines
5.1 KiB
YAML
hostname: vh-01.alexpires.local
|
|
ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}"
|
|
|
|
# Users
|
|
login_users:
|
|
- username: "{{ ansible_user }}"
|
|
comment: "Managed by Ansible"
|
|
sudoer: true
|
|
sudoer_root_only: true
|
|
sudoer_no_password: true
|
|
pubkey: "{{ lookup('file', 'keys/ansible_user.pub') }}"
|
|
password_disabled: true
|
|
- username: operator
|
|
comment: "Managed by Ansible"
|
|
sudoer: true
|
|
pubkey: "{{ lookup('file', 'keys/operator.pub') }}"
|
|
shell: "/bin/zsh"
|
|
password_expiration: false
|
|
|
|
# SSH Connection and security
|
|
sshd_port: 22
|
|
ssh_allowed_networks:
|
|
- "0.0.0.0/0"
|
|
sshd_admin_net: "0.0.0.0/0"
|
|
sshd_allow_groups: "{{ ansible_user }} users"
|
|
sshd_permit_root_login: "no"
|
|
sshd_password_authentication: "no"
|
|
sshd_allow_tcp_forwarding: "yes"
|
|
|
|
# Due to an issue increase the number of max auth tries
|
|
sshd_max_auth_tries: 10
|
|
|
|
# Firewall ports
|
|
ufw_enable: true
|
|
fw_allowed_ports:
|
|
- { rule: "allow", port: "22", proto: "tcp" }
|
|
- { rule: "allow", port: "9090", proto: "tcp" }
|
|
|
|
ufw_outgoing_traffic:
|
|
- 22 # SSH
|
|
- 53 # DNS
|
|
- 80 # HTTP
|
|
- 123 # NTP
|
|
- 443 # HTTPS
|
|
- 853 # DNS over TLS
|
|
|
|
ufw_default_forward_policy: "ACCEPT"
|
|
|
|
ipv4_sysctl_settings:
|
|
net.ipv4.ip_forward: 1
|
|
|
|
disable_ipv6: true
|
|
|
|
# geoip will override hosts_allow and hosts_deny (so it's disabled - CIS hardening)
|
|
custom_hosts_acls: true
|
|
|
|
# This fixes polkit issues with sudoers file (CIS hardening)
|
|
hide_pid: 0
|
|
|
|
# aide
|
|
install_aide: false
|
|
|
|
# Unattended upgrades
|
|
unattended_reboot: true
|
|
unattended_reboot_time: "04:30"
|
|
|
|
# Duo Security
|
|
duo_users: ["*", "!provision"]
|
|
duo_api_hostname: api-7cda1654.duosecurity.com
|
|
|
|
# VMs reserved CPU (for gaming and AI)
|
|
virt_vm_reserved_cpu: "1-5,7-11"
|
|
virt_raw_block_devices:
|
|
- "nvme0n1"
|
|
- "nvme0n1p1"
|
|
- "nvme0n1p2"
|
|
|
|
virt_extra_grub_args: >
|
|
i915.modeset=1 i915.enable_gvt=1 i915.enable_fbc=0
|
|
initcall_blacklist=simpledrm_platform_driver_init
|
|
rd.driver.blacklist=nouveau modprobe.blacklist=nouveau
|
|
|
|
virt_vfio_ids:
|
|
- 10de:2482 # NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
|
|
- 10de:228b # NVIDIA Corporation GA106 High Definition Audio Controller
|
|
- 10de:2504 # NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate]
|
|
- 10de:228e # NVIDIA Corporation GA106 High Definition Audio Controller
|
|
- 1b73:1100 # Fresco Logic FL1100 USB 3.0 Host Controller
|
|
|
|
virt_blacklist:
|
|
- noveau
|
|
- snd_hda_codec_hdmi
|
|
- i2c_nvidia_gpu
|
|
- mxm_wmi
|
|
|
|
virt_machines:
|
|
- name: windows-11
|
|
title: "Microsoft Windows 11"
|
|
uuid: "51d5d091-67cb-4113-bd8e-817e7317e1b4"
|
|
autostart: true
|
|
memory: 25165824
|
|
cores: 4
|
|
threads: 2
|
|
physical_cpus: "2-8,3-9,4-10,5-11"
|
|
reserved_cpus: "0,6"
|
|
enable_hyperv: true
|
|
cdrom: true
|
|
console: false
|
|
audio: true
|
|
secure_boot: true
|
|
tpm: true
|
|
tablet: true
|
|
disk_file: "windows-11.qcow2"
|
|
mac_address: "52:54:00:cd:dd:2d"
|
|
block_devs:
|
|
- block_dev: "/dev/nvme0n1"
|
|
target_dev: "sdb"
|
|
host_devs:
|
|
# Intel MDev device for GVT-g
|
|
- type: "mdev"
|
|
source:
|
|
uuid: "5abeb24f-d6f4-4666-b495-303f15b05723"
|
|
address: { type: 'pci', domain: '0x0000', bus: '0x07', slot: '0x00', function: '0x0' }
|
|
# Fresco Logic FL1100 USB 3.0 Host Controller
|
|
- type: "pci"
|
|
source:
|
|
address:
|
|
domain: "0x0000"
|
|
bus: "0x06"
|
|
slot: "0x00"
|
|
function: "0x0"
|
|
address: { type: 'pci', domain: '0x0000', bus: '0x10', slot: '0x00', function: '0x0' }
|
|
# NVIDIA Corporation GA104 [GeForce RTX 3070 Ti]
|
|
- type: "pci"
|
|
source:
|
|
address:
|
|
domain: "0x0000"
|
|
bus: "0x01"
|
|
slot: "0x00"
|
|
function: "0x0"
|
|
address: { type: 'pci', domain: '0x0000', bus: '0x0b', slot: '0x00', function: '0x0' }
|
|
# NVIDIA Corporation GA106 High Definition Audio Controller
|
|
- type: "pci"
|
|
source:
|
|
address:
|
|
domain: "0x0000"
|
|
bus: "0x01"
|
|
slot: "0x00"
|
|
function: "0x1"
|
|
address: { type: 'pci', domain: '0x0000', bus: '0x0f', slot: '0x00', function: '0x0' }
|
|
|
|
- name: fedora-headless
|
|
title: "Fedora CUDA headless"
|
|
uuid: "55feda16-51ae-446e-9c83-4c0eee1e5e00"
|
|
autostart: true
|
|
memory: 33554432
|
|
cores: 1
|
|
threads: 2
|
|
physical_cpus: "1-7"
|
|
reserved_cpus: "0,6"
|
|
cdrom: false
|
|
console: true
|
|
audio: false
|
|
secure_boot: false
|
|
tpm: true
|
|
disk_file: "fedora-headless.qcow2"
|
|
mac_address: "52:54:00:ae:f3:d0"
|
|
block_devs:
|
|
- block_dev: "/dev/nvme0n1"
|
|
target_dev: "sdb"
|
|
host_devs:
|
|
# NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate]
|
|
- type: "pci"
|
|
source:
|
|
address:
|
|
domain: "0x0000"
|
|
bus: "0x03"
|
|
slot: "0x00"
|
|
function: "0x0"
|
|
address: { type: 'pci',domain: '0x0000',bus: '0x09',slot: '0x00',function: '0x0' }
|
|
# NVIDIA Corporation GA106 High Definition Audio Controller
|
|
- type: "pci"
|
|
source:
|
|
address:
|
|
domain: "0x0000"
|
|
bus: "0x03"
|
|
slot: "0x00"
|
|
function: "0x1"
|
|
address: { type: 'pci',domain: '0x0000',bus: '0x0a',slot: '0x00',function: '0x0' }
|