alexandre.pires
e9e28a5ca8
- Created model files for Qwen3.5 with different context lengths. - Added a new Ansible host variable file for CI server configuration. - Updated GPU server host variables to include Ollama models and model files. - Enhanced playbooks for Podman to manage Ollama models, including copying model files and checking existing models. - Introduced a new playbook for setting up Qwen3.6 with specific configurations. - Updated Windows SSH tasks to improve security and configuration management. - Added a Python utility to parse Ollama model names from command output. - Modified Terraform configurations to include new DNS entries and proxy settings. - Improved Nginx proxy configurations with timeout settings.
142 lines
5.0 KiB
YAML
142 lines
5.0 KiB
YAML
hostname: gpu-01.lab.alexpires.me
|
|
ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}"
|
|
|
|
network_interface: enp7s0
|
|
|
|
# Users
|
|
login_users:
|
|
- username: "{{ ansible_user }}"
|
|
comment: "Managed by Ansible"
|
|
sudoer: true
|
|
sudoer_root_only: true
|
|
sudoer_no_password: true
|
|
pubkey: "{{ lookup('file', 'keys/ansible_user.pub') }}"
|
|
password_disabled: true
|
|
- username: operator
|
|
comment: "Managed by Ansible"
|
|
sudoer: true
|
|
pubkey: "{{ lookup('file', 'keys/operator.pub') }}"
|
|
password_expiration: false
|
|
|
|
# SSH Connection and security
|
|
sshd_port: 22
|
|
ssh_allowed_networks:
|
|
- "10.5.5.5/32" # Wireguard VPN (Laptop)
|
|
- "10.19.4.0/24" # local network
|
|
sshd_admin_net: "10.19.4.0/24" # local network
|
|
sshd_allow_groups: "{{ ansible_user }} users"
|
|
sshd_permit_root_login: "no"
|
|
sshd_password_authentication: "no"
|
|
sshd_allow_tcp_forwarding: "yes"
|
|
|
|
# Due to an issue increase the number of max auth tries
|
|
sshd_max_auth_tries: 10
|
|
|
|
packages_blocklist: []
|
|
|
|
# Firewall ports
|
|
ufw_enable: true
|
|
fw_allowed_ports:
|
|
- { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop)
|
|
- { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network
|
|
- { rule: "allow", port: "11434", proto: "tcp", from: "10.19.4.0/24" } # Ollama (local network)
|
|
- { rule: "allow", port: "11434", proto: "tcp", from: "10.5.5.5/32" } # Ollama (Laptop)
|
|
- { rule: "allow", port: "8880", proto: "tcp", from: "10.19.4.0/24" } # Kokoro-FastAPI (local network)
|
|
- { rule: "allow", port: "8880", proto: "tcp", from: "10.5.5.5/32" } # Kokoro-FastAPI (Laptop)
|
|
- { rule: "allow", port: "8188", proto: "tcp", from: "10.19.4.0/24" } # ComfyUI (local network)
|
|
- { rule: "allow", port: "8999", proto: "tcp", from: "10.19.4.0/24" } # ComfyUI - SimpleHttpServer (local network)
|
|
- { rule: "allow", port: "8012", proto: "tcp", from: "10.19.4.0/24" } # Qwen2 (local network)
|
|
- { rule: "allow", port: "8012", proto: "tcp", from: "10.5.5.5/32" } # Qwen2 (Laptop)
|
|
- { rule: "allow", port: "9090", proto: "tcp", from: "10.19.4.0/24" } # local network
|
|
ufw_outgoing_traffic:
|
|
- 22 # SSH
|
|
- 53 # DNS
|
|
- 80 # HTTP
|
|
- 123 # NTP
|
|
- 443 # HTTPS
|
|
- 853 # DNS over TLS
|
|
- 139 # Samba
|
|
- 445 # Samba
|
|
|
|
ufw_default_forward_policy: "ACCEPT"
|
|
fw_loopback_traffic_deny: false
|
|
|
|
ipv4_sysctl_settings:
|
|
net.ipv4.ip_forward: 1
|
|
|
|
disable_ipv6: true
|
|
|
|
# geoip will override hosts_allow and hosts_deny (so it's disabled - CIS hardening)
|
|
custom_hosts_acls: true
|
|
|
|
# This fixes polkit issues with sudoers file (CIS hardening)
|
|
hide_pid: 0
|
|
|
|
# CIS by default changes compilers permissions, Nvidia KMod needs to be build
|
|
compilers:
|
|
|
|
# aide
|
|
install_aide: false
|
|
|
|
# Unattended upgrades
|
|
unattended_reboot: true
|
|
unattended_reboot_time: "04:30"
|
|
|
|
# Duo Security
|
|
duo_users: ["*", "!provision", "!comfyui", "!kokoro", "!ollama"]
|
|
duo_api_hostname: api-7cda1654.duosecurity.com
|
|
|
|
# podman services settings
|
|
ollama_home: "/mnt/data/ollama"
|
|
llama_home: "/mnt/data/llamacpp"
|
|
podman_user_pubkey: "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAHHOPBR9p9kq5Cqzpe4cr3jHnweaYrHPXv5sXNzt+sCXP54uc5rWUBhxW2OQVvQzJ47dEVhEKi4WSC7LcuKS2G5AQDzWXNiasHvYIYQU3F/EknVCZnsiXYqXphYkJA6rJCNRnISZCIC1mocq6PB7J08ONdRFCvjfUBuVRT8BNGXNmQ/zQ=="
|
|
|
|
# ComfyUI settings
|
|
comfyui_home: "/mnt/data/comfyui"
|
|
comfyui_user_pubkey: "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAHHOPBR9p9kq5Cqzpe4cr3jHnweaYrHPXv5sXNzt+sCXP54uc5rWUBhxW2OQVvQzJ47dEVhEKi4WSC7LcuKS2G5AQDzWXNiasHvYIYQU3F/EknVCZnsiXYqXphYkJA6rJCNRnISZCIC1mocq6PB7J08ONdRFCvjfUBuVRT8BNGXNmQ/zQ=="
|
|
|
|
# Kokoro FastAPI settings (we don't set home because it is not expected to use a lot a disk space)
|
|
kokoro_user_pubkey: "ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAHHOPBR9p9kq5Cqzpe4cr3jHnweaYrHPXv5sXNzt+sCXP54uc5rWUBhxW2OQVvQzJ47dEVhEKi4WSC7LcuKS2G5AQDzWXNiasHvYIYQU3F/EknVCZnsiXYqXphYkJA6rJCNRnISZCIC1mocq6PB7J08ONdRFCvjfUBuVRT8BNGXNmQ/zQ=="
|
|
|
|
# Let's Encrypt / Certbot
|
|
cloudns_auth_id: "{{ lookup('env', 'CLOUDNS_AUTH_ID') }}"
|
|
cloudns_auth_password: "{{ lookup('env', 'CLOUDNS_PASSWORD') }}"
|
|
cloudns_nameserver: "109.201.133.111"
|
|
certbot_email: c.alexandre.pires@alexpires.me
|
|
certbot_domains:
|
|
- "gpu-01.lab.alexpires.me"
|
|
|
|
certbot_cockpit_domain: "gpu-01.lab.alexpires.me"
|
|
ollama_models:
|
|
# Thinking models
|
|
- gpt-oss:latest
|
|
- gemma4:e4b
|
|
- qwen3.5:9b
|
|
- qwen3.5:4b
|
|
# Non-thinking models
|
|
- ministral-3:3b
|
|
- ministral-3:8b
|
|
- ministral-3:14b
|
|
- granite4.1:3b
|
|
- granite4.1:8b
|
|
- deepseek-r1:latest
|
|
- qwen2.5-coder:3b
|
|
# Embedding models
|
|
- embeddinggemma:latest
|
|
- nomic-embed-text:latest
|
|
# Whisper models
|
|
- dimavz/whisper-tiny:latest
|
|
ollama_model_files:
|
|
- file: "ollama/gpt-oss-latest-32k.modelfile"
|
|
name: "gpt-oss-32k:latest"
|
|
- file: "ollama/gemma4-e4b-32k.modelfile"
|
|
name: "gemma4-e4b-32k:latest"
|
|
- file: "ollama/qwen3.5-9b-32k.modelfile"
|
|
name: "qwen3.5-9b-32k:latest"
|
|
- file: "ollama/qwen3.5-9b-64k.modelfile"
|
|
name: "qwen3.5-9b-64k:latest"
|
|
- file: "ollama/qwen3.5-4b-32k.modelfile"
|
|
name: "qwen3.5-4b-32k:latest"
|
|
- file: "ollama/qwen3.5-4b-64k.modelfile"
|
|
name: "qwen3.5-4b-64k:latest"
|