Initial commit: arr-stack homelab + local AI

Docker Compose media stack (gluetun, *arr, Jellyfin), Ternary-Bonsai AI
(Open WebUI, Forgejo, optional OpenHands), and Ansible bootstrap for the
SER5 Ubuntu host.

ansible/group_vars/all.yml

@@ -0,0 +1,221 @@
+---
+# ---------------------------------------------------------------------------
+# Host layout
+# ---------------------------------------------------------------------------
+stack_root: /opt/stack
+storage_root: /storage
+stack_owner: tim
+stack_group: tim
+
+# Media tree lives on the 1TB disk
+data_dir: "{{ storage_root }}"
+config_dir: "{{ stack_root }}/config"
+models_dir: "{{ stack_root }}/models/bonsai"
+workspace_dir: "{{ stack_root }}/workspace"
+wireguard_dir: "{{ stack_root }}/wireguard"
+
+# LAN (SER5 is 192.168.8.123)
+lan_subnet: 192.168.8.0/24
+timezone: America/Los_Angeles
+
+# ---------------------------------------------------------------------------
+# Packages
+# ---------------------------------------------------------------------------
+# Always-on essentials (explicit — also listed in common_packages)
+essential_packages:
+  - curl
+  - wget
+  - nano
+  - build-essential
+  - net-tools
+
+# Microsoft Edit (https://github.com/microsoft/edit) — terminal editor
+ms_edit_version: "2.0.0"
+ms_edit_install: true
+
+common_packages:
+  # essentials
+  - curl
+  - wget
+  - nano
+  - build-essential
+  - net-tools
+  # system / packaging
+  - ca-certificates
+  - gnupg
+  - apt-transport-https
+  - software-properties-common
+  - git
+  - python3
+  - python3-pip
+  - python3-venv
+  - cmake
+  - ninja-build
+  - pkg-config
+  # editors / viewers
+  - vim
+  - less
+  # monitoring / disk
+  - htop
+  - btop
+  - iotop
+  - iftop
+  - ncdu
+  - duf
+  - sysstat
+  - smartmontools
+  - lm-sensors
+  - nvme-cli
+  # network
+  - iproute2
+  - dnsutils
+  - traceroute
+  - mtr-tiny
+  - nmap
+  - tcpdump
+  # utils
+  - tree
+  - jq
+  - ripgrep
+  - fd-find
+  - fzf
+  - tmux
+  - rsync
+  - unzip
+  - zip
+  - p7zip-full
+  - lsof
+  - strace
+  - pciutils
+  - usbutils
+  - plocate
+  - bat
+  - aria2
+  # security / updates
+  - fail2ban
+  - unattended-upgrades
+  - update-notifier-common
+
+# Start stack on boot (docker compose up -d); pairs with restart: unless-stopped
+stack_systemd_enable: true
+stack_compose_profiles: []   # e.g. ["coding"] to also start openhands
+
+# AMD / Vulkan / media accel (Radeon 680M on SER5 PRO)
+# Note: Ubuntu 24.04 uses mesa-va-drivers (not the older libva-mesa-driver name).
+# Many of these live in the "universe" component — role enables it first.
+amd_vulkan_packages:
+  - linux-firmware
+  - mesa-vulkan-drivers
+  - mesa-utils
+  - libvulkan1
+  - vulkan-tools
+  - libgl1-mesa-dri
+  - libegl1
+  - libgles2
+  - vainfo
+  - libva2
+  - libva-drm2
+  - mesa-va-drivers
+  - mesa-vdpau-drivers
+  - clinfo
+
+# Groups for operator account (tim) — local trusted host, convenience over lockdown
+extra_user_groups:
+  - sudo
+  - docker
+  - video
+  - render
+  - adm
+  - disk
+  - plugdev
+  - dialout
+  - cdrom
+  - users
+  - systemd-journal
+  # present on many Ubuntu images; harmless if already primary
+  - tim
+
+# Passwordless full sudo for stack_owner (local monitored network)
+stack_passwordless_sudo: true
+
+# ---------------------------------------------------------------------------
+# Docker
+# ---------------------------------------------------------------------------
+docker_packages:
+  - docker-ce
+  - docker-ce-cli
+  - containerd.io
+  - docker-buildx-plugin
+  - docker-compose-plugin
+
+docker_daemon_json:
+  log-driver: json-file
+  log-opts:
+    max-size: "50m"
+    max-file: "5"
+  # Leave room for media + inference
+  default-address-pools:
+    - base: 172.30.0.0/16
+      size: 24
+  # Enable cgroup device access patterns used by /dev/dri
+  features:
+    buildkit: true
+
+# ---------------------------------------------------------------------------
+# Firewall (UFW) — default deny in, allow out; open stack ports to LAN only
+# ---------------------------------------------------------------------------
+ufw_enabled: true
+ufw_default_incoming: deny
+ufw_default_outgoing: allow
+
+# SSH from anywhere on LAN (and optionally world — keep LAN-only by default)
+ufw_allow_ssh_from_anywhere: false
+
+ufw_lan_tcp_ports:
+  - { port: 22, comment: "SSH" }
+  - { port: 8080, comment: "qBittorrent" }
+  - { port: 8096, comment: "Jellyfin" }
+  - { port: 8989, comment: "Sonarr" }
+  - { port: 7878, comment: "Radarr" }
+  - { port: 9696, comment: "Prowlarr" }
+  - { port: 6767, comment: "Bazarr" }
+  - { port: 8686, comment: "Lidarr" }
+  - { port: 3000, comment: "Open WebUI" }
+  - { port: 8081, comment: "Bonsai llama-server" }
+  - { port: 3001, comment: "OpenHands (optional)" }
+  - { port: 3002, comment: "Forgejo HTTP" }
+  - { port: 2222, comment: "Forgejo Git SSH" }
+
+# Forgejo (self-hosted Git)
+forgejo_domain: "192.168.8.123"
+forgejo_http_port: 3002
+forgejo_ssh_port: 2222
+forgejo_root_url: "http://{{ forgejo_domain }}:{{ forgejo_http_port }}/"
+
+# ---------------------------------------------------------------------------
+# Stack deployment
+# ---------------------------------------------------------------------------
+# Sync this repo (parent of ansible/) to stack_root on the server.
+# Set false if you manage /opt/stack yourself (git clone, etc.).
+deploy_stack_files: true
+
+# Paths on the control machine (the machine running ansible-playbook)
+# Default: the arr-stack repo that contains this ansible/ directory
+stack_src: "{{ playbook_dir | dirname }}"
+
+# AI defaults for SER5 + Vulkan
+bonsai_backend: vulkan
+bonsai_ngl: "99"
+bonsai_ctx: "16384"
+bonsai_threads: "12"
+bonsai_kv4: "0"
+open_webui_auth: "true"
+
+# Media subdirs under storage_root
+media_subdirs:
+  - media/movies
+  - media/tv
+  - media/music
+  - torrents/movies
+  - torrents/tv
+  - torrents/music