Initial commit: arr-stack homelab + local AI
Docker Compose media stack (gluetun, *arr, Jellyfin), Ternary-Bonsai AI (Open WebUI, Forgejo, optional OpenHands), and Ansible bootstrap for the SER5 Ubuntu host.
This commit is contained in:
tim
commit
3645d1314c
33 changed files with 2673 additions and 0 deletions
74
.env.example
Normal file
74
.env.example
Normal file
|
|
@ -0,0 +1,74 @@
|
||||||
|
# Copy to .env and adjust. The compose file reads these values.
|
||||||
|
|
||||||
|
# --- user / group that owns your media (run `id` on the host) ---
|
||||||
|
PUID=1000
|
||||||
|
PGID=1000
|
||||||
|
|
||||||
|
# --- your timezone (https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) ---
|
||||||
|
TZ=Europe/Berlin
|
||||||
|
|
||||||
|
# --- host paths (relative to this folder is fine) ---
|
||||||
|
CONFIG_DIR=./config
|
||||||
|
DATA_DIR=./data
|
||||||
|
|
||||||
|
# --- your LAN subnet, so the qBittorrent WebUI stays reachable through
|
||||||
|
# gluetun's firewall. If your machine is 192.168.1.50, use 192.168.1.0/24
|
||||||
|
LAN_SUBNET=192.168.1.0/24
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# Local AI (Ternary-Bonsai-27B on SER5 PRO / Ryzen 7735HS)
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
# GGUF weights directory (populated by scripts/download-bonsai-model.sh)
|
||||||
|
BONSAI_MODELS_DIR=./models/bonsai
|
||||||
|
BONSAI_MODEL_PATH=/models/Ternary-Bonsai-27B-Q2_0.gguf
|
||||||
|
|
||||||
|
# cpu (default) or vulkan — rebuild image after changing:
|
||||||
|
# BONSAI_BACKEND=vulkan docker compose build --no-cache bonsai
|
||||||
|
BONSAI_BACKEND=cpu
|
||||||
|
|
||||||
|
# GPU layers: 0 = CPU only. With vulkan image + /dev/dri, try 99.
|
||||||
|
BONSAI_NGL=0
|
||||||
|
|
||||||
|
# Context size. 16384 is a solid default on 32–64 GB RAM with the Arr stack.
|
||||||
|
# Raise for long docs / repo work; set BONSAI_KV4=1 if you run OOM.
|
||||||
|
BONSAI_CTX=16384
|
||||||
|
BONSAI_KV4=0
|
||||||
|
|
||||||
|
# Leave 0 for auto threads, or e.g. 12 on 16-thread 7735HS to leave headroom
|
||||||
|
BONSAI_THREADS=0
|
||||||
|
|
||||||
|
# Sampling (Prism 27B thinking-mode defaults)
|
||||||
|
BONSAI_TEMP=0.7
|
||||||
|
BONSAI_TOP_P=0.95
|
||||||
|
BONSAI_TOP_K=20
|
||||||
|
|
||||||
|
# Host port for llama-server API (OpenAI-compatible at /v1)
|
||||||
|
BONSAI_PORT=8081
|
||||||
|
|
||||||
|
# Open WebUI
|
||||||
|
OPEN_WEBUI_PORT=3000
|
||||||
|
OPENAI_API_KEY=sk-local-bonsai
|
||||||
|
# true = login required (recommended); false = open LAN access
|
||||||
|
WEBUI_AUTH=true
|
||||||
|
|
||||||
|
# Folder mounted read-only into Open WebUI as /workspace (RAG + file Q&A)
|
||||||
|
# Point this at your git projects, notes, docs, etc.
|
||||||
|
AI_WORKSPACE_DIR=./workspace
|
||||||
|
|
||||||
|
# SearXNG (web search for RAG) — published on localhost only
|
||||||
|
SEARXNG_PORT=8888
|
||||||
|
SEARXNG_SECRET=change-me-to-a-long-random-string
|
||||||
|
|
||||||
|
# OpenHands coding agent (docker compose --profile coding up -d)
|
||||||
|
OPENHANDS_PORT=3001
|
||||||
|
# LiteLLM-style id; after first start check http://host:8081/v1/models
|
||||||
|
OPENHANDS_MODEL=openai/local
|
||||||
|
|
||||||
|
# Forgejo — self-hosted Git (web + SSH clone)
|
||||||
|
FORGEJO_HTTP_PORT=3002
|
||||||
|
FORGEJO_SSH_PORT=2222
|
||||||
|
FORGEJO_DOMAIN=192.168.8.123
|
||||||
|
FORGEJO_ROOT_URL=http://192.168.8.123:3002/
|
||||||
|
# true after you create the admin account (blocks random signups)
|
||||||
|
FORGEJO_DISABLE_REGISTRATION=false
|
||||||
18
.gitignore
vendored
Normal file
18
.gitignore
vendored
Normal file
|
|
@ -0,0 +1,18 @@
|
||||||
|
|
||||||
|
ansible/*.retry
|
||||||
|
ansible/.secrets/
|
||||||
|
config/
|
||||||
|
config/wg0.conf
|
||||||
|
data/
|
||||||
|
.env
|
||||||
|
.env.*
|
||||||
|
!.env.example
|
||||||
|
*.gguf
|
||||||
|
models/bonsai/*.gguf
|
||||||
|
models/bonsai/*.partial
|
||||||
|
.openhands-state/
|
||||||
|
# secrets / local runtime
|
||||||
|
**/wg0.conf
|
||||||
|
wireguard/wg0.conf
|
||||||
|
workspace/*
|
||||||
|
!workspace/README.md
|
||||||
323
README.md
Normal file
323
README.md
Normal file
|
|
@ -0,0 +1,323 @@
|
||||||
|
# Arr Stack + Local AI
|
||||||
|
|
||||||
|
A dockerized media automation stack (VPN-locked torrents + Jellyfin) **plus** a
|
||||||
|
local AI stack built around
|
||||||
|
[Ternary-Bonsai-27B](https://huggingface.co/prism-ml/Ternary-Bonsai-27B-gguf)
|
||||||
|
for the **Beelink SER5 PRO** (Ryzen 7 7735HS + Radeon 680M).
|
||||||
|
|
||||||
|
## Services
|
||||||
|
|
||||||
|
| Service | URL | Purpose |
|
||||||
|
|-------------|------------------------|--------------------------------------|
|
||||||
|
| Jellyfin | http://host:8096 | Media server / playback |
|
||||||
|
| qBittorrent | http://host:8080 | Torrent client (VPN-only) |
|
||||||
|
| Prowlarr | http://host:9696 | Indexer manager |
|
||||||
|
| Sonarr | http://host:8989 | TV shows |
|
||||||
|
| Radarr | http://host:7878 | Movies |
|
||||||
|
| Bazarr | http://host:6767 | Subtitles |
|
||||||
|
| Lidarr | http://host:8686 | Music |
|
||||||
|
| **Forgejo** | http://host:3002 | Self-hosted Git (SSH :2222) |
|
||||||
|
| **Open WebUI** | http://host:3000 | Chat UI, RAG, tools, code interpreter |
|
||||||
|
| **Bonsai API** | http://host:8081/v1 | OpenAI-compatible llama-server |
|
||||||
|
| SearXNG | http://127.0.0.1:8888 | Private web search (for RAG) |
|
||||||
|
| OpenHands | http://host:3001 | Coding agent (`--profile coding`) |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Media stack
|
||||||
|
|
||||||
|
### 1. Prepare
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd arr-stack
|
||||||
|
cp .env.example .env # then edit .env (PUID/PGID, TZ, LAN_SUBNET)
|
||||||
|
```
|
||||||
|
|
||||||
|
Drop your provider's WireGuard config into `wireguard/wg0.conf` and make the
|
||||||
|
two edits described in `wireguard/wg0.conf.example`:
|
||||||
|
|
||||||
|
1. **Remove IPv6 addresses** from `Address` / `DNS` lines.
|
||||||
|
2. **Endpoint must be an IP**, not a hostname (`dig +short your.endpoint.host`).
|
||||||
|
|
||||||
|
Create the data tree (already scaffolded here; on a fresh host run):
|
||||||
|
|
||||||
|
```bash
|
||||||
|
mkdir -p config data/media/{movies,tv,music} data/torrents/{movies,tv,music}
|
||||||
|
```
|
||||||
|
|
||||||
|
The layout uses a **single `/data` share** — this lets the Arrs hardlink
|
||||||
|
finished downloads into the media library instantly (no copy, no double disk
|
||||||
|
usage, torrent keeps seeding):
|
||||||
|
|
||||||
|
```
|
||||||
|
data/
|
||||||
|
├── media/ <- Jellyfin libraries
|
||||||
|
│ ├── movies/
|
||||||
|
│ ├── tv/
|
||||||
|
│ └── music/
|
||||||
|
└── torrents/ <- qBittorrent downloads here
|
||||||
|
├── movies/
|
||||||
|
├── tv/
|
||||||
|
└── music/
|
||||||
|
```
|
||||||
|
|
||||||
|
### 2. Start media
|
||||||
|
|
||||||
|
```bash
|
||||||
|
docker compose up -d
|
||||||
|
docker compose ps # gluetun must show (healthy)
|
||||||
|
docker logs -f gluetun # wait for "You are running on the VPN" style line
|
||||||
|
```
|
||||||
|
|
||||||
|
qBittorrent waits for gluetun to be healthy before starting.
|
||||||
|
|
||||||
|
### 3. Verify the lockdown (do this once)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# IP seen from inside qBittorrent — must be your VPN's IP, NOT your home IP:
|
||||||
|
docker exec qbittorrent curl -s ifconfig.me && echo
|
||||||
|
|
||||||
|
# Your real IP for comparison:
|
||||||
|
curl -s ifconfig.me && echo
|
||||||
|
|
||||||
|
# Killswitch test — kill the tunnel, traffic must die with it:
|
||||||
|
docker exec gluetun sh -c "ip link del tun0" 2>/dev/null
|
||||||
|
docker exec qbittorrent curl -s --max-time 8 ifconfig.me || echo "NO CONNECTIVITY (good)"
|
||||||
|
docker restart gluetun # bring the tunnel back
|
||||||
|
```
|
||||||
|
|
||||||
|
Belt-and-suspenders extra: in qBittorrent → Tools → Options → Advanced, set
|
||||||
|
**Network interface** to `tun0`. Even in a hypothetical gluetun failure,
|
||||||
|
qBittorrent itself would then refuse to use any other interface.
|
||||||
|
|
||||||
|
### 4. Wire it together
|
||||||
|
|
||||||
|
**qBittorrent** (http://host:8080 — default user `admin`, temporary password
|
||||||
|
is printed in `docker logs qbittorrent` on first start; change it):
|
||||||
|
|
||||||
|
- Options → Downloads → Default Save Path: `/data/torrents`
|
||||||
|
- Create categories `movies` → `/data/torrents/movies` and `tv` → `/data/torrents/tv`
|
||||||
|
|
||||||
|
**Prowlarr** (http://host:9696):
|
||||||
|
|
||||||
|
- Add your indexers under *Indexers*.
|
||||||
|
- *Settings → Apps*: add Sonarr (`http://sonarr:8989`), Radarr
|
||||||
|
(`http://radarr:7878`), each with its API key (found in the Arr under
|
||||||
|
*Settings → General*). Indexers sync automatically from then on.
|
||||||
|
|
||||||
|
**Sonarr & Radarr** — *Settings → Download Clients* → add qBittorrent:
|
||||||
|
|
||||||
|
- Host: `gluetun`, Port: `8080`, your qBittorrent credentials
|
||||||
|
- Category: `tv` (Sonarr) / `movies` (Radarr)
|
||||||
|
- *Settings → Media Management*: root folder `/data/media/tv` or
|
||||||
|
`/data/media/movies`; **enable hardlinks** (on by default with this layout)
|
||||||
|
|
||||||
|
**Bazarr**: point it at Sonarr/Radarr (`http://sonarr:8989` /
|
||||||
|
`http://radarr:7878` + API keys); paths `/data/media/tv`, `/data/media/movies`.
|
||||||
|
|
||||||
|
**Lidarr** (http://host:8686) — music, same patterns as Sonarr/Radarr:
|
||||||
|
|
||||||
|
- *Settings → Download Clients* → qBittorrent: Host `gluetun`, Port `8080`
|
||||||
|
- Category: `music` → qBittorrent save path `/data/torrents/music`
|
||||||
|
- *Settings → Media Management*: root folder `/data/media/music`; hardlinks on
|
||||||
|
- In **Prowlarr** → *Settings → Apps*: add Lidarr (`http://lidarr:8686` + API key)
|
||||||
|
|
||||||
|
**Jellyfin** (http://host:8096): add libraries → Movies: `/data/media/movies`,
|
||||||
|
Shows: `/data/media/tv`, Music: `/data/media/music`. Its media mount is
|
||||||
|
read-only; enable trickplay/metadata into `/config` (the default) — it never
|
||||||
|
writes to your media.
|
||||||
|
|
||||||
|
### 5. Optional: provider port forwarding
|
||||||
|
|
||||||
|
If your VPN provider gives you a forwarded port (AirVPN, ProtonVPN, …),
|
||||||
|
inbound peers can reach you and swarm connectivity improves:
|
||||||
|
|
||||||
|
1. Uncomment `FIREWALL_VPN_INPUT_PORTS` in the compose file and set the port.
|
||||||
|
2. For providers with a NAT-PMP API also uncomment `VPN_PORT_FORWARDING` and
|
||||||
|
`VPN_PORT_FORWARDING_PROVIDER`.
|
||||||
|
3. Set the same port as qBittorrent's listening port (Options → Connection)
|
||||||
|
and disable UPnP/NAT-PMP inside qBittorrent.
|
||||||
|
|
||||||
|
Never publish qBittorrent's BitTorrent port on the host — inbound connections
|
||||||
|
must arrive through the tunnel only.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Local AI stack
|
||||||
|
|
||||||
|
### Why this design (and not plain Ollama)
|
||||||
|
|
||||||
|
| Piece | Choice | Reason |
|
||||||
|
|-------|--------|--------|
|
||||||
|
| Model | **Ternary-Bonsai-27B** (~7.2 GB Q2_0) | ~95% of FP16 quality at laptop footprint; strong coding/math |
|
||||||
|
| Runtime | **PrismML llama.cpp** (`llama-server`) | Custom Q2_0 g128 kernels — stock Ollama / mainline won't load the default GGUF |
|
||||||
|
| Hardware | **SER5 PRO** Ryzen 7 7735HS + Radeon 680M | No NVIDIA → default is **CPU**; optional Vulkan for the iGPU |
|
||||||
|
| Web UI | **Open WebUI** | Chat, document RAG, web search, tools, code interpreter |
|
||||||
|
| Search | **SearXNG** | Keyless private search for RAG |
|
||||||
|
| Coding | **OpenHands** (optional profile) + `/workspace` mount | Agent that edits files / runs commands in a sandbox |
|
||||||
|
|
||||||
|
**Memory ballpark** (model alone, from Prism docs): ~8 GB at 4–10k context, ~14 GB at 100k with FP16 KV. With Arr + Jellyfin running, **32 GB system RAM is the practical minimum**; **64 GB** is comfortable for long context + media.
|
||||||
|
|
||||||
|
### 1. Download the model (~7.2 GB)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Recommended (resume-friendly):
|
||||||
|
pip install -U "huggingface_hub[cli]"
|
||||||
|
|
||||||
|
./scripts/download-bonsai-model.sh
|
||||||
|
# files land in ./models/bonsai/
|
||||||
|
```
|
||||||
|
|
||||||
|
Optional:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
DOWNLOAD_DRAFTER=1 ./scripts/download-bonsai-model.sh # speculative decoding pack (CUDA-oriented)
|
||||||
|
```
|
||||||
|
|
||||||
|
### 2. Start AI services
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Build Prism llama-server image + start UI + search
|
||||||
|
docker compose up -d --build bonsai open-webui searxng
|
||||||
|
|
||||||
|
# Health
|
||||||
|
curl -s http://localhost:8081/health
|
||||||
|
curl -s http://localhost:8081/v1/models
|
||||||
|
```
|
||||||
|
|
||||||
|
Open **http://host:3000** — create the admin account on first visit.
|
||||||
|
Open WebUI is pre-pointed at `http://bonsai:8080/v1` (see compose env).
|
||||||
|
|
||||||
|
### 3. RAG (documents & local files)
|
||||||
|
|
||||||
|
**Upload / Knowledge collections (best for docs)**
|
||||||
|
|
||||||
|
1. Open WebUI → **Workspace → Knowledge** → create a collection.
|
||||||
|
2. Upload PDFs, markdown, code, notes.
|
||||||
|
3. In a chat, attach the collection (or enable it on the model).
|
||||||
|
|
||||||
|
Embeddings download into the Open WebUI volume on first use (local, no cloud).
|
||||||
|
|
||||||
|
**Whole folders via bind-mount**
|
||||||
|
|
||||||
|
`AI_WORKSPACE_DIR` (default `./workspace`) is mounted **read-only** at
|
||||||
|
`/workspace` inside Open WebUI. Put projects/notes there, or point
|
||||||
|
`.env` at your real code tree:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# .env
|
||||||
|
AI_WORKSPACE_DIR=/home/you/src
|
||||||
|
```
|
||||||
|
|
||||||
|
Then ask e.g. “Summarize the layout of `/workspace/my-app`” after adding those
|
||||||
|
paths to a Knowledge collection, or use tools/OpenHands for active editing.
|
||||||
|
|
||||||
|
**Web RAG**
|
||||||
|
|
||||||
|
SearXNG is wired as the search engine (`ENABLE_RAG_WEB_SEARCH=true`). In chat
|
||||||
|
settings enable web search when you want live results.
|
||||||
|
|
||||||
|
### 4. Coding helpers
|
||||||
|
|
||||||
|
| Tool | How | Best for |
|
||||||
|
|------|-----|----------|
|
||||||
|
| **Open WebUI + Knowledge** | Upload repo docs / mount `/workspace` | Q&A over code, design docs |
|
||||||
|
| **Open WebUI code interpreter** | Enabled in compose | Python plots, quick analysis |
|
||||||
|
| **OpenHands** | `docker compose --profile coding up -d openhands` | Multi-step “change the code / run tests” agents |
|
||||||
|
| **Continue / Aider / Cursor** (host apps) | Base URL `http://host:8081/v1`, any API key | IDE-native completion & edits |
|
||||||
|
|
||||||
|
**OpenHands** (http://host:3001):
|
||||||
|
|
||||||
|
1. Settings → enable Advanced.
|
||||||
|
2. Custom model: `openai/<id-from-/v1/models>` (or keep the pre-set env).
|
||||||
|
3. Base URL: `http://bonsai:8080/v1` (from inside Docker) or `http://host.docker.internal:8081/v1`.
|
||||||
|
4. API key: same as `OPENAI_API_KEY` in `.env`.
|
||||||
|
5. Workspace is `${AI_WORKSPACE_DIR}` — agent sandboxes use Docker socket.
|
||||||
|
|
||||||
|
> Note: Prism lists long-horizon multi-file agentic coding as a weaker area of
|
||||||
|
> this 27B release; it is still very usable for review, refactors, and smaller
|
||||||
|
> tasks. Prefer shorter goals and verify with tests.
|
||||||
|
|
||||||
|
### 5. Performance knobs (SER5 PRO)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# .env examples
|
||||||
|
|
||||||
|
# Leave headroom for Jellyfin/Arrs on a 16-thread 7735HS
|
||||||
|
BONSAI_THREADS=12
|
||||||
|
|
||||||
|
# Longer context for big repos / PDFs (needs RAM)
|
||||||
|
BONSAI_CTX=32768
|
||||||
|
BONSAI_KV4=1 # 4-bit KV cache if you approach OOM
|
||||||
|
|
||||||
|
# Optional: Vulkan offload on Radeon 680M
|
||||||
|
BONSAI_BACKEND=vulkan
|
||||||
|
BONSAI_NGL=99
|
||||||
|
# then uncomment devices/group_add under bonsai in docker-compose.yml
|
||||||
|
docker compose build --no-cache bonsai && docker compose up -d bonsai
|
||||||
|
```
|
||||||
|
|
||||||
|
Start with **CPU (`BONSAI_NGL=0`)**. iGPU Vulkan can help but shares system
|
||||||
|
RAM and is more fiddly in Docker; measure both with a short prompt if you care.
|
||||||
|
|
||||||
|
Recommended generation defaults (already set): `temp=0.7`, `top_p=0.95`,
|
||||||
|
`top_k=20`. The 27B is a **thinking** model — answers may include a reasoning
|
||||||
|
block; that is expected and improves quality.
|
||||||
|
|
||||||
|
### 6. Quick API smoke test
|
||||||
|
|
||||||
|
```bash
|
||||||
|
curl -s http://localhost:8081/v1/chat/completions \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
-H "Authorization: Bearer sk-local-bonsai" \
|
||||||
|
-d '{
|
||||||
|
"model": "local",
|
||||||
|
"messages": [{"role":"user","content":"Say hello in one short sentence."}],
|
||||||
|
"temperature": 0.7,
|
||||||
|
"max_tokens": 128
|
||||||
|
}'
|
||||||
|
```
|
||||||
|
|
||||||
|
(`model` can be any string or the id returned by `/v1/models` — llama-server is
|
||||||
|
usually lenient.)
|
||||||
|
|
||||||
|
### 7. What not to do
|
||||||
|
|
||||||
|
- Do **not** route bonsai/open-webui through gluetun — inference is local and
|
||||||
|
the VPN killswitch would only add pain.
|
||||||
|
- Do **not** expect stock Ollama to load `Ternary-Bonsai-27B-Q2_0.gguf` without
|
||||||
|
Prism’s kernels (use our `bonsai` service).
|
||||||
|
- Keep Open WebUI / OpenHands off the public internet; use LAN + auth (`WEBUI_AUTH=true`).
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Layout after AI setup
|
||||||
|
|
||||||
|
```
|
||||||
|
arr-stack/
|
||||||
|
├── docker-compose.yml
|
||||||
|
├── .env / .env.example
|
||||||
|
├── ai/ # Prism llama-server image
|
||||||
|
│ ├── Dockerfile
|
||||||
|
│ └── entrypoint.sh
|
||||||
|
├── models/bonsai/ # GGUF weights (gitignored content)
|
||||||
|
├── workspace/ # files for RAG / OpenHands
|
||||||
|
├── searxng/settings.yml
|
||||||
|
├── scripts/download-bonsai-model.sh
|
||||||
|
├── config/ # app configs (open-webui, sonarr, …)
|
||||||
|
├── data/ # media + torrents
|
||||||
|
└── wireguard/wg0.conf
|
||||||
|
```
|
||||||
|
|
||||||
|
## Notes
|
||||||
|
|
||||||
|
- All app-to-app traffic uses container DNS names (`gluetun`, `sonarr`,
|
||||||
|
`bonsai`, …) on the internal `arr-net` bridge; only WebUIs are exposed to
|
||||||
|
your LAN.
|
||||||
|
- Update media stack with `docker compose pull && docker compose up -d`.
|
||||||
|
Gluetun is pinned to major version `v3` — read its release notes before
|
||||||
|
jumping majors.
|
||||||
|
- Rebuild AI runtime after Prism release bumps: edit `PRISM_RELEASE` in
|
||||||
|
`ai/Dockerfile`, then `docker compose build --no-cache bonsai`.
|
||||||
|
- Optional media extras (commented in compose): Jellyseerr.
|
||||||
|
- Optional coding profile: `docker compose --profile coding up -d openhands`.
|
||||||
67
ai/Dockerfile
Normal file
67
ai/Dockerfile
Normal file
|
|
@ -0,0 +1,67 @@
|
||||||
|
# PrismML Ternary-Bonsai 27B server (llama-server OpenAI-compatible API)
|
||||||
|
# Uses prebuilt binaries from PrismML-Eng/llama.cpp — required for Q2_0 g128 GGUFs.
|
||||||
|
#
|
||||||
|
# Build args:
|
||||||
|
# BONSAI_BACKEND = cpu (default) | vulkan
|
||||||
|
# cpu — safe default for any host (SER5 PRO works well here)
|
||||||
|
# vulkan — AMD Radeon 680M offload; needs /dev/dri on the host + Mesa
|
||||||
|
|
||||||
|
ARG BONSAI_BACKEND=cpu
|
||||||
|
|
||||||
|
FROM ubuntu:24.04 AS base
|
||||||
|
|
||||||
|
ARG BONSAI_BACKEND
|
||||||
|
ENV DEBIAN_FRONTEND=noninteractive \
|
||||||
|
BONSAI_BACKEND=${BONSAI_BACKEND} \
|
||||||
|
PRISM_RELEASE=prism-b9596-9fcaed7
|
||||||
|
|
||||||
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||||
|
ca-certificates curl tar libgomp1 \
|
||||||
|
&& if [ "$BONSAI_BACKEND" = "vulkan" ]; then \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
libvulkan1 mesa-vulkan-drivers vulkan-tools; \
|
||||||
|
fi \
|
||||||
|
&& rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
|
WORKDIR /opt/bonsai
|
||||||
|
|
||||||
|
# Prebuilt Prism llama.cpp (group-128 Q2_0 kernels)
|
||||||
|
RUN set -eux; \
|
||||||
|
BASE="https://github.com/PrismML-Eng/llama.cpp/releases/download/${PRISM_RELEASE}"; \
|
||||||
|
case "$BONSAI_BACKEND" in \
|
||||||
|
vulkan) ASSET="llama-${PRISM_RELEASE}-bin-ubuntu-vulkan-x64.tar.gz"; DEST=bin/vulkan ;; \
|
||||||
|
cpu|*) ASSET="llama-${PRISM_RELEASE}-bin-ubuntu-x64.tar.gz"; DEST=bin/cpu ;; \
|
||||||
|
esac; \
|
||||||
|
mkdir -p "$DEST"; \
|
||||||
|
curl -fL --retry 3 "$BASE/$ASSET" -o /tmp/llama.tgz; \
|
||||||
|
tar -xzf /tmp/llama.tgz -C "$DEST" --strip-components=1 2>/dev/null \
|
||||||
|
|| tar -xzf /tmp/llama.tgz -C "$DEST"; \
|
||||||
|
rm -f /tmp/llama.tgz; \
|
||||||
|
test -x "$DEST/llama-server"; \
|
||||||
|
ln -sf "/opt/bonsai/$DEST/llama-server" /usr/local/bin/llama-server; \
|
||||||
|
printf '%s\n' "$PRISM_RELEASE" > "$DEST/.llama_release"
|
||||||
|
|
||||||
|
COPY entrypoint.sh /usr/local/bin/entrypoint.sh
|
||||||
|
RUN chmod +x /usr/local/bin/entrypoint.sh
|
||||||
|
|
||||||
|
# Models mounted at runtime: /models
|
||||||
|
VOLUME ["/models"]
|
||||||
|
EXPOSE 8080
|
||||||
|
|
||||||
|
ENV LD_LIBRARY_PATH=/opt/bonsai/bin/cpu:/opt/bonsai/bin/vulkan \
|
||||||
|
MODEL_PATH=/models/Ternary-Bonsai-27B-Q2_0.gguf \
|
||||||
|
HOST=0.0.0.0 \
|
||||||
|
PORT=8080 \
|
||||||
|
NGL=0 \
|
||||||
|
CTX_SIZE=16384 \
|
||||||
|
TEMP=0.7 \
|
||||||
|
TOP_P=0.95 \
|
||||||
|
TOP_K=20 \
|
||||||
|
THREADS=0 \
|
||||||
|
KV4=0 \
|
||||||
|
EXTRA_ARGS=
|
||||||
|
|
||||||
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=120s --retries=5 \
|
||||||
|
CMD curl -fsS "http://127.0.0.1:${PORT}/health" || exit 1
|
||||||
|
|
||||||
|
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
|
||||||
88
ai/entrypoint.sh
Executable file
88
ai/entrypoint.sh
Executable file
|
|
@ -0,0 +1,88 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
# Start Prism llama-server with Ternary-Bonsai defaults.
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
MODEL_PATH="${MODEL_PATH:-/models/Ternary-Bonsai-27B-Q2_0.gguf}"
|
||||||
|
HOST="${HOST:-0.0.0.0}"
|
||||||
|
PORT="${PORT:-8080}"
|
||||||
|
CTX_SIZE="${CTX_SIZE:-16384}"
|
||||||
|
TEMP="${TEMP:-0.7}"
|
||||||
|
TOP_P="${TOP_P:-0.95}"
|
||||||
|
TOP_K="${TOP_K:-20}"
|
||||||
|
NGL="${NGL:-0}"
|
||||||
|
THREADS="${THREADS:-0}"
|
||||||
|
KV4="${KV4:-0}"
|
||||||
|
EXTRA_ARGS="${EXTRA_ARGS:-}"
|
||||||
|
|
||||||
|
# Prefer vulkan binary tree if present and NGL > 0
|
||||||
|
BIN=/usr/local/bin/llama-server
|
||||||
|
if [ -x /opt/bonsai/bin/vulkan/llama-server ] && [ "${NGL}" != "0" ]; then
|
||||||
|
export LD_LIBRARY_PATH="/opt/bonsai/bin/vulkan${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
|
||||||
|
BIN=/opt/bonsai/bin/vulkan/llama-server
|
||||||
|
elif [ -x /opt/bonsai/bin/cpu/llama-server ]; then
|
||||||
|
export LD_LIBRARY_PATH="/opt/bonsai/bin/cpu${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
|
||||||
|
BIN=/opt/bonsai/bin/cpu/llama-server
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ ! -f "$MODEL_PATH" ]; then
|
||||||
|
echo "ERROR: model not found at $MODEL_PATH"
|
||||||
|
echo "Run: ./scripts/download-bonsai-model.sh"
|
||||||
|
echo "Or set MODEL_PATH to your GGUF file."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Optional vision projector (27B VLM)
|
||||||
|
MMPROJ_ARGS=()
|
||||||
|
if [ -n "${MMPROJ_PATH:-}" ] && [ -f "$MMPROJ_PATH" ]; then
|
||||||
|
MMPROJ_ARGS=(--mmproj "$MMPROJ_PATH")
|
||||||
|
else
|
||||||
|
# Auto-detect mmproj next to the model
|
||||||
|
_dir="$(dirname "$MODEL_PATH")"
|
||||||
|
for _mp in "$_dir"/*mmproj*.gguf; do
|
||||||
|
if [ -f "$_mp" ]; then
|
||||||
|
MMPROJ_ARGS=(--mmproj "$_mp")
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Optional 4-bit KV cache (long context on limited RAM)
|
||||||
|
KV_ARGS=()
|
||||||
|
if [ "$KV4" = "1" ]; then
|
||||||
|
KV_ARGS=(--cache-type-k q4_0 --cache-type-v q4_0)
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Thread count: 0 = leave llama.cpp default (usually all physical cores)
|
||||||
|
THREAD_ARGS=()
|
||||||
|
if [ "$THREADS" != "0" ] && [ -n "$THREADS" ]; then
|
||||||
|
THREAD_ARGS=(-t "$THREADS")
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "=== Ternary-Bonsai llama-server ==="
|
||||||
|
echo " model: $MODEL_PATH"
|
||||||
|
echo " binary: $BIN"
|
||||||
|
echo " ngl: $NGL (0=CPU; for Vulkan image try 99 with /dev/dri)"
|
||||||
|
echo " context: $CTX_SIZE"
|
||||||
|
echo " api: http://${HOST}:${PORT}/v1/chat/completions"
|
||||||
|
[ "${#MMPROJ_ARGS[@]}" -gt 0 ] && echo " vision: ${MMPROJ_ARGS[1]}"
|
||||||
|
[ "$KV4" = "1" ] && echo " kv: q4_0"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# shellcheck disable=SC2086
|
||||||
|
exec "$BIN" \
|
||||||
|
-m "$MODEL_PATH" \
|
||||||
|
--host "$HOST" \
|
||||||
|
--port "$PORT" \
|
||||||
|
-ngl "$NGL" \
|
||||||
|
-fa on \
|
||||||
|
-c "$CTX_SIZE" \
|
||||||
|
--temp "$TEMP" \
|
||||||
|
--top-p "$TOP_P" \
|
||||||
|
--top-k "$TOP_K" \
|
||||||
|
--min-p 0 \
|
||||||
|
--jinja \
|
||||||
|
"${THREAD_ARGS[@]}" \
|
||||||
|
"${MMPROJ_ARGS[@]}" \
|
||||||
|
"${KV_ARGS[@]}" \
|
||||||
|
$EXTRA_ARGS \
|
||||||
|
"$@"
|
||||||
132
ansible/README.md
Normal file
132
ansible/README.md
Normal file
|
|
@ -0,0 +1,132 @@
|
||||||
|
# Homelab Ansible — Ubuntu 24.04 (SER5 PRO)
|
||||||
|
|
||||||
|
Bootstraps the headless mini PC for **arr-stack + Ternary-Bonsai (Vulkan)**.
|
||||||
|
|
||||||
|
| Item | Value |
|
||||||
|
|------|--------|
|
||||||
|
| Host | `192.168.8.123:22` |
|
||||||
|
| User | `tim` |
|
||||||
|
| SSH key | `~/.ssh/id_ed25519` |
|
||||||
|
| Stack | `/opt/stack` |
|
||||||
|
| Media | `/storage` |
|
||||||
|
|
||||||
|
## What it installs
|
||||||
|
|
||||||
|
1. **common** — apt upgrade, essentials (`curl` `wget` `nano` `build-essential` `net-tools`), [Microsoft Edit](https://github.com/microsoft/edit), tools, unattended-upgrades, fail2ban
|
||||||
|
2. **docker** — Docker CE + Compose plugin, enabled on boot, user in `docker`
|
||||||
|
3. **amd_vulkan** — Mesa Vulkan, VA-API, firmware, `video`/`render` groups, udev rules
|
||||||
|
4. **firewall** — UFW: deny inbound, allow stack ports **from LAN only** (`192.168.8.0/24`)
|
||||||
|
5. **stack** — `/opt/stack` + `/storage`, rsync project, `.env`, Vulkan compose override, **`arr-stack.service`** so compose comes up after reboot (`restart: unless-stopped` on every service)
|
||||||
|
|
||||||
|
## Prerequisites (control machine)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Debian/Ubuntu control node
|
||||||
|
sudo apt install -y ansible git rsync
|
||||||
|
|
||||||
|
cd /path/to/arr-stack/ansible
|
||||||
|
ansible-galaxy collection install -r requirements.yml
|
||||||
|
```
|
||||||
|
|
||||||
|
SSH must already work:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
ssh -i ~/.ssh/id_ed25519 tim@192.168.8.123
|
||||||
|
```
|
||||||
|
|
||||||
|
On the **server**, either enable passwordless sudo (recommended for automation):
|
||||||
|
|
||||||
|
```bash
|
||||||
|
echo 'tim ALL=(ALL) NOPASSWD:ALL' | sudo tee /etc/sudoers.d/tim
|
||||||
|
sudo chmod 440 /etc/sudoers.d/tim
|
||||||
|
```
|
||||||
|
|
||||||
|
…or pass the sudo password each run with `-K` / `--ask-become-pass`.
|
||||||
|
|
||||||
|
## Run
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd ansible
|
||||||
|
|
||||||
|
# Full bootstrap (prompt for sudo if not NOPASSWD)
|
||||||
|
ansible-playbook site.yml -K
|
||||||
|
|
||||||
|
# Or limit / tags
|
||||||
|
ansible-playbook site.yml -K --tags docker,amd,firewall
|
||||||
|
ansible-playbook site.yml -K --tags stack,deploy
|
||||||
|
ansible-playbook site.yml -K --check # dry-run (partial)
|
||||||
|
```
|
||||||
|
|
||||||
|
First connection may prompt for host key (`accept-new` is set in `ansible.cfg`).
|
||||||
|
|
||||||
|
## After the playbook
|
||||||
|
|
||||||
|
On the **server** (or via SSH):
|
||||||
|
|
||||||
|
```bash
|
||||||
|
ssh tim@192.168.8.123
|
||||||
|
# new shell so docker/video/render groups apply
|
||||||
|
cd /opt/stack
|
||||||
|
|
||||||
|
# WireGuard (if not copied): edit wireguard/wg0.conf
|
||||||
|
# Model (~7.2G):
|
||||||
|
./scripts/download-bonsai-model.sh
|
||||||
|
|
||||||
|
# Vulkan image + stack
|
||||||
|
docker compose build bonsai
|
||||||
|
docker compose up -d
|
||||||
|
docker compose ps
|
||||||
|
```
|
||||||
|
|
||||||
|
Verify GPU / tools inside the host:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
vulkaninfo --summary
|
||||||
|
ls -l /dev/dri
|
||||||
|
groups # should include docker, video, render
|
||||||
|
edit --version # Microsoft terminal editor
|
||||||
|
curl --version && wget --version && nano --version
|
||||||
|
```
|
||||||
|
|
||||||
|
Survive reboots:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
systemctl is-enabled docker arr-stack
|
||||||
|
systemctl status arr-stack
|
||||||
|
# containers use restart: unless-stopped; arr-stack.service runs compose up -d on boot
|
||||||
|
```
|
||||||
|
|
||||||
|
## Layout on the server
|
||||||
|
|
||||||
|
```
|
||||||
|
/opt/stack/ # compose, config, models, workspace, wireguard
|
||||||
|
docker-compose.yml
|
||||||
|
docker-compose.override.yml # /dev/dri for bonsai + jellyfin
|
||||||
|
.env
|
||||||
|
config/
|
||||||
|
models/bonsai/
|
||||||
|
workspace/
|
||||||
|
wireguard/wg0.conf
|
||||||
|
|
||||||
|
/storage/ # 1TB media disk
|
||||||
|
media/{movies,tv,music}
|
||||||
|
torrents/{movies,tv,music}
|
||||||
|
```
|
||||||
|
|
||||||
|
`.env` points `DATA_DIR=/storage` and `CONFIG_DIR=/opt/stack/config`.
|
||||||
|
|
||||||
|
## Variables
|
||||||
|
|
||||||
|
Edit `group_vars/all.yml` (or host_vars) for:
|
||||||
|
|
||||||
|
- `lan_subnet`, `timezone`
|
||||||
|
- `bonsai_backend` / `bonsai_ngl` (default `vulkan` / `99`)
|
||||||
|
- `ufw_allow_ssh_from_anywhere` (default `false` — SSH only from LAN)
|
||||||
|
- `deploy_stack_files` — set `false` to skip rsync
|
||||||
|
|
||||||
|
## Security notes
|
||||||
|
|
||||||
|
- Do not commit `wireguard/wg0.conf` or production `.env`.
|
||||||
|
- UFW allows service ports only from `lan_subnet`.
|
||||||
|
- Fail2ban protects SSH.
|
||||||
|
- Re-login after first run so group membership (`docker`, `render`) is active.
|
||||||
25
ansible/ansible.cfg
Normal file
25
ansible/ansible.cfg
Normal file
|
|
@ -0,0 +1,25 @@
|
||||||
|
[defaults]
|
||||||
|
inventory = inventory/hosts.ini
|
||||||
|
roles_path = roles
|
||||||
|
remote_user = tim
|
||||||
|
private_key_file = ~/.ssh/id_ed25519
|
||||||
|
host_key_checking = True
|
||||||
|
retry_files_enabled = False
|
||||||
|
# community.general.yaml was removed; use the built-in default callback's YAML format
|
||||||
|
stdout_callback = ansible.builtin.default
|
||||||
|
# (ansible-core 2.13+; ignored on older cores that don't know this key)
|
||||||
|
callback_result_format = yaml
|
||||||
|
interpreter_python = auto_silent
|
||||||
|
deprecation_warnings = False
|
||||||
|
# Faster on a single host
|
||||||
|
forks = 5
|
||||||
|
timeout = 30
|
||||||
|
|
||||||
|
[privilege_escalation]
|
||||||
|
# become is set per-play in site.yml (not global) so ad-hoc ping works without sudo
|
||||||
|
become_method = sudo
|
||||||
|
become_user = root
|
||||||
|
|
||||||
|
[ssh_connection]
|
||||||
|
pipelining = True
|
||||||
|
ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=accept-new
|
||||||
221
ansible/group_vars/all.yml
Normal file
221
ansible/group_vars/all.yml
Normal file
|
|
@ -0,0 +1,221 @@
|
||||||
|
---
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# Host layout
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
stack_root: /opt/stack
|
||||||
|
storage_root: /storage
|
||||||
|
stack_owner: tim
|
||||||
|
stack_group: tim
|
||||||
|
|
||||||
|
# Media tree lives on the 1TB disk
|
||||||
|
data_dir: "{{ storage_root }}"
|
||||||
|
config_dir: "{{ stack_root }}/config"
|
||||||
|
models_dir: "{{ stack_root }}/models/bonsai"
|
||||||
|
workspace_dir: "{{ stack_root }}/workspace"
|
||||||
|
wireguard_dir: "{{ stack_root }}/wireguard"
|
||||||
|
|
||||||
|
# LAN (SER5 is 192.168.8.123)
|
||||||
|
lan_subnet: 192.168.8.0/24
|
||||||
|
timezone: America/Los_Angeles
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# Packages
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# Always-on essentials (explicit — also listed in common_packages)
|
||||||
|
essential_packages:
|
||||||
|
- curl
|
||||||
|
- wget
|
||||||
|
- nano
|
||||||
|
- build-essential
|
||||||
|
- net-tools
|
||||||
|
|
||||||
|
# Microsoft Edit (https://github.com/microsoft/edit) — terminal editor
|
||||||
|
ms_edit_version: "2.0.0"
|
||||||
|
ms_edit_install: true
|
||||||
|
|
||||||
|
common_packages:
|
||||||
|
# essentials
|
||||||
|
- curl
|
||||||
|
- wget
|
||||||
|
- nano
|
||||||
|
- build-essential
|
||||||
|
- net-tools
|
||||||
|
# system / packaging
|
||||||
|
- ca-certificates
|
||||||
|
- gnupg
|
||||||
|
- apt-transport-https
|
||||||
|
- software-properties-common
|
||||||
|
- git
|
||||||
|
- python3
|
||||||
|
- python3-pip
|
||||||
|
- python3-venv
|
||||||
|
- cmake
|
||||||
|
- ninja-build
|
||||||
|
- pkg-config
|
||||||
|
# editors / viewers
|
||||||
|
- vim
|
||||||
|
- less
|
||||||
|
# monitoring / disk
|
||||||
|
- htop
|
||||||
|
- btop
|
||||||
|
- iotop
|
||||||
|
- iftop
|
||||||
|
- ncdu
|
||||||
|
- duf
|
||||||
|
- sysstat
|
||||||
|
- smartmontools
|
||||||
|
- lm-sensors
|
||||||
|
- nvme-cli
|
||||||
|
# network
|
||||||
|
- iproute2
|
||||||
|
- dnsutils
|
||||||
|
- traceroute
|
||||||
|
- mtr-tiny
|
||||||
|
- nmap
|
||||||
|
- tcpdump
|
||||||
|
# utils
|
||||||
|
- tree
|
||||||
|
- jq
|
||||||
|
- ripgrep
|
||||||
|
- fd-find
|
||||||
|
- fzf
|
||||||
|
- tmux
|
||||||
|
- rsync
|
||||||
|
- unzip
|
||||||
|
- zip
|
||||||
|
- p7zip-full
|
||||||
|
- lsof
|
||||||
|
- strace
|
||||||
|
- pciutils
|
||||||
|
- usbutils
|
||||||
|
- plocate
|
||||||
|
- bat
|
||||||
|
- aria2
|
||||||
|
# security / updates
|
||||||
|
- fail2ban
|
||||||
|
- unattended-upgrades
|
||||||
|
- update-notifier-common
|
||||||
|
|
||||||
|
# Start stack on boot (docker compose up -d); pairs with restart: unless-stopped
|
||||||
|
stack_systemd_enable: true
|
||||||
|
stack_compose_profiles: [] # e.g. ["coding"] to also start openhands
|
||||||
|
|
||||||
|
# AMD / Vulkan / media accel (Radeon 680M on SER5 PRO)
|
||||||
|
# Note: Ubuntu 24.04 uses mesa-va-drivers (not the older libva-mesa-driver name).
|
||||||
|
# Many of these live in the "universe" component — role enables it first.
|
||||||
|
amd_vulkan_packages:
|
||||||
|
- linux-firmware
|
||||||
|
- mesa-vulkan-drivers
|
||||||
|
- mesa-utils
|
||||||
|
- libvulkan1
|
||||||
|
- vulkan-tools
|
||||||
|
- libgl1-mesa-dri
|
||||||
|
- libegl1
|
||||||
|
- libgles2
|
||||||
|
- vainfo
|
||||||
|
- libva2
|
||||||
|
- libva-drm2
|
||||||
|
- mesa-va-drivers
|
||||||
|
- mesa-vdpau-drivers
|
||||||
|
- clinfo
|
||||||
|
|
||||||
|
# Groups for operator account (tim) — local trusted host, convenience over lockdown
|
||||||
|
extra_user_groups:
|
||||||
|
- sudo
|
||||||
|
- docker
|
||||||
|
- video
|
||||||
|
- render
|
||||||
|
- adm
|
||||||
|
- disk
|
||||||
|
- plugdev
|
||||||
|
- dialout
|
||||||
|
- cdrom
|
||||||
|
- users
|
||||||
|
- systemd-journal
|
||||||
|
# present on many Ubuntu images; harmless if already primary
|
||||||
|
- tim
|
||||||
|
|
||||||
|
# Passwordless full sudo for stack_owner (local monitored network)
|
||||||
|
stack_passwordless_sudo: true
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# Docker
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
docker_packages:
|
||||||
|
- docker-ce
|
||||||
|
- docker-ce-cli
|
||||||
|
- containerd.io
|
||||||
|
- docker-buildx-plugin
|
||||||
|
- docker-compose-plugin
|
||||||
|
|
||||||
|
docker_daemon_json:
|
||||||
|
log-driver: json-file
|
||||||
|
log-opts:
|
||||||
|
max-size: "50m"
|
||||||
|
max-file: "5"
|
||||||
|
# Leave room for media + inference
|
||||||
|
default-address-pools:
|
||||||
|
- base: 172.30.0.0/16
|
||||||
|
size: 24
|
||||||
|
# Enable cgroup device access patterns used by /dev/dri
|
||||||
|
features:
|
||||||
|
buildkit: true
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# Firewall (UFW) — default deny in, allow out; open stack ports to LAN only
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
ufw_enabled: true
|
||||||
|
ufw_default_incoming: deny
|
||||||
|
ufw_default_outgoing: allow
|
||||||
|
|
||||||
|
# SSH from anywhere on LAN (and optionally world — keep LAN-only by default)
|
||||||
|
ufw_allow_ssh_from_anywhere: false
|
||||||
|
|
||||||
|
ufw_lan_tcp_ports:
|
||||||
|
- { port: 22, comment: "SSH" }
|
||||||
|
- { port: 8080, comment: "qBittorrent" }
|
||||||
|
- { port: 8096, comment: "Jellyfin" }
|
||||||
|
- { port: 8989, comment: "Sonarr" }
|
||||||
|
- { port: 7878, comment: "Radarr" }
|
||||||
|
- { port: 9696, comment: "Prowlarr" }
|
||||||
|
- { port: 6767, comment: "Bazarr" }
|
||||||
|
- { port: 8686, comment: "Lidarr" }
|
||||||
|
- { port: 3000, comment: "Open WebUI" }
|
||||||
|
- { port: 8081, comment: "Bonsai llama-server" }
|
||||||
|
- { port: 3001, comment: "OpenHands (optional)" }
|
||||||
|
- { port: 3002, comment: "Forgejo HTTP" }
|
||||||
|
- { port: 2222, comment: "Forgejo Git SSH" }
|
||||||
|
|
||||||
|
# Forgejo (self-hosted Git)
|
||||||
|
forgejo_domain: "192.168.8.123"
|
||||||
|
forgejo_http_port: 3002
|
||||||
|
forgejo_ssh_port: 2222
|
||||||
|
forgejo_root_url: "http://{{ forgejo_domain }}:{{ forgejo_http_port }}/"
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# Stack deployment
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# Sync this repo (parent of ansible/) to stack_root on the server.
|
||||||
|
# Set false if you manage /opt/stack yourself (git clone, etc.).
|
||||||
|
deploy_stack_files: true
|
||||||
|
|
||||||
|
# Paths on the control machine (the machine running ansible-playbook)
|
||||||
|
# Default: the arr-stack repo that contains this ansible/ directory
|
||||||
|
stack_src: "{{ playbook_dir | dirname }}"
|
||||||
|
|
||||||
|
# AI defaults for SER5 + Vulkan
|
||||||
|
bonsai_backend: vulkan
|
||||||
|
bonsai_ngl: "99"
|
||||||
|
bonsai_ctx: "16384"
|
||||||
|
bonsai_threads: "12"
|
||||||
|
bonsai_kv4: "0"
|
||||||
|
open_webui_auth: "true"
|
||||||
|
|
||||||
|
# Media subdirs under storage_root
|
||||||
|
media_subdirs:
|
||||||
|
- media/movies
|
||||||
|
- media/tv
|
||||||
|
- media/music
|
||||||
|
- torrents/movies
|
||||||
|
- torrents/tv
|
||||||
|
- torrents/music
|
||||||
7
ansible/inventory/hosts.ini
Normal file
7
ansible/inventory/hosts.ini
Normal file
|
|
@ -0,0 +1,7 @@
|
||||||
|
# Homelab mini PC (Beelink SER5 PRO / Ubuntu Server 24.04)
|
||||||
|
[homelab]
|
||||||
|
ser5 ansible_host=192.168.8.123 ansible_port=22 ansible_user=tim
|
||||||
|
|
||||||
|
[homelab:vars]
|
||||||
|
ansible_ssh_private_key_file=~/.ssh/id_ed25519
|
||||||
|
ansible_python_interpreter=/usr/bin/python3
|
||||||
6
ansible/requirements.yml
Normal file
6
ansible/requirements.yml
Normal file
|
|
@ -0,0 +1,6 @@
|
||||||
|
---
|
||||||
|
collections:
|
||||||
|
- name: community.general
|
||||||
|
version: ">=8.0.0"
|
||||||
|
- name: ansible.posix
|
||||||
|
version: ">=1.5.0"
|
||||||
6
ansible/roles/amd_vulkan/handlers/main.yml
Normal file
6
ansible/roles/amd_vulkan/handlers/main.yml
Normal file
|
|
@ -0,0 +1,6 @@
|
||||||
|
---
|
||||||
|
- name: Reload udev
|
||||||
|
ansible.builtin.shell: |
|
||||||
|
udevadm control --reload-rules
|
||||||
|
udevadm trigger
|
||||||
|
changed_when: true
|
||||||
102
ansible/roles/amd_vulkan/tasks/main.yml
Normal file
102
ansible/roles/amd_vulkan/tasks/main.yml
Normal file
|
|
@ -0,0 +1,102 @@
|
||||||
|
---
|
||||||
|
# Radeon 680M (RDNA2 iGPU) on SER5 PRO — Mesa Vulkan for llama.cpp / Jellyfin VAAPI
|
||||||
|
|
||||||
|
- name: Install software-properties-common (for add-apt-repository)
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name: software-properties-common
|
||||||
|
state: present
|
||||||
|
tags: [amd, vulkan, gpu]
|
||||||
|
|
||||||
|
- name: Enable Ubuntu universe and multiverse components
|
||||||
|
ansible.builtin.command: add-apt-repository -y {{ item }}
|
||||||
|
loop:
|
||||||
|
- universe
|
||||||
|
- multiverse
|
||||||
|
register: apt_components
|
||||||
|
# With loop, changed_when runs per item — use item stdout, not .results
|
||||||
|
changed_when: "'Adding component' in (apt_components.stdout | default(''))"
|
||||||
|
failed_when: apt_components.rc is defined and apt_components.rc != 0
|
||||||
|
tags: [amd, vulkan, gpu]
|
||||||
|
|
||||||
|
- name: Update apt cache after enabling universe/multiverse
|
||||||
|
ansible.builtin.apt:
|
||||||
|
update_cache: true
|
||||||
|
tags: [amd, vulkan, gpu]
|
||||||
|
|
||||||
|
- name: Install AMD / Mesa / Vulkan packages
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name: "{{ amd_vulkan_packages }}"
|
||||||
|
state: present
|
||||||
|
update_cache: false
|
||||||
|
tags: [amd, vulkan, gpu]
|
||||||
|
|
||||||
|
- name: Ensure video and render groups exist
|
||||||
|
ansible.builtin.group:
|
||||||
|
name: "{{ item }}"
|
||||||
|
state: present
|
||||||
|
loop:
|
||||||
|
- video
|
||||||
|
- render
|
||||||
|
tags: [amd, vulkan, gpu]
|
||||||
|
|
||||||
|
- name: Add stack user to video and render (GPU device access)
|
||||||
|
ansible.builtin.user:
|
||||||
|
name: "{{ stack_owner }}"
|
||||||
|
groups:
|
||||||
|
- video
|
||||||
|
- render
|
||||||
|
append: true
|
||||||
|
tags: [amd, vulkan, gpu]
|
||||||
|
|
||||||
|
- name: Check for DRM render nodes
|
||||||
|
ansible.builtin.find:
|
||||||
|
paths: /dev/dri
|
||||||
|
patterns: "renderD*,card*"
|
||||||
|
file_type: any
|
||||||
|
register: dri_nodes
|
||||||
|
tags: [amd, vulkan, gpu]
|
||||||
|
failed_when: false
|
||||||
|
|
||||||
|
- name: Report /dev/dri devices
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: >-
|
||||||
|
DRM nodes:
|
||||||
|
{{ dri_nodes.files | map(attribute='path') | list | default(['(none found — check kernel / firmware)'], true) }}
|
||||||
|
tags: [amd, vulkan, gpu]
|
||||||
|
|
||||||
|
- name: Probe Vulkan (as stack user when possible)
|
||||||
|
become: true
|
||||||
|
become_user: "{{ stack_owner }}"
|
||||||
|
ansible.builtin.command: vulkaninfo --summary
|
||||||
|
register: vulkan_summary
|
||||||
|
changed_when: false
|
||||||
|
failed_when: false
|
||||||
|
tags: [amd, vulkan, gpu]
|
||||||
|
|
||||||
|
- name: Show Vulkan summary (first lines)
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "{{ (vulkan_summary.stdout_lines | default(['vulkaninfo failed or not usable yet']))[:40] }}"
|
||||||
|
tags: [amd, vulkan, gpu]
|
||||||
|
|
||||||
|
- name: Probe VA-API
|
||||||
|
ansible.builtin.command: vainfo
|
||||||
|
register: vainfo_out
|
||||||
|
changed_when: false
|
||||||
|
failed_when: false
|
||||||
|
tags: [amd, vulkan, gpu]
|
||||||
|
|
||||||
|
- name: Show vainfo snippet
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "{{ (vainfo_out.stdout_lines | default(vainfo_out.stderr_lines | default(['vainfo unavailable'])))[:25] }}"
|
||||||
|
tags: [amd, vulkan, gpu]
|
||||||
|
|
||||||
|
- name: udev rule — ensure render nodes are accessible by render group
|
||||||
|
ansible.builtin.copy:
|
||||||
|
dest: /etc/udev/rules.d/99-amd-render.rules
|
||||||
|
mode: "0644"
|
||||||
|
content: |
|
||||||
|
# Homelab: AMD GPU / APU render nodes for Docker + Vulkan
|
||||||
|
KERNEL=="renderD*", GROUP="render", MODE="0660"
|
||||||
|
KERNEL=="card*", GROUP="video", MODE="0660"
|
||||||
|
notify: Reload udev
|
||||||
|
tags: [amd, vulkan, gpu]
|
||||||
5
ansible/roles/common/handlers/main.yml
Normal file
5
ansible/roles/common/handlers/main.yml
Normal file
|
|
@ -0,0 +1,5 @@
|
||||||
|
---
|
||||||
|
- name: Restart fail2ban
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: fail2ban
|
||||||
|
state: restarted
|
||||||
179
ansible/roles/common/tasks/main.yml
Normal file
179
ansible/roles/common/tasks/main.yml
Normal file
|
|
@ -0,0 +1,179 @@
|
||||||
|
---
|
||||||
|
- name: Set system timezone
|
||||||
|
community.general.timezone:
|
||||||
|
name: "{{ timezone }}"
|
||||||
|
tags: [common, timezone]
|
||||||
|
|
||||||
|
- name: Wait for any existing unattended-upgrade / dpkg lock
|
||||||
|
ansible.builtin.shell: |
|
||||||
|
while fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1 \
|
||||||
|
|| fuser /var/lib/apt/lists/lock >/dev/null 2>&1; do
|
||||||
|
sleep 5
|
||||||
|
done
|
||||||
|
changed_when: false
|
||||||
|
tags: [common, apt]
|
||||||
|
|
||||||
|
- name: Update apt cache
|
||||||
|
ansible.builtin.apt:
|
||||||
|
update_cache: true
|
||||||
|
cache_valid_time: 3600
|
||||||
|
tags: [common, apt]
|
||||||
|
|
||||||
|
- name: Upgrade all packages
|
||||||
|
ansible.builtin.apt:
|
||||||
|
upgrade: dist
|
||||||
|
autoremove: true
|
||||||
|
autoclean: true
|
||||||
|
tags: [common, apt, upgrade]
|
||||||
|
|
||||||
|
- name: Install essential packages (curl wget nano build-essential net-tools)
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name: "{{ essential_packages }}"
|
||||||
|
state: present
|
||||||
|
tags: [common, packages, essentials]
|
||||||
|
|
||||||
|
- name: Install common packages
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name: "{{ common_packages }}"
|
||||||
|
state: present
|
||||||
|
tags: [common, packages]
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# Microsoft Edit — terminal-based editor (https://github.com/microsoft/edit)
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
- name: Resolve Microsoft Edit archive name for this arch
|
||||||
|
ansible.builtin.set_fact:
|
||||||
|
ms_edit_arch_triple: >-
|
||||||
|
{{
|
||||||
|
'x86_64-linux-gnu' if ansible_architecture in ['x86_64', 'amd64']
|
||||||
|
else (
|
||||||
|
'aarch64-linux-gnu' if ansible_architecture in ['aarch64', 'arm64']
|
||||||
|
else 'UNSUPPORTED'
|
||||||
|
)
|
||||||
|
}}
|
||||||
|
when: ms_edit_install | bool
|
||||||
|
tags: [common, packages, edit]
|
||||||
|
|
||||||
|
- name: Fail if Microsoft Edit has no binary for this architecture
|
||||||
|
ansible.builtin.fail:
|
||||||
|
msg: "No Microsoft Edit release for architecture {{ ansible_architecture }}"
|
||||||
|
when:
|
||||||
|
- ms_edit_install | bool
|
||||||
|
- ms_edit_arch_triple == 'UNSUPPORTED'
|
||||||
|
tags: [common, packages, edit]
|
||||||
|
|
||||||
|
- name: Check whether Microsoft Edit is already installed at the desired version
|
||||||
|
ansible.builtin.command: /usr/local/bin/edit --version
|
||||||
|
register: ms_edit_installed
|
||||||
|
changed_when: false
|
||||||
|
failed_when: false
|
||||||
|
when: ms_edit_install | bool
|
||||||
|
tags: [common, packages, edit]
|
||||||
|
|
||||||
|
- name: Download Microsoft Edit release tarball
|
||||||
|
ansible.builtin.get_url:
|
||||||
|
url: >-
|
||||||
|
https://github.com/microsoft/edit/releases/download/v{{ ms_edit_version }}/edit-{{ ms_edit_version }}-{{ ms_edit_arch_triple | trim }}.tar.gz
|
||||||
|
dest: "/tmp/edit-{{ ms_edit_version }}.tar.gz"
|
||||||
|
mode: "0644"
|
||||||
|
when:
|
||||||
|
- ms_edit_install | bool
|
||||||
|
- ms_edit_installed.rc is not defined or ms_edit_installed.rc != 0
|
||||||
|
or (ms_edit_version not in (ms_edit_installed.stdout | default('')))
|
||||||
|
tags: [common, packages, edit]
|
||||||
|
|
||||||
|
- name: Install Microsoft Edit binary to /usr/local/bin/edit
|
||||||
|
ansible.builtin.unarchive:
|
||||||
|
src: "/tmp/edit-{{ ms_edit_version }}.tar.gz"
|
||||||
|
dest: /usr/local/bin
|
||||||
|
remote_src: true
|
||||||
|
mode: "0755"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
when:
|
||||||
|
- ms_edit_install | bool
|
||||||
|
- ms_edit_installed.rc is not defined or ms_edit_installed.rc != 0
|
||||||
|
or (ms_edit_version not in (ms_edit_installed.stdout | default('')))
|
||||||
|
tags: [common, packages, edit]
|
||||||
|
|
||||||
|
- name: Verify Microsoft Edit is on PATH
|
||||||
|
ansible.builtin.command: /usr/local/bin/edit --version
|
||||||
|
register: ms_edit_verify
|
||||||
|
changed_when: false
|
||||||
|
failed_when: ms_edit_verify.rc != 0
|
||||||
|
when: ms_edit_install | bool
|
||||||
|
tags: [common, packages, edit]
|
||||||
|
|
||||||
|
- name: Show Microsoft Edit version
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "{{ ms_edit_verify.stdout | default(ms_edit_installed.stdout) | default('edit installed') }}"
|
||||||
|
when: ms_edit_install | bool
|
||||||
|
tags: [common, packages, edit]
|
||||||
|
|
||||||
|
- name: Enable unattended-upgrades
|
||||||
|
ansible.builtin.debconf:
|
||||||
|
name: unattended-upgrades
|
||||||
|
question: unattended-upgrades/enable_auto_updates
|
||||||
|
value: "true"
|
||||||
|
vtype: boolean
|
||||||
|
tags: [common, unattended]
|
||||||
|
|
||||||
|
- name: Configure unattended-upgrades (security only)
|
||||||
|
ansible.builtin.copy:
|
||||||
|
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
||||||
|
mode: "0644"
|
||||||
|
content: |
|
||||||
|
APT::Periodic::Update-Package-Lists "1";
|
||||||
|
APT::Periodic::Unattended-Upgrade "1";
|
||||||
|
APT::Periodic::AutocleanInterval "7";
|
||||||
|
tags: [common, unattended]
|
||||||
|
|
||||||
|
- name: Prefer security updates in unattended-upgrades
|
||||||
|
ansible.builtin.lineinfile:
|
||||||
|
path: /etc/apt/apt.conf.d/50unattended-upgrades
|
||||||
|
regexp: '{{ item.regexp }}'
|
||||||
|
line: '{{ item.line }}'
|
||||||
|
state: present
|
||||||
|
loop:
|
||||||
|
- regexp: '^\s*//\s*"\$\{distro_id\}:\$\{distro_codename\}-security";'
|
||||||
|
line: ' "${distro_id}:${distro_codename}-security";'
|
||||||
|
- regexp: 'Unattended-Upgrade::Remove-Unused-Dependencies'
|
||||||
|
line: 'Unattended-Upgrade::Remove-Unused-Dependencies "true";'
|
||||||
|
failed_when: false
|
||||||
|
tags: [common, unattended]
|
||||||
|
|
||||||
|
- name: Enable and start fail2ban
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: fail2ban
|
||||||
|
state: started
|
||||||
|
enabled: true
|
||||||
|
tags: [common, fail2ban]
|
||||||
|
|
||||||
|
- name: Fail2ban SSH jail (sshd)
|
||||||
|
ansible.builtin.copy:
|
||||||
|
dest: /etc/fail2ban/jail.d/sshd.local
|
||||||
|
mode: "0644"
|
||||||
|
content: |
|
||||||
|
[sshd]
|
||||||
|
enabled = true
|
||||||
|
port = ssh
|
||||||
|
filter = sshd
|
||||||
|
maxretry = 5
|
||||||
|
bantime = 1h
|
||||||
|
findtime = 10m
|
||||||
|
notify: Restart fail2ban
|
||||||
|
tags: [common, fail2ban]
|
||||||
|
|
||||||
|
- name: Ensure plocate database is built
|
||||||
|
ansible.builtin.command: updatedb
|
||||||
|
changed_when: false
|
||||||
|
failed_when: false
|
||||||
|
tags: [common]
|
||||||
|
|
||||||
|
- name: Detect sensors (lm-sensors)
|
||||||
|
ansible.builtin.command: sensors-detect --auto
|
||||||
|
args:
|
||||||
|
creates: /etc/sensors3.conf
|
||||||
|
failed_when: false
|
||||||
|
changed_when: false
|
||||||
|
tags: [common]
|
||||||
5
ansible/roles/docker/handlers/main.yml
Normal file
5
ansible/roles/docker/handlers/main.yml
Normal file
|
|
@ -0,0 +1,5 @@
|
||||||
|
---
|
||||||
|
- name: Restart docker
|
||||||
|
ansible.builtin.service:
|
||||||
|
name: docker
|
||||||
|
state: restarted
|
||||||
91
ansible/roles/docker/tasks/main.yml
Normal file
91
ansible/roles/docker/tasks/main.yml
Normal file
|
|
@ -0,0 +1,91 @@
|
||||||
|
---
|
||||||
|
- name: Install Docker apt prerequisites
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name:
|
||||||
|
- ca-certificates
|
||||||
|
- curl
|
||||||
|
- gnupg
|
||||||
|
state: present
|
||||||
|
tags: [docker]
|
||||||
|
|
||||||
|
- name: Create keyrings directory
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: /etc/apt/keyrings
|
||||||
|
state: directory
|
||||||
|
mode: "0755"
|
||||||
|
tags: [docker]
|
||||||
|
|
||||||
|
- name: Add Docker official GPG key
|
||||||
|
ansible.builtin.get_url:
|
||||||
|
url: https://download.docker.com/linux/ubuntu/gpg
|
||||||
|
dest: /etc/apt/keyrings/docker.asc
|
||||||
|
mode: "0644"
|
||||||
|
force: true
|
||||||
|
tags: [docker]
|
||||||
|
|
||||||
|
- name: Add Docker apt repository (deb822)
|
||||||
|
ansible.builtin.deb822_repository:
|
||||||
|
name: docker
|
||||||
|
types: [deb]
|
||||||
|
uris: https://download.docker.com/linux/ubuntu
|
||||||
|
suites: ["{{ ansible_distribution_release }}"]
|
||||||
|
components: [stable]
|
||||||
|
architectures: "{{ [ansible_architecture | replace('x86_64', 'amd64') | replace('aarch64', 'arm64')] }}"
|
||||||
|
signed_by: /etc/apt/keyrings/docker.asc
|
||||||
|
state: present
|
||||||
|
enabled: true
|
||||||
|
tags: [docker]
|
||||||
|
|
||||||
|
- name: Install Docker Engine + Compose plugin
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name: "{{ docker_packages }}"
|
||||||
|
state: present
|
||||||
|
update_cache: true
|
||||||
|
tags: [docker]
|
||||||
|
|
||||||
|
- name: Ensure docker group exists
|
||||||
|
ansible.builtin.group:
|
||||||
|
name: docker
|
||||||
|
state: present
|
||||||
|
tags: [docker]
|
||||||
|
|
||||||
|
- name: Configure Docker daemon.json
|
||||||
|
ansible.builtin.copy:
|
||||||
|
dest: /etc/docker/daemon.json
|
||||||
|
mode: "0644"
|
||||||
|
content: "{{ docker_daemon_json | to_nice_json }}\n"
|
||||||
|
notify: Restart docker
|
||||||
|
tags: [docker]
|
||||||
|
|
||||||
|
- name: Enable and start Docker (survives reboots)
|
||||||
|
ansible.builtin.systemd:
|
||||||
|
name: docker
|
||||||
|
state: started
|
||||||
|
enabled: true
|
||||||
|
tags: [docker]
|
||||||
|
|
||||||
|
- name: Enable containerd (Docker dependency)
|
||||||
|
ansible.builtin.systemd:
|
||||||
|
name: containerd
|
||||||
|
state: started
|
||||||
|
enabled: true
|
||||||
|
tags: [docker]
|
||||||
|
|
||||||
|
- name: Add stack user to docker / video / render groups
|
||||||
|
ansible.builtin.user:
|
||||||
|
name: "{{ stack_owner }}"
|
||||||
|
groups: "{{ extra_user_groups }}"
|
||||||
|
append: true
|
||||||
|
tags: [docker, users]
|
||||||
|
# Full permission setup also runs in the users role
|
||||||
|
|
||||||
|
- name: Verify docker works
|
||||||
|
ansible.builtin.command: docker version --format '{% raw %}{{.Server.Version}}{% endraw %}'
|
||||||
|
register: docker_ver
|
||||||
|
changed_when: false
|
||||||
|
tags: [docker]
|
||||||
|
|
||||||
|
- name: Show docker version
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "Docker server {{ docker_ver.stdout }}"
|
||||||
|
tags: [docker]
|
||||||
71
ansible/roles/firewall/tasks/main.yml
Normal file
71
ansible/roles/firewall/tasks/main.yml
Normal file
|
|
@ -0,0 +1,71 @@
|
||||||
|
---
|
||||||
|
- name: Install UFW
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name: ufw
|
||||||
|
state: present
|
||||||
|
tags: [firewall, ufw]
|
||||||
|
|
||||||
|
- name: Set UFW default policies
|
||||||
|
community.general.ufw:
|
||||||
|
direction: "{{ item.direction }}"
|
||||||
|
policy: "{{ item.policy }}"
|
||||||
|
loop:
|
||||||
|
- { direction: incoming, policy: "{{ ufw_default_incoming }}" }
|
||||||
|
- { direction: outgoing, policy: "{{ ufw_default_outgoing }}" }
|
||||||
|
tags: [firewall, ufw]
|
||||||
|
|
||||||
|
- name: Allow OpenSSH (rate-limited) from LAN
|
||||||
|
community.general.ufw:
|
||||||
|
rule: limit
|
||||||
|
port: "22"
|
||||||
|
proto: tcp
|
||||||
|
src: "{{ lan_subnet }}"
|
||||||
|
comment: "SSH from LAN"
|
||||||
|
tags: [firewall, ufw]
|
||||||
|
|
||||||
|
- name: Allow OpenSSH from anywhere (optional)
|
||||||
|
community.general.ufw:
|
||||||
|
rule: limit
|
||||||
|
port: "22"
|
||||||
|
proto: tcp
|
||||||
|
comment: "SSH world"
|
||||||
|
when: ufw_allow_ssh_from_anywhere | bool
|
||||||
|
tags: [firewall, ufw]
|
||||||
|
|
||||||
|
- name: Allow stack service ports from LAN
|
||||||
|
community.general.ufw:
|
||||||
|
rule: allow
|
||||||
|
port: "{{ item.port | string }}"
|
||||||
|
proto: tcp
|
||||||
|
src: "{{ lan_subnet }}"
|
||||||
|
comment: "{{ item.comment }}"
|
||||||
|
loop: "{{ ufw_lan_tcp_ports }}"
|
||||||
|
# SSH already handled above with limit; skip duplicate 22 if listed
|
||||||
|
when: item.port | int != 22
|
||||||
|
tags: [firewall, ufw]
|
||||||
|
|
||||||
|
- name: Allow Docker published ports on loopback freely (implicit)
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "UFW will leave local/docker internal traffic alone; LAN rules cover published WebUIs."
|
||||||
|
tags: [firewall, ufw]
|
||||||
|
|
||||||
|
# Docker + UFW: without this, published ports can bypass UFW on some setups.
|
||||||
|
# Route forwarded packets through ufw-before-forward is complex; we rely on
|
||||||
|
# binding services to LAN + ufw allow from lan_subnet. Documented in README.
|
||||||
|
|
||||||
|
- name: Enable UFW
|
||||||
|
community.general.ufw:
|
||||||
|
state: enabled
|
||||||
|
when: ufw_enabled | bool
|
||||||
|
tags: [firewall, ufw]
|
||||||
|
|
||||||
|
- name: Show UFW status
|
||||||
|
ansible.builtin.command: ufw status verbose
|
||||||
|
register: ufw_status
|
||||||
|
changed_when: false
|
||||||
|
tags: [firewall, ufw]
|
||||||
|
|
||||||
|
- name: Print UFW status
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "{{ ufw_status.stdout_lines }}"
|
||||||
|
tags: [firewall, ufw]
|
||||||
4
ansible/roles/stack/handlers/main.yml
Normal file
4
ansible/roles/stack/handlers/main.yml
Normal file
|
|
@ -0,0 +1,4 @@
|
||||||
|
---
|
||||||
|
- name: Reload systemd
|
||||||
|
ansible.builtin.systemd:
|
||||||
|
daemon_reload: true
|
||||||
207
ansible/roles/stack/tasks/main.yml
Normal file
207
ansible/roles/stack/tasks/main.yml
Normal file
|
|
@ -0,0 +1,207 @@
|
||||||
|
---
|
||||||
|
# Layout: compose + config under /opt/stack, media under /storage
|
||||||
|
|
||||||
|
- name: Ensure stack owner exists
|
||||||
|
ansible.builtin.user:
|
||||||
|
name: "{{ stack_owner }}"
|
||||||
|
state: present
|
||||||
|
shell: /bin/bash
|
||||||
|
create_home: true
|
||||||
|
tags: [stack]
|
||||||
|
|
||||||
|
- name: Create /opt/stack hierarchy
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "{{ item }}"
|
||||||
|
state: directory
|
||||||
|
owner: "{{ stack_owner }}"
|
||||||
|
group: "{{ stack_group }}"
|
||||||
|
mode: "0755"
|
||||||
|
loop:
|
||||||
|
- "{{ stack_root }}"
|
||||||
|
- "{{ config_dir }}"
|
||||||
|
- "{{ models_dir }}"
|
||||||
|
- "{{ workspace_dir }}"
|
||||||
|
- "{{ wireguard_dir }}"
|
||||||
|
- "{{ stack_root }}/ai"
|
||||||
|
- "{{ stack_root }}/scripts"
|
||||||
|
- "{{ stack_root }}/searxng"
|
||||||
|
- "{{ stack_root }}/ansible"
|
||||||
|
tags: [stack]
|
||||||
|
|
||||||
|
- name: Ensure storage root exists
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "{{ storage_root }}"
|
||||||
|
state: directory
|
||||||
|
owner: "{{ stack_owner }}"
|
||||||
|
group: "{{ stack_group }}"
|
||||||
|
mode: "0755"
|
||||||
|
tags: [stack, storage]
|
||||||
|
|
||||||
|
- name: Create media / torrent directories on /storage
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "{{ storage_root }}/{{ item }}"
|
||||||
|
state: directory
|
||||||
|
owner: "{{ stack_owner }}"
|
||||||
|
group: "{{ stack_group }}"
|
||||||
|
mode: "0755"
|
||||||
|
loop: "{{ media_subdirs }}"
|
||||||
|
tags: [stack, storage]
|
||||||
|
|
||||||
|
- name: Deploy stack files from control machine
|
||||||
|
ansible.posix.synchronize:
|
||||||
|
src: "{{ stack_src }}/"
|
||||||
|
dest: "{{ stack_root }}/"
|
||||||
|
delete: false
|
||||||
|
recursive: true
|
||||||
|
rsync_opts:
|
||||||
|
- "--exclude=.git"
|
||||||
|
- "--exclude=config/"
|
||||||
|
- "--exclude=data/"
|
||||||
|
- "--exclude=models/bonsai/*.gguf"
|
||||||
|
- "--exclude=*.partial"
|
||||||
|
- "--exclude=.env"
|
||||||
|
- "--exclude=wireguard/wg0.conf"
|
||||||
|
- "--exclude=ansible/.vault_pass"
|
||||||
|
when: deploy_stack_files | bool
|
||||||
|
become: false
|
||||||
|
tags: [stack, deploy]
|
||||||
|
|
||||||
|
- name: Fix ownership after rsync
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "{{ stack_root }}"
|
||||||
|
state: directory
|
||||||
|
owner: "{{ stack_owner }}"
|
||||||
|
group: "{{ stack_group }}"
|
||||||
|
recurse: true
|
||||||
|
when: deploy_stack_files | bool
|
||||||
|
tags: [stack, deploy]
|
||||||
|
|
||||||
|
- name: Deploy production .env for this host
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: env.j2
|
||||||
|
dest: "{{ stack_root }}/.env"
|
||||||
|
owner: "{{ stack_owner }}"
|
||||||
|
group: "{{ stack_group }}"
|
||||||
|
mode: "0600"
|
||||||
|
tags: [stack, env]
|
||||||
|
|
||||||
|
- name: Deploy WireGuard config if present on control machine
|
||||||
|
ansible.builtin.copy:
|
||||||
|
src: "{{ stack_src }}/wireguard/wg0.conf"
|
||||||
|
dest: "{{ wireguard_dir }}/wg0.conf"
|
||||||
|
owner: "{{ stack_owner }}"
|
||||||
|
group: "{{ stack_group }}"
|
||||||
|
mode: "0600"
|
||||||
|
when:
|
||||||
|
- deploy_stack_files | bool
|
||||||
|
ignore_errors: true
|
||||||
|
tags: [stack, wireguard]
|
||||||
|
|
||||||
|
- name: Note missing local wg0.conf
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: >-
|
||||||
|
Place wireguard/wg0.conf on the control machine (or copy to
|
||||||
|
{{ wireguard_dir }}/wg0.conf on the server) before starting gluetun.
|
||||||
|
tags: [stack, wireguard]
|
||||||
|
|
||||||
|
- name: Resolve host video group GID (for Docker group_add)
|
||||||
|
ansible.builtin.command: getent group video
|
||||||
|
register: getent_video
|
||||||
|
changed_when: false
|
||||||
|
failed_when: false
|
||||||
|
tags: [stack, compose, vulkan]
|
||||||
|
|
||||||
|
- name: Resolve host render group GID (for Docker group_add)
|
||||||
|
ansible.builtin.command: getent group render
|
||||||
|
register: getent_render
|
||||||
|
changed_when: false
|
||||||
|
failed_when: false
|
||||||
|
tags: [stack, compose, vulkan]
|
||||||
|
|
||||||
|
- name: Set video/render GID facts
|
||||||
|
ansible.builtin.set_fact:
|
||||||
|
video_gid: "{{ (getent_video.stdout.split(':')[2]) if getent_video.rc == 0 else '' }}"
|
||||||
|
render_gid: "{{ (getent_render.stdout.split(':')[2]) if getent_render.rc == 0 else '' }}"
|
||||||
|
tags: [stack, compose, vulkan]
|
||||||
|
|
||||||
|
- name: Write docker compose override for Vulkan / paths
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: docker-compose.override.yml.j2
|
||||||
|
dest: "{{ stack_root }}/docker-compose.override.yml"
|
||||||
|
owner: "{{ stack_owner }}"
|
||||||
|
group: "{{ stack_group }}"
|
||||||
|
mode: "0644"
|
||||||
|
tags: [stack, compose, vulkan]
|
||||||
|
|
||||||
|
- name: Loginctl linger for stack user (optional user services later)
|
||||||
|
ansible.builtin.command: loginctl enable-linger {{ stack_owner }}
|
||||||
|
changed_when: false
|
||||||
|
failed_when: false
|
||||||
|
tags: [stack]
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# Persist stack across reboots
|
||||||
|
# - Every service in docker-compose.yml uses restart: unless-stopped
|
||||||
|
# - Docker itself is enabled on boot (docker role)
|
||||||
|
# - This unit runs `docker compose up -d` after docker is ready
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
- name: "Assert all active compose services use restart: unless-stopped"
|
||||||
|
ansible.builtin.shell: |
|
||||||
|
set -euo pipefail
|
||||||
|
# Extract service-level restart policies (ignore comments)
|
||||||
|
bad=$(grep -E '^\s+restart:' "{{ stack_root }}/docker-compose.yml" \
|
||||||
|
| grep -v 'unless-stopped' \
|
||||||
|
| grep -v '^\s*#' || true)
|
||||||
|
if [ -n "$bad" ]; then
|
||||||
|
echo "Services missing restart: unless-stopped:"
|
||||||
|
echo "$bad"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
count=$(grep -cE '^\s+restart:\s*unless-stopped' "{{ stack_root }}/docker-compose.yml" || true)
|
||||||
|
echo "OK: $count service(s) with restart: unless-stopped"
|
||||||
|
args:
|
||||||
|
executable: /bin/bash
|
||||||
|
register: restart_policy_check
|
||||||
|
changed_when: false
|
||||||
|
tags: [stack, restart]
|
||||||
|
|
||||||
|
- name: Show restart policy check
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "{{ restart_policy_check.stdout }}"
|
||||||
|
tags: [stack, restart]
|
||||||
|
|
||||||
|
- name: Install systemd unit for arr-stack compose
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: arr-stack.service.j2
|
||||||
|
dest: /etc/systemd/system/arr-stack.service
|
||||||
|
mode: "0644"
|
||||||
|
when: stack_systemd_enable | bool
|
||||||
|
notify: Reload systemd
|
||||||
|
tags: [stack, restart, systemd]
|
||||||
|
|
||||||
|
- name: Enable arr-stack systemd unit (start on boot)
|
||||||
|
ansible.builtin.systemd:
|
||||||
|
name: arr-stack.service
|
||||||
|
enabled: true
|
||||||
|
daemon_reload: true
|
||||||
|
when: stack_systemd_enable | bool
|
||||||
|
tags: [stack, restart, systemd]
|
||||||
|
|
||||||
|
- name: Start arr-stack now (docker compose up -d)
|
||||||
|
ansible.builtin.systemd:
|
||||||
|
name: arr-stack.service
|
||||||
|
state: started
|
||||||
|
when: stack_systemd_enable | bool
|
||||||
|
# May fail on first run if images/model not ready — do not hard-fail bootstrap
|
||||||
|
failed_when: false
|
||||||
|
register: arr_stack_start
|
||||||
|
tags: [stack, restart, systemd]
|
||||||
|
|
||||||
|
- name: Report arr-stack service start result
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: >-
|
||||||
|
arr-stack.service:
|
||||||
|
{{ 'started/active' if (arr_stack_start is succeeded and not arr_stack_start.failed | default(false))
|
||||||
|
else 'enabled for boot; start deferred (build images / download model first, then: sudo systemctl start arr-stack)' }}
|
||||||
|
when: stack_systemd_enable | bool
|
||||||
|
tags: [stack, restart, systemd]
|
||||||
23
ansible/roles/stack/templates/arr-stack.service.j2
Normal file
23
ansible/roles/stack/templates/arr-stack.service.j2
Normal file
|
|
@ -0,0 +1,23 @@
|
||||||
|
[Unit]
|
||||||
|
Description=arr-stack Docker Compose services
|
||||||
|
Documentation=file://{{ stack_root }}/README.md
|
||||||
|
Requires=docker.service
|
||||||
|
After=docker.service network-online.target
|
||||||
|
Wants=network-online.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=oneshot
|
||||||
|
RemainAfterExit=yes
|
||||||
|
User={{ stack_owner }}
|
||||||
|
Group={{ stack_group }}
|
||||||
|
WorkingDirectory={{ stack_root }}
|
||||||
|
Environment=HOME=/home/{{ stack_owner }}
|
||||||
|
# All compose services use restart: unless-stopped; this unit brings the stack
|
||||||
|
# up after boot / docker restarts.
|
||||||
|
ExecStart=/usr/bin/docker compose {% if stack_compose_profiles | length > 0 %}--profile {{ stack_compose_profiles | join(' --profile ') }} {% endif %}up -d --remove-orphans
|
||||||
|
ExecStop=/usr/bin/docker compose stop
|
||||||
|
TimeoutStartSec=0
|
||||||
|
TimeoutStopSec=120
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
29
ansible/roles/stack/templates/docker-compose.override.yml.j2
Normal file
29
ansible/roles/stack/templates/docker-compose.override.yml.j2
Normal file
|
|
@ -0,0 +1,29 @@
|
||||||
|
# Generated by Ansible — merges with docker-compose.yml
|
||||||
|
# group_add uses numeric host GIDs (names fail inside Ubuntu base images).
|
||||||
|
|
||||||
|
services:
|
||||||
|
{% if bonsai_backend == "vulkan" %}
|
||||||
|
bonsai:
|
||||||
|
devices:
|
||||||
|
- /dev/dri:/dev/dri
|
||||||
|
{% if video_gid is defined and video_gid | length > 0 %}
|
||||||
|
group_add:
|
||||||
|
- "{{ video_gid }}"
|
||||||
|
{% if render_gid is defined and render_gid | length > 0 %}
|
||||||
|
- "{{ render_gid }}"
|
||||||
|
{% endif %}
|
||||||
|
{% endif %}
|
||||||
|
environment:
|
||||||
|
NGL: "{{ bonsai_ngl }}"
|
||||||
|
{% endif %}
|
||||||
|
|
||||||
|
jellyfin:
|
||||||
|
devices:
|
||||||
|
- /dev/dri:/dev/dri
|
||||||
|
{% if video_gid is defined and video_gid | length > 0 %}
|
||||||
|
group_add:
|
||||||
|
- "{{ video_gid }}"
|
||||||
|
{% if render_gid is defined and render_gid | length > 0 %}
|
||||||
|
- "{{ render_gid }}"
|
||||||
|
{% endif %}
|
||||||
|
{% endif %}
|
||||||
41
ansible/roles/stack/templates/env.j2
Normal file
41
ansible/roles/stack/templates/env.j2
Normal file
|
|
@ -0,0 +1,41 @@
|
||||||
|
# Generated by Ansible for {{ inventory_hostname }} — do not commit
|
||||||
|
# Host: {{ ansible_host | default(inventory_hostname) }}
|
||||||
|
|
||||||
|
PUID={{ ansible_user_uid | default(1000) }}
|
||||||
|
PGID={{ ansible_user_gid | default(1000) }}
|
||||||
|
TZ={{ timezone }}
|
||||||
|
|
||||||
|
CONFIG_DIR={{ config_dir }}
|
||||||
|
DATA_DIR={{ data_dir }}
|
||||||
|
LAN_SUBNET={{ lan_subnet }}
|
||||||
|
|
||||||
|
# --- AI (Ternary-Bonsai + Vulkan on SER5) ---
|
||||||
|
BONSAI_MODELS_DIR={{ models_dir }}
|
||||||
|
BONSAI_MODEL_PATH=/models/Ternary-Bonsai-27B-Q2_0.gguf
|
||||||
|
BONSAI_BACKEND={{ bonsai_backend }}
|
||||||
|
BONSAI_NGL={{ bonsai_ngl }}
|
||||||
|
BONSAI_CTX={{ bonsai_ctx }}
|
||||||
|
BONSAI_KV4={{ bonsai_kv4 }}
|
||||||
|
BONSAI_THREADS={{ bonsai_threads }}
|
||||||
|
BONSAI_TEMP=0.7
|
||||||
|
BONSAI_TOP_P=0.95
|
||||||
|
BONSAI_TOP_K=20
|
||||||
|
BONSAI_PORT=8081
|
||||||
|
|
||||||
|
OPEN_WEBUI_PORT=3000
|
||||||
|
OPENAI_API_KEY=sk-local-bonsai
|
||||||
|
WEBUI_AUTH={{ open_webui_auth }}
|
||||||
|
AI_WORKSPACE_DIR={{ workspace_dir }}
|
||||||
|
|
||||||
|
SEARXNG_PORT=8888
|
||||||
|
SEARXNG_SECRET={{ lookup('password', playbook_dir + '/.secrets/searxng_secret chars=ascii_letters,digits length=48') }}
|
||||||
|
|
||||||
|
OPENHANDS_PORT=3001
|
||||||
|
OPENHANDS_MODEL=openai/local
|
||||||
|
|
||||||
|
# Forgejo (self-hosted Git)
|
||||||
|
FORGEJO_HTTP_PORT={{ forgejo_http_port }}
|
||||||
|
FORGEJO_SSH_PORT={{ forgejo_ssh_port }}
|
||||||
|
FORGEJO_DOMAIN={{ forgejo_domain }}
|
||||||
|
FORGEJO_ROOT_URL={{ forgejo_root_url }}
|
||||||
|
FORGEJO_DISABLE_REGISTRATION=false
|
||||||
6
ansible/roles/users/handlers/main.yml
Normal file
6
ansible/roles/users/handlers/main.yml
Normal file
|
|
@ -0,0 +1,6 @@
|
||||||
|
---
|
||||||
|
- name: Reload udev
|
||||||
|
ansible.builtin.shell: |
|
||||||
|
udevadm control --reload-rules
|
||||||
|
udevadm trigger
|
||||||
|
changed_when: true
|
||||||
171
ansible/roles/users/tasks/main.yml
Normal file
171
ansible/roles/users/tasks/main.yml
Normal file
|
|
@ -0,0 +1,171 @@
|
||||||
|
---
|
||||||
|
# Local homelab operator account — broad permissions (LAN-trusted host)
|
||||||
|
|
||||||
|
- name: Ensure stack user exists with bash shell
|
||||||
|
ansible.builtin.user:
|
||||||
|
name: "{{ stack_owner }}"
|
||||||
|
state: present
|
||||||
|
shell: /bin/bash
|
||||||
|
create_home: true
|
||||||
|
groups: "{{ extra_user_groups }}"
|
||||||
|
append: true
|
||||||
|
tags: [users, permissions]
|
||||||
|
|
||||||
|
- name: Ensure useful system groups exist (create if missing)
|
||||||
|
ansible.builtin.group:
|
||||||
|
name: "{{ item }}"
|
||||||
|
state: present
|
||||||
|
loop: "{{ extra_user_groups }}"
|
||||||
|
failed_when: false
|
||||||
|
tags: [users, permissions]
|
||||||
|
|
||||||
|
- name: Add stack user to all useful groups
|
||||||
|
ansible.builtin.user:
|
||||||
|
name: "{{ stack_owner }}"
|
||||||
|
groups: "{{ extra_user_groups }}"
|
||||||
|
append: true
|
||||||
|
tags: [users, permissions]
|
||||||
|
|
||||||
|
- name: Passwordless sudo for stack user (full admin)
|
||||||
|
ansible.builtin.copy:
|
||||||
|
dest: "/etc/sudoers.d/{{ stack_owner }}"
|
||||||
|
mode: "0440"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
validate: "visudo -cf %s"
|
||||||
|
content: |
|
||||||
|
# Homelab operator — passwordless sudo (local trusted host)
|
||||||
|
{{ stack_owner }} ALL=(ALL) NOPASSWD:ALL
|
||||||
|
Defaults:{{ stack_owner }} !env_reset
|
||||||
|
Defaults:{{ stack_owner }} secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"
|
||||||
|
tags: [users, permissions, sudo]
|
||||||
|
|
||||||
|
- name: Allow stack user to manage Docker and arr-stack via systemctl without password
|
||||||
|
ansible.builtin.copy:
|
||||||
|
dest: "/etc/sudoers.d/{{ stack_owner }}-services"
|
||||||
|
mode: "0440"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
validate: "visudo -cf %s"
|
||||||
|
content: |
|
||||||
|
# Redundant with NOPASSWD:ALL; kept explicit for clarity if sudo is tightened later
|
||||||
|
{{ stack_owner }} ALL=(root) NOPASSWD: /bin/systemctl * docker*, /bin/systemctl * containerd*, /bin/systemctl * arr-stack*, /usr/bin/systemctl * docker*, /usr/bin/systemctl * containerd*, /usr/bin/systemctl * arr-stack*
|
||||||
|
tags: [users, permissions, sudo]
|
||||||
|
|
||||||
|
- name: Install ACL tools
|
||||||
|
ansible.builtin.apt:
|
||||||
|
name: acl
|
||||||
|
state: present
|
||||||
|
tags: [users, permissions]
|
||||||
|
|
||||||
|
- name: Own stack and storage roots
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "{{ item }}"
|
||||||
|
state: directory
|
||||||
|
owner: "{{ stack_owner }}"
|
||||||
|
group: "{{ stack_group }}"
|
||||||
|
mode: "0775"
|
||||||
|
loop:
|
||||||
|
- "{{ stack_root }}"
|
||||||
|
- "{{ storage_root }}"
|
||||||
|
tags: [users, permissions]
|
||||||
|
|
||||||
|
- name: Recursive ownership of stack tree
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "{{ stack_root }}"
|
||||||
|
state: directory
|
||||||
|
owner: "{{ stack_owner }}"
|
||||||
|
group: "{{ stack_group }}"
|
||||||
|
recurse: true
|
||||||
|
tags: [users, permissions]
|
||||||
|
|
||||||
|
- name: Recursive ownership of storage tree
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: "{{ storage_root }}"
|
||||||
|
state: directory
|
||||||
|
owner: "{{ stack_owner }}"
|
||||||
|
group: "{{ stack_group }}"
|
||||||
|
recurse: true
|
||||||
|
# Large trees: may take a moment; safe to re-run
|
||||||
|
tags: [users, permissions]
|
||||||
|
|
||||||
|
- name: Default ACLs so new files under stack stay group-writable
|
||||||
|
ansible.builtin.command: >
|
||||||
|
setfacl -R -d -m u:{{ stack_owner }}:rwx,g:{{ stack_group }}:rwx,o::r-x {{ item }}
|
||||||
|
loop:
|
||||||
|
- "{{ stack_root }}"
|
||||||
|
- "{{ storage_root }}"
|
||||||
|
changed_when: true
|
||||||
|
failed_when: false
|
||||||
|
tags: [users, permissions]
|
||||||
|
|
||||||
|
- name: Current ACLs for stack owner full access
|
||||||
|
ansible.builtin.command: >
|
||||||
|
setfacl -R -m u:{{ stack_owner }}:rwx,g:{{ stack_group }}:rwx {{ item }}
|
||||||
|
loop:
|
||||||
|
- "{{ stack_root }}"
|
||||||
|
- "{{ storage_root }}"
|
||||||
|
changed_when: true
|
||||||
|
failed_when: false
|
||||||
|
tags: [users, permissions]
|
||||||
|
|
||||||
|
- name: Discover DRM nodes for permission tweak
|
||||||
|
ansible.builtin.find:
|
||||||
|
paths: /dev/dri
|
||||||
|
patterns: "*"
|
||||||
|
file_type: any
|
||||||
|
register: dri_nodes
|
||||||
|
failed_when: false
|
||||||
|
tags: [users, permissions, gpu]
|
||||||
|
|
||||||
|
- name: Make /dev/dri nodes world-accessible (trusted local host)
|
||||||
|
ansible.builtin.shell: |
|
||||||
|
set -e
|
||||||
|
if [ -d /dev/dri ]; then
|
||||||
|
chmod a+rw /dev/dri/* 2>/dev/null || true
|
||||||
|
ls -la /dev/dri
|
||||||
|
fi
|
||||||
|
register: dri_chmod
|
||||||
|
changed_when: "'rw' in dri_chmod.stdout"
|
||||||
|
failed_when: false
|
||||||
|
tags: [users, permissions, gpu]
|
||||||
|
|
||||||
|
- name: Persist permissive DRM udev rule for trusted host
|
||||||
|
ansible.builtin.copy:
|
||||||
|
dest: /etc/udev/rules.d/99-homelab-dri-permissive.rules
|
||||||
|
mode: "0644"
|
||||||
|
content: |
|
||||||
|
# Trusted LAN homelab — allow any user/container access to GPU nodes
|
||||||
|
KERNEL=="renderD*", MODE="0666"
|
||||||
|
KERNEL=="card*", MODE="0666"
|
||||||
|
KERNEL=="controlD*", MODE="0666"
|
||||||
|
notify: Reload udev
|
||||||
|
tags: [users, permissions, gpu]
|
||||||
|
|
||||||
|
- name: Ensure docker socket is group-writable for docker group
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: /var/run/docker.sock
|
||||||
|
group: docker
|
||||||
|
mode: "0660"
|
||||||
|
failed_when: false
|
||||||
|
tags: [users, permissions, docker]
|
||||||
|
|
||||||
|
- name: Verify stack user can sudo without password
|
||||||
|
become: true
|
||||||
|
become_user: "{{ stack_owner }}"
|
||||||
|
ansible.builtin.command: sudo -n true
|
||||||
|
changed_when: false
|
||||||
|
tags: [users, permissions]
|
||||||
|
|
||||||
|
- name: Show stack user identity and groups
|
||||||
|
become: true
|
||||||
|
become_user: "{{ stack_owner }}"
|
||||||
|
ansible.builtin.command: id
|
||||||
|
register: stack_user_id
|
||||||
|
changed_when: false
|
||||||
|
tags: [users, permissions]
|
||||||
|
|
||||||
|
- name: Report stack user permissions
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: "{{ stack_user_id.stdout }}"
|
||||||
|
tags: [users, permissions]
|
||||||
69
ansible/site.yml
Normal file
69
ansible/site.yml
Normal file
|
|
@ -0,0 +1,69 @@
|
||||||
|
---
|
||||||
|
# Bootstrap Ubuntu Server 24.04 headless host for arr-stack + local AI (Vulkan)
|
||||||
|
#
|
||||||
|
# Usage (from this directory):
|
||||||
|
# ansible-galaxy collection install -r requirements.yml
|
||||||
|
# ansible-playbook site.yml -l ser5
|
||||||
|
#
|
||||||
|
# Tags: common, docker, amd, vulkan, firewall, stack, upgrade, deploy
|
||||||
|
|
||||||
|
- name: Prepare homelab host
|
||||||
|
hosts: homelab
|
||||||
|
gather_facts: true
|
||||||
|
become: true
|
||||||
|
|
||||||
|
pre_tasks:
|
||||||
|
- name: Verify target is Ubuntu
|
||||||
|
ansible.builtin.assert:
|
||||||
|
that:
|
||||||
|
- ansible_distribution == "Ubuntu"
|
||||||
|
- ansible_distribution_major_version is version('24', '>=')
|
||||||
|
fail_msg: "This playbook targets Ubuntu 24.04+. Found {{ ansible_distribution }} {{ ansible_distribution_version }}"
|
||||||
|
tags: [always]
|
||||||
|
|
||||||
|
- name: Resolve stack user uid/gid
|
||||||
|
ansible.builtin.getent:
|
||||||
|
database: passwd
|
||||||
|
key: "{{ stack_owner }}"
|
||||||
|
tags: [always]
|
||||||
|
|
||||||
|
- name: Set PUID/PGID facts from passwd
|
||||||
|
ansible.builtin.set_fact:
|
||||||
|
ansible_user_uid: "{{ getent_passwd[stack_owner][1] }}"
|
||||||
|
ansible_user_gid: "{{ getent_passwd[stack_owner][2] }}"
|
||||||
|
tags: [always]
|
||||||
|
|
||||||
|
roles:
|
||||||
|
- role: common
|
||||||
|
tags: [common]
|
||||||
|
- role: docker
|
||||||
|
tags: [docker]
|
||||||
|
- role: amd_vulkan
|
||||||
|
tags: [amd, vulkan, gpu]
|
||||||
|
- role: firewall
|
||||||
|
tags: [firewall]
|
||||||
|
- role: stack
|
||||||
|
tags: [stack]
|
||||||
|
# After stack paths exist — ownership, sudo, groups, GPU nodes
|
||||||
|
- role: users
|
||||||
|
tags: [users, permissions]
|
||||||
|
|
||||||
|
post_tasks:
|
||||||
|
- name: Summary
|
||||||
|
ansible.builtin.debug:
|
||||||
|
msg: |
|
||||||
|
Host ready: {{ inventory_hostname }} ({{ ansible_host }})
|
||||||
|
Stack root: {{ stack_root }} (owned by {{ stack_owner }})
|
||||||
|
Media root: {{ storage_root }} (owned by {{ stack_owner }})
|
||||||
|
User: {{ stack_owner }} — passwordless sudo, docker/video/render/…
|
||||||
|
Docker: enabled on boot
|
||||||
|
Vulkan: Mesa packages + permissive /dev/dri udev (trusted host)
|
||||||
|
Firewall: UFW LAN {{ lan_subnet }}
|
||||||
|
|
||||||
|
Next on the server (re-login once for groups):
|
||||||
|
cd {{ stack_root }}
|
||||||
|
docker compose build bonsai && docker compose up -d
|
||||||
|
|
||||||
|
Open WebUI: http://{{ ansible_host }}:3000
|
||||||
|
Jellyfin: http://{{ ansible_host }}:8096
|
||||||
|
tags: [always]
|
||||||
22
docker-compose.override.yml
Normal file
22
docker-compose.override.yml
Normal file
|
|
@ -0,0 +1,22 @@
|
||||||
|
# GPU access for Vulkan (bonsai) + VA-API (jellyfin).
|
||||||
|
#
|
||||||
|
# Do NOT use group names like "video"/"render" here — Docker resolves them
|
||||||
|
# inside the container image, which often has no "render" group and fails with:
|
||||||
|
# unable to find group render: no matching entries in group file
|
||||||
|
#
|
||||||
|
# Options:
|
||||||
|
# A) Rely on host /dev/dri being 0666 (Ansible users role udev rule) — no group_add.
|
||||||
|
# B) Use numeric host GIDs: getent group video render
|
||||||
|
#
|
||||||
|
# Ansible regenerates this file with host GIDs when you run the stack role.
|
||||||
|
|
||||||
|
services:
|
||||||
|
bonsai:
|
||||||
|
devices:
|
||||||
|
- /dev/dri:/dev/dri
|
||||||
|
environment:
|
||||||
|
NGL: "99"
|
||||||
|
|
||||||
|
jellyfin:
|
||||||
|
devices:
|
||||||
|
- /dev/dri:/dev/dri
|
||||||
372
docker-compose.yml
Normal file
372
docker-compose.yml
Normal file
|
|
@ -0,0 +1,372 @@
|
||||||
|
name: arr-stack
|
||||||
|
|
||||||
|
################################################################################
|
||||||
|
# Arr stack
|
||||||
|
# gluetun WireGuard VPN client + firewall killswitch
|
||||||
|
# qbittorrent torrent client, lives INSIDE gluetun's network namespace
|
||||||
|
# prowlarr indexer manager
|
||||||
|
# sonarr TV radarr movies bazarr subtitles
|
||||||
|
# jellyfin media server
|
||||||
|
#
|
||||||
|
# AI / coding stack (local, no VPN)
|
||||||
|
# bonsai Prism Ternary-Bonsai-27B via llama-server (OpenAI-compatible API)
|
||||||
|
# open-webui Chat UI + RAG + tools + code interpreter
|
||||||
|
# searxng Private metasearch for web RAG
|
||||||
|
# forgejo Self-hosted Git (repos for coding + OpenHands)
|
||||||
|
# openhands Optional autonomous coding agent (profile: coding)
|
||||||
|
#
|
||||||
|
# Lockdown model:
|
||||||
|
# * qbittorrent uses `network_mode: service:gluetun` -> it has NO network
|
||||||
|
# interface of its own. Every packet it sends/receives goes through
|
||||||
|
# gluetun, and gluetun's built-in firewall only lets traffic out via the
|
||||||
|
# WireGuard tunnel. Tunnel down = zero connectivity. No leaks possible.
|
||||||
|
# * Do NOT publish qBittorrent's BitTorrent listening port on the host -
|
||||||
|
# inbound peer connections must come through the tunnel (port forwarding),
|
||||||
|
# never via your real IP.
|
||||||
|
# * AI services stay on arr-net (LAN only). They do NOT route through gluetun.
|
||||||
|
################################################################################
|
||||||
|
|
||||||
|
networks:
|
||||||
|
arr-net:
|
||||||
|
driver: bridge
|
||||||
|
|
||||||
|
services:
|
||||||
|
|
||||||
|
# ------------------------------------------------------------- VPN gateway #
|
||||||
|
gluetun:
|
||||||
|
image: qmcgaw/gluetun:v3
|
||||||
|
container_name: gluetun
|
||||||
|
restart: unless-stopped
|
||||||
|
cap_add:
|
||||||
|
- NET_ADMIN
|
||||||
|
devices:
|
||||||
|
- /dev/net/tun:/dev/net/tun
|
||||||
|
networks:
|
||||||
|
- arr-net
|
||||||
|
ports:
|
||||||
|
# Ports for anything running inside gluetun's namespace are published
|
||||||
|
# HERE, on gluetun - not on the inner container.
|
||||||
|
- 8080:8080/tcp # qBittorrent WebUI
|
||||||
|
volumes:
|
||||||
|
# Your provider's WireGuard config, renamed to wg0.conf
|
||||||
|
# (see wireguard/wg0.conf.example and the README for required edits)
|
||||||
|
- ./wireguard/wg0.conf:/gluetun/wireguard/wg0.conf:ro
|
||||||
|
environment:
|
||||||
|
VPN_SERVICE_PROVIDER: custom
|
||||||
|
VPN_TYPE: wireguard
|
||||||
|
TZ: ${TZ}
|
||||||
|
# Lets your LAN reach the qBittorrent WebUI through gluetun's firewall
|
||||||
|
FIREWALL_OUTBOUND_SUBNETS: ${LAN_SUBNET}
|
||||||
|
# --- optional: provider port forwarding (better swarm connectivity) ---
|
||||||
|
# FIREWALL_VPN_INPUT_PORTS: "12345" # port your provider assigned you
|
||||||
|
# VPN_PORT_FORWARDING: "on" # for providers with NAT-PMP API
|
||||||
|
# VPN_PORT_FORWARDING_PROVIDER: protonvpn
|
||||||
|
|
||||||
|
# --------------------------------------------------------- torrent client #
|
||||||
|
qbittorrent:
|
||||||
|
image: lscr.io/linuxserver/qbittorrent:latest
|
||||||
|
container_name: qbittorrent
|
||||||
|
restart: unless-stopped
|
||||||
|
network_mode: service:gluetun # <-- the entire isolation trick
|
||||||
|
depends_on:
|
||||||
|
gluetun:
|
||||||
|
condition: service_healthy # start only once the tunnel is up
|
||||||
|
environment:
|
||||||
|
PUID: ${PUID}
|
||||||
|
PGID: ${PGID}
|
||||||
|
TZ: ${TZ}
|
||||||
|
WEBUI_PORT: "8080"
|
||||||
|
volumes:
|
||||||
|
- ${CONFIG_DIR}/qbittorrent:/config
|
||||||
|
- ${DATA_DIR}:/data # single shared tree -> hardlinks
|
||||||
|
|
||||||
|
# -------------------------------------------------------------- indexers #
|
||||||
|
prowlarr:
|
||||||
|
image: lscr.io/linuxserver/prowlarr:latest
|
||||||
|
container_name: prowlarr
|
||||||
|
restart: unless-stopped
|
||||||
|
networks: [arr-net]
|
||||||
|
ports:
|
||||||
|
- 9696:9696
|
||||||
|
environment: &arr-env
|
||||||
|
PUID: ${PUID}
|
||||||
|
PGID: ${PGID}
|
||||||
|
TZ: ${TZ}
|
||||||
|
volumes:
|
||||||
|
- ${CONFIG_DIR}/prowlarr:/config
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------- TV #
|
||||||
|
sonarr:
|
||||||
|
image: lscr.io/linuxserver/sonarr:latest
|
||||||
|
container_name: sonarr
|
||||||
|
restart: unless-stopped
|
||||||
|
networks: [arr-net]
|
||||||
|
ports:
|
||||||
|
- 8989:8989
|
||||||
|
environment: *arr-env
|
||||||
|
volumes:
|
||||||
|
- ${CONFIG_DIR}/sonarr:/config
|
||||||
|
- ${DATA_DIR}:/data
|
||||||
|
|
||||||
|
# ----------------------------------------------------------------- movies #
|
||||||
|
radarr:
|
||||||
|
image: lscr.io/linuxserver/radarr:latest
|
||||||
|
container_name: radarr
|
||||||
|
restart: unless-stopped
|
||||||
|
networks: [arr-net]
|
||||||
|
ports:
|
||||||
|
- 7878:7878
|
||||||
|
environment: *arr-env
|
||||||
|
volumes:
|
||||||
|
- ${CONFIG_DIR}/radarr:/config
|
||||||
|
- ${DATA_DIR}:/data
|
||||||
|
|
||||||
|
# -------------------------------------------------------------- subtitles #
|
||||||
|
bazarr:
|
||||||
|
image: lscr.io/linuxserver/bazarr:latest
|
||||||
|
container_name: bazarr
|
||||||
|
restart: unless-stopped
|
||||||
|
networks: [arr-net]
|
||||||
|
ports:
|
||||||
|
- 6767:6767
|
||||||
|
environment: *arr-env
|
||||||
|
volumes:
|
||||||
|
- ${CONFIG_DIR}/bazarr:/config
|
||||||
|
- ${DATA_DIR}:/data
|
||||||
|
|
||||||
|
# ----------------------------------------------------------- media server #
|
||||||
|
jellyfin:
|
||||||
|
image: lscr.io/linuxserver/jellyfin:latest
|
||||||
|
container_name: jellyfin
|
||||||
|
restart: unless-stopped
|
||||||
|
networks: [arr-net]
|
||||||
|
ports:
|
||||||
|
- 8096:8096/tcp # web UI / clients
|
||||||
|
# - 8920:8920/tcp # optional HTTPS
|
||||||
|
# - 7359:7359/udp # optional client autodiscovery
|
||||||
|
environment: *arr-env
|
||||||
|
volumes:
|
||||||
|
- ${CONFIG_DIR}/jellyfin:/config
|
||||||
|
- ${DATA_DIR}/media:/data/media:ro # read-only: Jellyfin never touches files
|
||||||
|
# --- optional: Intel QuickSync hardware transcoding --- (Unused on this AMD machine)
|
||||||
|
# devices:
|
||||||
|
# - /dev/dri:/dev/dri
|
||||||
|
|
||||||
|
# ------------------------------------------------------------------- music #
|
||||||
|
lidarr:
|
||||||
|
image: lscr.io/linuxserver/lidarr:latest
|
||||||
|
container_name: lidarr
|
||||||
|
restart: unless-stopped
|
||||||
|
networks: [arr-net]
|
||||||
|
ports:
|
||||||
|
- 8686:8686
|
||||||
|
environment: *arr-env
|
||||||
|
volumes:
|
||||||
|
- ${CONFIG_DIR}/lidarr:/config
|
||||||
|
- ${DATA_DIR}:/data # same /data tree as Sonarr/Radarr
|
||||||
|
|
||||||
|
# ==========================================================================
|
||||||
|
# Optional media extras - uncomment as needed
|
||||||
|
# ==========================================================================
|
||||||
|
#
|
||||||
|
# jellyseerr: # request UI for Jellyfin
|
||||||
|
# image: fallenbagel/jellyseerr:latest
|
||||||
|
# container_name: jellyseerr
|
||||||
|
# restart: unless-stopped
|
||||||
|
# networks: [arr-net]
|
||||||
|
# ports: ["5055:5055"]
|
||||||
|
# environment: *arr-env
|
||||||
|
# volumes:
|
||||||
|
# - ${CONFIG_DIR}/jellyseerr:/app/config
|
||||||
|
|
||||||
|
# ==========================================================================
|
||||||
|
# Local AI — Ternary-Bonsai-27B + Open WebUI + RAG + coding helpers
|
||||||
|
# Target: Beelink SER5 PRO (Ryzen 7 7735HS + Radeon 680M, no NVIDIA)
|
||||||
|
# ==========================================================================
|
||||||
|
|
||||||
|
# OpenAI-compatible API for Ternary-Bonsai-27B (PrismML Q2_0 GGUF)
|
||||||
|
# First: ./scripts/download-bonsai-model.sh
|
||||||
|
# Then: docker compose up -d --build bonsai open-webui searxng
|
||||||
|
bonsai:
|
||||||
|
build:
|
||||||
|
context: ./ai
|
||||||
|
dockerfile: Dockerfile
|
||||||
|
args:
|
||||||
|
# cpu = reliable default on SER5 PRO
|
||||||
|
# vulkan = try Radeon 680M offload (also set NGL=99 and uncomment devices)
|
||||||
|
BONSAI_BACKEND: ${BONSAI_BACKEND:-vulkan}
|
||||||
|
image: arr-stack/bonsai:local
|
||||||
|
container_name: bonsai
|
||||||
|
restart: unless-stopped
|
||||||
|
networks: [arr-net]
|
||||||
|
ports:
|
||||||
|
- "${BONSAI_PORT:-8081}:8080" # avoid clash with qBittorrent :8080
|
||||||
|
environment:
|
||||||
|
TZ: ${TZ}
|
||||||
|
MODEL_PATH: ${BONSAI_MODEL_PATH:-/models/Ternary-Bonsai-27B-Q2_0.gguf}
|
||||||
|
# 0 = CPU (recommended start). Vulkan image: try 99 with /dev/dri mounted.
|
||||||
|
NGL: ${BONSAI_NGL:-99}
|
||||||
|
# 16k is a good default on 32–64 GB systems with media stack co-resident.
|
||||||
|
# Long docs / full-repo: try 32768 or 65536; enable KV4=1 if RAM is tight.
|
||||||
|
CTX_SIZE: ${BONSAI_CTX:-16384}
|
||||||
|
TEMP: ${BONSAI_TEMP:-0.7}
|
||||||
|
TOP_P: ${BONSAI_TOP_P:-0.95}
|
||||||
|
TOP_K: ${BONSAI_TOP_K:-20}
|
||||||
|
# 0 = auto; or set to physical cores (e.g. 8 on 7735HS) leaving some for Arrs
|
||||||
|
THREADS: ${BONSAI_THREADS:-0}
|
||||||
|
KV4: ${BONSAI_KV4:-0}
|
||||||
|
EXTRA_ARGS: ${BONSAI_EXTRA_ARGS:-}
|
||||||
|
volumes:
|
||||||
|
- ${BONSAI_MODELS_DIR:-./models/bonsai}:/models:ro
|
||||||
|
# Shared memory helps large context / mmap
|
||||||
|
shm_size: "4gb"
|
||||||
|
# Vulkan / AMD iGPU: devices + group_add live ONLY in
|
||||||
|
# docker-compose.override.yml (Compose merges lists and rejects duplicates).
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8080/health"]
|
||||||
|
interval: 30s
|
||||||
|
timeout: 10s
|
||||||
|
start_period: 180s
|
||||||
|
retries: 5
|
||||||
|
|
||||||
|
# ChatGPT-style UI with built-in RAG, tools, and code interpreter
|
||||||
|
open-webui:
|
||||||
|
image: ghcr.io/open-webui/open-webui:main
|
||||||
|
container_name: open-webui
|
||||||
|
restart: unless-stopped
|
||||||
|
networks: [arr-net]
|
||||||
|
ports:
|
||||||
|
- "${OPEN_WEBUI_PORT:-3000}:8080"
|
||||||
|
depends_on:
|
||||||
|
bonsai:
|
||||||
|
condition: service_healthy
|
||||||
|
searxng:
|
||||||
|
condition: service_started
|
||||||
|
environment:
|
||||||
|
TZ: ${TZ}
|
||||||
|
# Point at local llama-server (OpenAI-compatible)
|
||||||
|
OPENAI_API_BASE_URL: http://bonsai:8080/v1
|
||||||
|
OPENAI_API_KEY: ${OPENAI_API_KEY:-sk-local-bonsai}
|
||||||
|
# Disable Ollama unless you add it later
|
||||||
|
ENABLE_OLLAMA_API: "false"
|
||||||
|
# First account becomes admin; set WEBUI_AUTH=false only on trusted LAN
|
||||||
|
WEBUI_AUTH: ${WEBUI_AUTH:-true}
|
||||||
|
# RAG: local embeddings run inside open-webui (downloads on first use)
|
||||||
|
RAG_EMBEDDING_ENGINE: ${RAG_EMBEDDING_ENGINE:-}
|
||||||
|
CHUNK_SIZE: ${RAG_CHUNK_SIZE:-1000}
|
||||||
|
CHUNK_OVERLAP: ${RAG_CHUNK_OVERLAP:-100}
|
||||||
|
# Web search via local SearXNG
|
||||||
|
ENABLE_RAG_WEB_SEARCH: "true"
|
||||||
|
ENABLE_SEARCH_QUERY: "true"
|
||||||
|
RAG_WEB_SEARCH_ENGINE: searxng
|
||||||
|
SEARXNG_QUERY_URL: http://searxng:8080/search?q=<query>
|
||||||
|
# Allow fetching internal / LAN URLs for RAG (homelab docs)
|
||||||
|
ENABLE_RAG_LOCAL_WEB_FETCH: "true"
|
||||||
|
# Code interpreter (runs in open-webui sandbox)
|
||||||
|
ENABLE_CODE_INTERPRETER: "true"
|
||||||
|
# Reduce background LLM spam on a single local model
|
||||||
|
ENABLE_TITLE_GENERATION: "false"
|
||||||
|
ENABLE_FOLLOW_UP_GENERATION: "false"
|
||||||
|
ENABLE_TAGS_GENERATION: "false"
|
||||||
|
# Default model id as reported by llama-server /v1/models
|
||||||
|
DEFAULT_MODELS: ${OPENWEBUI_DEFAULT_MODEL:-}
|
||||||
|
volumes:
|
||||||
|
- ${CONFIG_DIR}/open-webui:/app/backend/data
|
||||||
|
# Your local files for RAG / "read my project" workflows
|
||||||
|
- ${AI_WORKSPACE_DIR:-./workspace}:/workspace:ro
|
||||||
|
# Optional: expose media library read-only for Q&A about your library tree
|
||||||
|
# - ${DATA_DIR}/media:/media:ro
|
||||||
|
extra_hosts:
|
||||||
|
- "host.docker.internal:host-gateway"
|
||||||
|
|
||||||
|
# Private metasearch (no API keys) for Open WebUI web RAG
|
||||||
|
searxng:
|
||||||
|
image: docker.io/searxng/searxng:latest
|
||||||
|
container_name: searxng
|
||||||
|
restart: unless-stopped
|
||||||
|
networks: [arr-net]
|
||||||
|
# Bind to localhost only — Open WebUI reaches it on arr-net
|
||||||
|
ports:
|
||||||
|
- "127.0.0.1:${SEARXNG_PORT:-8888}:8080"
|
||||||
|
environment:
|
||||||
|
SEARXNG_BASE_URL: http://localhost:${SEARXNG_PORT:-8888}/
|
||||||
|
SEARXNG_SECRET: ${SEARXNG_SECRET:-change-me-to-a-long-random-string}
|
||||||
|
volumes:
|
||||||
|
- ./searxng:/etc/searxng:rw
|
||||||
|
cap_drop:
|
||||||
|
- ALL
|
||||||
|
cap_add:
|
||||||
|
- CHOWN
|
||||||
|
- SETGID
|
||||||
|
- SETUID
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
# Forgejo — self-hosted Git (Gitea soft-fork). SQLite is fine for a homelab.
|
||||||
|
# Web: http://host:3002 Git SSH: host:2222 (git@host:user/repo.git with port 2222)
|
||||||
|
# First visit: create admin account, then create repos / push code.
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
forgejo:
|
||||||
|
image: codeberg.org/forgejo/forgejo:11
|
||||||
|
container_name: forgejo
|
||||||
|
restart: unless-stopped
|
||||||
|
networks: [arr-net]
|
||||||
|
ports:
|
||||||
|
- "${FORGEJO_HTTP_PORT:-3002}:3000"
|
||||||
|
- "${FORGEJO_SSH_PORT:-2222}:22"
|
||||||
|
environment:
|
||||||
|
USER_UID: ${PUID:-1000}
|
||||||
|
USER_GID: ${PGID:-1000}
|
||||||
|
TZ: ${TZ}
|
||||||
|
# Image already runs OpenSSH on :22 (mapped to host FORGEJO_SSH_PORT).
|
||||||
|
# Do NOT enable Forgejo's built-in SSH too — both bind :22 and the
|
||||||
|
# process fatals with "address already in use" (connection refused on :3002).
|
||||||
|
FORGEJO__server__START_SSH_SERVER: "false"
|
||||||
|
FORGEJO__server__DISABLE_SSH: "false"
|
||||||
|
FORGEJO__server__SSH_PORT: ${FORGEJO_SSH_PORT:-2222}
|
||||||
|
FORGEJO__server__SSH_DOMAIN: ${FORGEJO_DOMAIN:-192.168.8.123}
|
||||||
|
FORGEJO__server__DOMAIN: ${FORGEJO_DOMAIN:-192.168.8.123}
|
||||||
|
FORGEJO__server__ROOT_URL: ${FORGEJO_ROOT_URL:-http://192.168.8.123:3002/}
|
||||||
|
FORGEJO__server__HTTP_PORT: "3000"
|
||||||
|
# SQLite by default (no extra DB container)
|
||||||
|
FORGEJO__database__DB_TYPE: sqlite3
|
||||||
|
FORGEJO__service__DISABLE_REGISTRATION: ${FORGEJO_DISABLE_REGISTRATION:-false}
|
||||||
|
FORGEJO__actions__ENABLED: "true"
|
||||||
|
volumes:
|
||||||
|
- ${CONFIG_DIR}/forgejo:/data
|
||||||
|
- /etc/localtime:/etc/localtime:ro
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
# OpenHands — autonomous coding agent (opt-in)
|
||||||
|
# Start with: docker compose --profile coding up -d openhands
|
||||||
|
# UI: http://host:3001 → Settings → custom model openai/<id>
|
||||||
|
# Base URL: http://bonsai:8080/v1 API key: sk-local-bonsai
|
||||||
|
# Needs Docker socket to spawn sandboxed runtimes.
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
openhands:
|
||||||
|
profiles: ["coding"]
|
||||||
|
# Prefer GHCR — docker.all-hands.dev often fails DNS / is decommissioned
|
||||||
|
image: ghcr.io/all-hands-ai/openhands:0.54
|
||||||
|
container_name: openhands
|
||||||
|
restart: unless-stopped
|
||||||
|
networks: [arr-net]
|
||||||
|
ports:
|
||||||
|
- "${OPENHANDS_PORT:-3001}:3000"
|
||||||
|
extra_hosts:
|
||||||
|
- "host.docker.internal:host-gateway"
|
||||||
|
environment:
|
||||||
|
TZ: ${TZ}
|
||||||
|
SANDBOX_RUNTIME_CONTAINER_IMAGE: ghcr.io/all-hands-ai/runtime:0.54-nikolaik
|
||||||
|
LOG_ALL_EVENTS: "true"
|
||||||
|
# Pre-wire local Bonsai (override in UI if model id differs)
|
||||||
|
LLM_BASE_URL: http://bonsai:8080/v1
|
||||||
|
LLM_API_KEY: ${OPENAI_API_KEY:-sk-local-bonsai}
|
||||||
|
LLM_MODEL: ${OPENHANDS_MODEL:-openai/local}
|
||||||
|
WORKSPACE_MOUNT_PATH: ${AI_WORKSPACE_DIR:-./workspace}
|
||||||
|
SANDBOX_VOLUMES: ${AI_WORKSPACE_DIR:-./workspace}:/workspace:rw
|
||||||
|
volumes:
|
||||||
|
- /var/run/docker.sock:/var/run/docker.sock
|
||||||
|
- ${CONFIG_DIR}/openhands:/.openhands-state
|
||||||
|
- ${AI_WORKSPACE_DIR:-./workspace}:/opt/workspace_base
|
||||||
|
depends_on:
|
||||||
|
bonsai:
|
||||||
|
condition: service_healthy
|
||||||
1
models/bonsai/.gitkeep
Normal file
1
models/bonsai/.gitkeep
Normal file
|
|
@ -0,0 +1 @@
|
||||||
|
# Place Ternary-Bonsai-27B GGUF files here (see scripts/download-bonsai-model.sh)
|
||||||
138
quickstart.md
Normal file
138
quickstart.md
Normal file
|
|
@ -0,0 +1,138 @@
|
||||||
|
# Quickstart
|
||||||
|
|
||||||
|
Homelab host: **`192.168.8.123`** (SER5, Ubuntu 24.04)
|
||||||
|
Stack: **`/opt/stack`** · Media: **`/storage`** · User: **`tim`**
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Ansible
|
||||||
|
|
||||||
|
From a machine with this repo and SSH key `~/.ssh/id_ed25519`:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd ansible
|
||||||
|
ansible-galaxy collection install -r requirements.yml
|
||||||
|
|
||||||
|
ansible-playbook site.yml -K # -K only if sudo still asks once; playbook installs NOPASSWD for tim
|
||||||
|
```
|
||||||
|
|
||||||
|
What it does: OS updates, tools (incl. Microsoft `edit`), Docker, AMD/Vulkan, UFW (LAN only), `/opt/stack` + `/storage`, `.env`, `arr-stack.service`, and **tim** as local admin (passwordless sudo, docker/video/render/…, owns stack + storage, permissive GPU nodes).
|
||||||
|
|
||||||
|
**Before first full stack start** (on ser5):
|
||||||
|
|
||||||
|
```bash
|
||||||
|
ssh tim@192.168.8.123
|
||||||
|
# new login so docker/video/render groups apply
|
||||||
|
cd /opt/stack
|
||||||
|
# wireguard/wg0.conf must exist (no IPv6; Endpoint = IP not hostname)
|
||||||
|
./scripts/download-bonsai-model.sh # ~7.2 GB GGUF
|
||||||
|
docker compose build bonsai
|
||||||
|
docker compose up -d
|
||||||
|
# or: sudo systemctl enable --now arr-stack
|
||||||
|
docker compose ps
|
||||||
|
```
|
||||||
|
|
||||||
|
**Compose GPU notes**
|
||||||
|
- Keep `devices`/`group_add` only in `docker-compose.override.yml` (not also in the main file).
|
||||||
|
- Use **numeric GIDs** for `group_add`, not names (`video`/`render` fail inside the image). Or omit `group_add` if `/dev/dri` is mode `0666`.
|
||||||
|
|
||||||
|
|
||||||
|
Re-run playbook anytime: `ansible-playbook site.yml -K`
|
||||||
|
Tags: `--tags common,docker,amd,firewall,stack`
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Remotes
|
||||||
|
|
||||||
|
LAN URLs (UFW allows **`192.168.8.0/24`**). Replace host if needed.
|
||||||
|
|
||||||
|
| Service | URL |
|
||||||
|
|---------|-----|
|
||||||
|
| Jellyfin | http://192.168.8.123:8096 |
|
||||||
|
| qBittorrent | http://192.168.8.123:8080 |
|
||||||
|
| Prowlarr | http://192.168.8.123:9696 |
|
||||||
|
| Sonarr | http://192.168.8.123:8989 |
|
||||||
|
| Radarr | http://192.168.8.123:7878 |
|
||||||
|
| Bazarr | http://192.168.8.123:6767 |
|
||||||
|
| Lidarr | http://192.168.8.123:8686 |
|
||||||
|
| Open WebUI | http://192.168.8.123:3000 |
|
||||||
|
| Bonsai API | http://192.168.8.123:8081/v1 |
|
||||||
|
| OpenHands | http://192.168.8.123:3001 |
|
||||||
|
| **Forgejo** | http://192.168.8.123:3002 |
|
||||||
|
| Forgejo Git SSH | `ssh://git@192.168.8.123:2222/user/repo.git` |
|
||||||
|
|
||||||
|
OpenHands only runs with: `docker compose --profile coding up -d` (or `stack_compose_profiles: [coding]` in Ansible).
|
||||||
|
Images are from **GHCR** (`ghcr.io/all-hands-ai/...`); the old `docker.all-hands.dev` host often does not resolve.
|
||||||
|
|
||||||
|
### Manual config (once)
|
||||||
|
|
||||||
|
**qBittorrent** — temp password in `docker logs qbittorrent`; user `admin`.
|
||||||
|
Advanced → Network interface: `tun0`.
|
||||||
|
|
||||||
|
Default save path + categories (WebUI):
|
||||||
|
|
||||||
|
1. **Tools → Options → Downloads**
|
||||||
|
- Default Save Path: `/data/torrents`
|
||||||
|
- Keep “Keep incomplete torrents in” off (or a subfolder under `/data/torrents` if you prefer).
|
||||||
|
2. **Categories** (same Options → Downloads page, or right‑click empty area in the left “Categories” panel → **Add category**):
|
||||||
|
|
||||||
|
| Category name | Save path |
|
||||||
|
|---------------|-----------|
|
||||||
|
| `movies` | `/data/torrents/movies` |
|
||||||
|
| `tv` | `/data/torrents/tv` |
|
||||||
|
| `music` | `/data/torrents/music` |
|
||||||
|
|
||||||
|
For each: **Add category** → name exactly `movies` / `tv` / `music` (lowercase, matches Sonarr/Radarr/Lidarr) → set **Save path** to the path above → OK.
|
||||||
|
|
||||||
|
3. Sonarr/Radarr/Lidarr download-client “Category” fields must match those names so torrents land in the right folder for hardlinks.
|
||||||
|
|
||||||
|
**Sonarr / Radarr / Lidarr** — Download client qBittorrent: host **`gluetun`**, port **`8080`**, categories `tv` / `movies` / `music`.
|
||||||
|
Root folders: `/data/media/tv`, `/data/media/movies`, `/data/media/music` (hardlinks on).
|
||||||
|
|
||||||
|
**Prowlarr** — Add indexers. Apps: Sonarr `http://sonarr:8989`, Radarr `http://radarr:7878`, Lidarr `http://lidarr:8686` + each API key (*Settings → General*).
|
||||||
|
|
||||||
|
**Bazarr** — Sonarr/Radarr URLs + API keys; paths `/data/media/tv`, `/data/media/movies`.
|
||||||
|
|
||||||
|
**Jellyfin** — Libraries: Movies `/data/media/movies`, Shows `/data/media/tv`, Music `/data/media/music`.
|
||||||
|
|
||||||
|
**Open WebUI** — Create admin on first visit. Model connection is pre-set to Bonsai (`http://bonsai:8080/v1`). Enable web search in chat if desired. RAG: Workspace → Knowledge (uploads) or files under `/workspace`.
|
||||||
|
|
||||||
|
**Bonsai** — No UI login. Smoke test: `curl -s http://192.168.8.123:8081/v1/models`. Needs GGUF in `models/bonsai/` and `docker compose build bonsai` once.
|
||||||
|
|
||||||
|
**OpenHands** — On the server (`/opt/stack`): `docker compose --profile coding up -d openhands`.
|
||||||
|
Settings → Advanced: base URL `http://bonsai:8080/v1`, API key `sk-local-bonsai` (or `.env` value), model `openai/<id from /v1/models>`.
|
||||||
|
|
||||||
|
**Forgejo** — First visit http://192.168.8.123:3002 → install wizard (SQLite is pre-selected via env) → create **admin**.
|
||||||
|
If connection refused: container crash-looped (built-in SSH + image OpenSSH both on :22). Compose sets `START_SSH_SERVER=false`; recreate with `docker compose up -d forgejo --force-recreate`.
|
||||||
|
Then: **+ → New Repository** → clone into workspace:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# HTTPS
|
||||||
|
git clone http://192.168.8.123:3002/YOU/repo.git /opt/stack/workspace/repo
|
||||||
|
|
||||||
|
# SSH (port 2222 — host :22 stays for machine login)
|
||||||
|
git clone ssh://git@192.168.8.123:2222/YOU/repo.git /opt/stack/workspace/repo
|
||||||
|
# or: git remote add origin ssh://git@192.168.8.123:2222/YOU/repo.git
|
||||||
|
```
|
||||||
|
|
||||||
|
Point OpenHands / Open WebUI `AI_WORKSPACE_DIR` at those clones. After admin exists, set `FORGEJO_DISABLE_REGISTRATION=true` in `.env` and recreate: `docker compose up -d forgejo`.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Locals
|
||||||
|
|
||||||
|
Bound to loopback on the host (not LAN-reachable as published):
|
||||||
|
|
||||||
|
| Service | URL / path |
|
||||||
|
|---------|------------|
|
||||||
|
| SearXNG | http://127.0.0.1:8888 |
|
||||||
|
|
||||||
|
Open WebUI talks to SearXNG on the Docker network (`http://searxng:8080`); you only need the loopback URL for direct browser checks on the server.
|
||||||
|
|
||||||
|
### Manual config
|
||||||
|
|
||||||
|
**SearXNG** — None for normal use. Settings: `/opt/stack/searxng/settings.yml`. Secret comes from `.env` (`SEARXNG_SECRET`).
|
||||||
|
|
||||||
|
**WireGuard** — File only: `/opt/stack/wireguard/wg0.conf` (not a web UI). Must be ready before gluetun is healthy.
|
||||||
|
|
||||||
|
**Host shell** — `ssh tim@192.168.8.123` · stack logs: `docker compose -f /opt/stack/docker-compose.yml logs -f` · unit: `systemctl status arr-stack`.
|
||||||
112
scripts/download-bonsai-model.sh
Executable file
112
scripts/download-bonsai-model.sh
Executable file
|
|
@ -0,0 +1,112 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
# Download Ternary-Bonsai-27B GGUF (and optional vision / drafter packs)
|
||||||
|
# into ./models/bonsai for the docker-compose bonsai service.
|
||||||
|
#
|
||||||
|
# Requires: ~8–10 GB free disk for the base model.
|
||||||
|
# Prefer: pip install -U "huggingface_hub[cli]" # provides `hf`
|
||||||
|
# Optional: HF_TOKEN / BONSAI_TOKEN if the repo ever requires auth.
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
||||||
|
OUT="${MODEL_DIR:-$ROOT/models/bonsai}"
|
||||||
|
REPO="${BONSAI_HF_REPO:-prism-ml/Ternary-Bonsai-27B-gguf}"
|
||||||
|
# Group-128 Q2_0 — needs PrismML llama.cpp (what our Docker image ships)
|
||||||
|
MAIN_FILE="${BONSAI_MAIN_FILE:-Ternary-Bonsai-27B-Q2_0.gguf}"
|
||||||
|
DOWNLOAD_VISION="${DOWNLOAD_VISION:-1}"
|
||||||
|
DOWNLOAD_DRAFTER="${DOWNLOAD_DRAFTER:-0}"
|
||||||
|
|
||||||
|
mkdir -p "$OUT"
|
||||||
|
cd "$OUT"
|
||||||
|
|
||||||
|
export HF_TOKEN="${HF_TOKEN:-${BONSAI_TOKEN:-}}"
|
||||||
|
|
||||||
|
have_hf() {
|
||||||
|
command -v hf >/dev/null 2>&1 || command -v huggingface-cli >/dev/null 2>&1
|
||||||
|
}
|
||||||
|
|
||||||
|
hf_get() {
|
||||||
|
local file="$1"
|
||||||
|
if command -v hf >/dev/null 2>&1; then
|
||||||
|
hf download "$REPO" "$file" --local-dir .
|
||||||
|
else
|
||||||
|
huggingface-cli download "$REPO" "$file" --local-dir .
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
curl_get() {
|
||||||
|
local file="$1"
|
||||||
|
local url="https://huggingface.co/${REPO}/resolve/main/${file}"
|
||||||
|
local auth=()
|
||||||
|
if [ -n "${HF_TOKEN:-}" ]; then
|
||||||
|
auth=(-H "Authorization: Bearer ${HF_TOKEN}")
|
||||||
|
fi
|
||||||
|
curl -fL --retry 5 --continue-at - "${auth[@]}" "$url" -o "${file}.partial"
|
||||||
|
mv "${file}.partial" "$file"
|
||||||
|
}
|
||||||
|
|
||||||
|
download() {
|
||||||
|
local file="$1"
|
||||||
|
if [ -f "$file" ] && [ -s "$file" ]; then
|
||||||
|
echo "Already present: $file ($(du -h "$file" | cut -f1))"
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
echo "Downloading $file ..."
|
||||||
|
if have_hf; then
|
||||||
|
hf_get "$file"
|
||||||
|
else
|
||||||
|
echo " (tip: install huggingface_hub for more reliable downloads: pip install -U 'huggingface_hub[cli]')"
|
||||||
|
curl_get "$file"
|
||||||
|
fi
|
||||||
|
echo " OK: $file ($(du -h "$file" | cut -f1))"
|
||||||
|
}
|
||||||
|
|
||||||
|
echo "Target directory: $OUT"
|
||||||
|
echo "Repo: $REPO"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
download "$MAIN_FILE"
|
||||||
|
|
||||||
|
if [ "$DOWNLOAD_VISION" = "1" ]; then
|
||||||
|
echo ""
|
||||||
|
echo "Optional vision projector (mmproj) — attempting known filenames..."
|
||||||
|
_got=0
|
||||||
|
for f in \
|
||||||
|
Ternary-Bonsai-27B-mmproj-HQQ4.gguf \
|
||||||
|
Ternary-Bonsai-27B-mmproj-f16.gguf \
|
||||||
|
mmproj-Ternary-Bonsai-27B.gguf \
|
||||||
|
; do
|
||||||
|
if [ -f "$f" ]; then
|
||||||
|
echo "Already present: $f"
|
||||||
|
_got=1
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
if have_hf; then
|
||||||
|
if hf_get "$f" 2>/dev/null; then
|
||||||
|
_got=1
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
if [ "$_got" != "1" ]; then
|
||||||
|
echo "Vision mmproj not found automatically (optional for text-only)."
|
||||||
|
echo " List files: https://huggingface.co/${REPO}/tree/main"
|
||||||
|
echo " Place any *mmproj*.gguf into $OUT and restart bonsai."
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ "$DOWNLOAD_DRAFTER" = "1" ]; then
|
||||||
|
echo ""
|
||||||
|
echo "Optional DSpark drafter (speculative decoding; mainly helps CUDA)..."
|
||||||
|
for f in Ternary-Bonsai-27B-dspark-Q4_1.gguf; do
|
||||||
|
download "$f" || echo " skipped: $f"
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "Done. GGUF files in $OUT:"
|
||||||
|
ls -lh "$OUT"/*.gguf 2>/dev/null || ls -lh "$OUT"
|
||||||
|
echo ""
|
||||||
|
echo "Next:"
|
||||||
|
echo " docker compose up -d --build bonsai open-webui searxng"
|
||||||
|
echo " Open WebUI → http://localhost:3000"
|
||||||
|
echo " Raw API → http://localhost:8081/v1/models"
|
||||||
29
searxng/settings.yml
Normal file
29
searxng/settings.yml
Normal file
|
|
@ -0,0 +1,29 @@
|
||||||
|
# Minimal SearXNG config for Open WebUI web-search RAG.
|
||||||
|
# See https://docs.searxng.org/admin/settings/settings.html
|
||||||
|
|
||||||
|
use_default_settings: true
|
||||||
|
|
||||||
|
general:
|
||||||
|
instance_name: "arr-stack searxng"
|
||||||
|
enable_metrics: false
|
||||||
|
|
||||||
|
search:
|
||||||
|
safe_search: 0
|
||||||
|
autocomplete: ""
|
||||||
|
default_lang: "en"
|
||||||
|
formats:
|
||||||
|
- html
|
||||||
|
- json
|
||||||
|
|
||||||
|
server:
|
||||||
|
# Shared secret for limiter / sessions; override via SEARXNG_SECRET in compose if you like
|
||||||
|
secret_key: "change-me-in-production-use-env"
|
||||||
|
limiter: false
|
||||||
|
image_proxy: true
|
||||||
|
|
||||||
|
ui:
|
||||||
|
static_use_hash: true
|
||||||
|
|
||||||
|
# Disable outbound image proxy noise; keep JSON API for Open WebUI
|
||||||
|
outgoing:
|
||||||
|
request_timeout: 10.0
|
||||||
27
wireguard/wg0.conf.example
Normal file
27
wireguard/wg0.conf.example
Normal file
|
|
@ -0,0 +1,27 @@
|
||||||
|
# Rename YOUR provider's config file to `wg0.conf` and put it in this folder.
|
||||||
|
# It looks roughly like this:
|
||||||
|
#
|
||||||
|
# [Interface]
|
||||||
|
# PrivateKey = yAnz..................................=
|
||||||
|
# Address = 10.2.0.2/32
|
||||||
|
# DNS = 10.2.0.1
|
||||||
|
#
|
||||||
|
# [Peer]
|
||||||
|
# PublicKey = xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=
|
||||||
|
# PresharedKey = ......................................= # only if present
|
||||||
|
# AllowedIPs = 0.0.0.0/0
|
||||||
|
# Endpoint = 185.159.157.12:51820
|
||||||
|
#
|
||||||
|
# Two required edits before gluetun accepts it:
|
||||||
|
#
|
||||||
|
# 1. Remove any IPv6 addresses from the Address and DNS lines, e.g.
|
||||||
|
# Address = 10.182.160.190/32, fd7d:76ee:...::/128
|
||||||
|
# becomes
|
||||||
|
# Address = 10.182.160.190/32
|
||||||
|
#
|
||||||
|
# 2. The Endpoint must be an IP address, not a hostname. If yours says
|
||||||
|
# something like `Endpoint = se3.vpn.example.org:51820`, resolve it first:
|
||||||
|
# dig +short se3.vpn.example.org
|
||||||
|
# and paste the IP back into the file.
|
||||||
|
#
|
||||||
|
# Keep AllowedIPs = 0.0.0.0/0 as-is; gluetun handles the routing itself.
|
||||||
2
workspace/README.md
Normal file
2
workspace/README.md
Normal file
|
|
@ -0,0 +1,2 @@
|
||||||
|
# AI workspace — mount point for Open WebUI (/workspace) and OpenHands
|
||||||
|
# Drop project folders, notes, and docs here for local file Q&A and coding tasks.
|
||||||
Loading…
Add table
Add a link
Reference in a new issue