218e64314d
When gluetun is unhealthy, re-dig the WireGuard peer hostname, update wg0.conf Endpoint, recreate gluetun then qbittorrent, and verify the VPN exit IP. Keeps torrent path alive when provider endpoints rotate.
233 lines
5.8 KiB
YAML
233 lines
5.8 KiB
YAML
---
|
|
# ---------------------------------------------------------------------------
|
|
# Host layout
|
|
# ---------------------------------------------------------------------------
|
|
stack_root: /opt/stack
|
|
storage_root: /storage
|
|
stack_owner: tim
|
|
stack_group: tim
|
|
|
|
# Media tree lives on the 1TB disk
|
|
data_dir: "{{ storage_root }}"
|
|
config_dir: "{{ stack_root }}/config"
|
|
models_dir: "{{ stack_root }}/models/bonsai"
|
|
workspace_dir: "{{ stack_root }}/workspace"
|
|
wireguard_dir: "{{ stack_root }}/wireguard"
|
|
|
|
# LAN (SER5 is 192.168.8.123)
|
|
lan_subnet: 192.168.8.0/24
|
|
timezone: America/Los_Angeles
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Packages
|
|
# ---------------------------------------------------------------------------
|
|
# Always-on essentials (explicit — also listed in common_packages)
|
|
essential_packages:
|
|
- curl
|
|
- wget
|
|
- nano
|
|
- build-essential
|
|
- net-tools
|
|
|
|
# Microsoft Edit (https://github.com/microsoft/edit) — terminal editor
|
|
ms_edit_version: "2.0.0"
|
|
ms_edit_install: true
|
|
|
|
common_packages:
|
|
# essentials
|
|
- curl
|
|
- wget
|
|
- nano
|
|
- build-essential
|
|
- net-tools
|
|
# system / packaging
|
|
- ca-certificates
|
|
- gnupg
|
|
- apt-transport-https
|
|
- software-properties-common
|
|
- git
|
|
- python3
|
|
- python3-pip
|
|
- python3-venv
|
|
- cmake
|
|
- ninja-build
|
|
- pkg-config
|
|
# editors / viewers
|
|
- vim
|
|
- less
|
|
# monitoring / disk
|
|
- htop
|
|
- btop
|
|
- iotop
|
|
- iftop
|
|
- ncdu
|
|
- duf
|
|
- sysstat
|
|
- smartmontools
|
|
- lm-sensors
|
|
- nvme-cli
|
|
# network
|
|
- iproute2
|
|
- dnsutils
|
|
- traceroute
|
|
- mtr-tiny
|
|
- nmap
|
|
- tcpdump
|
|
# utils
|
|
- tree
|
|
- jq
|
|
- ripgrep
|
|
- fd-find
|
|
- fzf
|
|
- tmux
|
|
- rsync
|
|
- unzip
|
|
- zip
|
|
- p7zip-full
|
|
- lsof
|
|
- strace
|
|
- pciutils
|
|
- usbutils
|
|
- plocate
|
|
- bat
|
|
- aria2
|
|
# security / updates
|
|
- fail2ban
|
|
- unattended-upgrades
|
|
- update-notifier-common
|
|
|
|
# Start stack on boot (docker compose up -d); pairs with restart: unless-stopped
|
|
stack_systemd_enable: true
|
|
stack_compose_profiles: [] # e.g. ["coding"] to also start openhands
|
|
|
|
# AMD / Vulkan / media accel (Radeon 680M on SER5 PRO)
|
|
# Note: Ubuntu 24.04 uses mesa-va-drivers (not the older libva-mesa-driver name).
|
|
# Many of these live in the "universe" component — role enables it first.
|
|
amd_vulkan_packages:
|
|
- linux-firmware
|
|
- mesa-vulkan-drivers
|
|
- mesa-utils
|
|
- libvulkan1
|
|
- vulkan-tools
|
|
- libgl1-mesa-dri
|
|
- libegl1
|
|
- libgles2
|
|
- vainfo
|
|
- libva2
|
|
- libva-drm2
|
|
- mesa-va-drivers
|
|
- mesa-vdpau-drivers
|
|
- clinfo
|
|
|
|
# Groups for operator account (tim) — local trusted host, convenience over lockdown
|
|
extra_user_groups:
|
|
- sudo
|
|
- docker
|
|
- video
|
|
- render
|
|
- adm
|
|
- disk
|
|
- plugdev
|
|
- dialout
|
|
- cdrom
|
|
- users
|
|
- systemd-journal
|
|
# present on many Ubuntu images; harmless if already primary
|
|
- tim
|
|
|
|
# Passwordless full sudo for stack_owner (local monitored network)
|
|
stack_passwordless_sudo: true
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Docker
|
|
# ---------------------------------------------------------------------------
|
|
docker_packages:
|
|
- docker-ce
|
|
- docker-ce-cli
|
|
- containerd.io
|
|
- docker-buildx-plugin
|
|
- docker-compose-plugin
|
|
|
|
docker_daemon_json:
|
|
log-driver: json-file
|
|
log-opts:
|
|
max-size: "50m"
|
|
max-file: "5"
|
|
# Leave room for media + inference
|
|
default-address-pools:
|
|
- base: 172.30.0.0/16
|
|
size: 24
|
|
# Enable cgroup device access patterns used by /dev/dri
|
|
features:
|
|
buildkit: true
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Firewall (UFW) — default deny in, allow out; open stack ports to LAN only
|
|
# ---------------------------------------------------------------------------
|
|
ufw_enabled: true
|
|
ufw_default_incoming: deny
|
|
ufw_default_outgoing: allow
|
|
|
|
# SSH from anywhere on LAN (and optionally world — keep LAN-only by default)
|
|
ufw_allow_ssh_from_anywhere: false
|
|
|
|
ufw_lan_tcp_ports:
|
|
- { port: 22, comment: "SSH" }
|
|
- { port: 8080, comment: "qBittorrent" }
|
|
- { port: 8096, comment: "Jellyfin" }
|
|
- { port: 8989, comment: "Sonarr" }
|
|
- { port: 7878, comment: "Radarr" }
|
|
- { port: 9696, comment: "Prowlarr" }
|
|
- { port: 6767, comment: "Bazarr" }
|
|
- { port: 8686, comment: "Lidarr" }
|
|
- { port: 3000, comment: "Open WebUI" }
|
|
- { port: 8081, comment: "Bonsai llama-server" }
|
|
- { port: 3001, comment: "OpenHands (optional)" }
|
|
- { port: 3002, comment: "Forgejo HTTP" }
|
|
- { port: 2222, comment: "Forgejo Git SSH" }
|
|
|
|
# WireGuard peer hostname for gluetun-endpoint-watch
|
|
wireguard_endpoint_host: las-183-wg.whiskergalaxy.com
|
|
wireguard_endpoint_port: "443"
|
|
|
|
# Forgejo (self-hosted Git)
|
|
forgejo_domain: "192.168.8.123"
|
|
forgejo_http_port: 3002
|
|
forgejo_ssh_port: 2222
|
|
forgejo_root_url: "http://{{ forgejo_domain }}:{{ forgejo_http_port }}/"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Stack deployment
|
|
# ---------------------------------------------------------------------------
|
|
# Deploy stack *code* to the server.
|
|
# git — /opt/stack is a clone of Forgejo (preferred; use `git pull` on ser5)
|
|
# rsync — push from the control machine (laptop) tree
|
|
stack_deploy_method: git
|
|
deploy_stack_files: true # master switch for code deploy tasks
|
|
|
|
# Forgejo remote used on the server (same host → prefer loopback SSH port)
|
|
stack_git_repo: "ssh://git@127.0.0.1:2222/tim/stack.git"
|
|
stack_git_branch: main
|
|
# Also accept the LAN URL if someone clones from another machine
|
|
stack_git_repo_lan: "ssh://git@192.168.8.123:2222/tim/stack.git"
|
|
|
|
# Paths on the control machine (the machine running ansible-playbook)
|
|
# Default: the arr-stack repo that contains this ansible/ directory
|
|
stack_src: "{{ playbook_dir | dirname }}"
|
|
|
|
# AI defaults for SER5 + Vulkan
|
|
bonsai_backend: vulkan
|
|
bonsai_ngl: "99"
|
|
bonsai_ctx: "16384"
|
|
bonsai_threads: "12"
|
|
bonsai_kv4: "0"
|
|
open_webui_auth: "true"
|
|
|
|
# Media subdirs under storage_root
|
|
media_subdirs:
|
|
- media/movies
|
|
- media/tv
|
|
- media/music
|
|
- torrents/movies
|
|
- torrents/tv
|
|
- torrents/music
|