07ae1c0c71
Wire Newshosting/Tweaknews via secrets-driven configure script, NZBgeek through Prowlarr, and /data/usenet paths for hardlinks with the Arrs.
238 lines
6 KiB
YAML
238 lines
6 KiB
YAML
---
|
|
# ---------------------------------------------------------------------------
|
|
# Host layout
|
|
# ---------------------------------------------------------------------------
|
|
stack_root: /opt/stack
|
|
storage_root: /storage
|
|
stack_owner: tim
|
|
stack_group: tim
|
|
|
|
# Media tree lives on the 1TB disk
|
|
data_dir: "{{ storage_root }}"
|
|
config_dir: "{{ stack_root }}/config"
|
|
models_dir: "{{ stack_root }}/models/bonsai"
|
|
workspace_dir: "{{ stack_root }}/workspace"
|
|
wireguard_dir: "{{ stack_root }}/wireguard"
|
|
|
|
# LAN (SER5 is 192.168.8.123)
|
|
lan_subnet: 192.168.8.0/24
|
|
timezone: America/Los_Angeles
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Packages
|
|
# ---------------------------------------------------------------------------
|
|
# Always-on essentials (explicit — also listed in common_packages)
|
|
essential_packages:
|
|
- curl
|
|
- wget
|
|
- nano
|
|
- build-essential
|
|
- net-tools
|
|
|
|
# Microsoft Edit (https://github.com/microsoft/edit) — terminal editor
|
|
ms_edit_version: "2.0.0"
|
|
ms_edit_install: true
|
|
|
|
common_packages:
|
|
# essentials
|
|
- curl
|
|
- wget
|
|
- nano
|
|
- build-essential
|
|
- net-tools
|
|
# system / packaging
|
|
- ca-certificates
|
|
- gnupg
|
|
- apt-transport-https
|
|
- software-properties-common
|
|
- git
|
|
- python3
|
|
- python3-pip
|
|
- python3-venv
|
|
- cmake
|
|
- ninja-build
|
|
- pkg-config
|
|
# editors / viewers
|
|
- vim
|
|
- less
|
|
# monitoring / disk
|
|
- htop
|
|
- btop
|
|
- iotop
|
|
- iftop
|
|
- ncdu
|
|
- duf
|
|
- sysstat
|
|
- smartmontools
|
|
- lm-sensors
|
|
- nvme-cli
|
|
# network
|
|
- iproute2
|
|
- dnsutils
|
|
- traceroute
|
|
- mtr-tiny
|
|
- nmap
|
|
- tcpdump
|
|
# utils
|
|
- tree
|
|
- jq
|
|
- ripgrep
|
|
- fd-find
|
|
- fzf
|
|
- tmux
|
|
- rsync
|
|
- unzip
|
|
- zip
|
|
- p7zip-full
|
|
- lsof
|
|
- strace
|
|
- pciutils
|
|
- usbutils
|
|
- plocate
|
|
- bat
|
|
- aria2
|
|
# security / updates
|
|
- fail2ban
|
|
- unattended-upgrades
|
|
- update-notifier-common
|
|
|
|
# Start stack on boot (docker compose up -d); pairs with restart: unless-stopped
|
|
stack_systemd_enable: true
|
|
stack_compose_profiles: [] # e.g. ["coding"] to also start openhands
|
|
|
|
# AMD / Vulkan / media accel (Radeon 680M on SER5 PRO)
|
|
# Note: Ubuntu 24.04 uses mesa-va-drivers (not the older libva-mesa-driver name).
|
|
# Many of these live in the "universe" component — role enables it first.
|
|
amd_vulkan_packages:
|
|
- linux-firmware
|
|
- mesa-vulkan-drivers
|
|
- mesa-utils
|
|
- libvulkan1
|
|
- vulkan-tools
|
|
- libgl1-mesa-dri
|
|
- libegl1
|
|
- libgles2
|
|
- vainfo
|
|
- libva2
|
|
- libva-drm2
|
|
- mesa-va-drivers
|
|
- mesa-vdpau-drivers
|
|
- clinfo
|
|
|
|
# Groups for operator account (tim) — local trusted host, convenience over lockdown
|
|
extra_user_groups:
|
|
- sudo
|
|
- docker
|
|
- video
|
|
- render
|
|
- adm
|
|
- disk
|
|
- plugdev
|
|
- dialout
|
|
- cdrom
|
|
- users
|
|
- systemd-journal
|
|
# present on many Ubuntu images; harmless if already primary
|
|
- tim
|
|
|
|
# Passwordless full sudo for stack_owner (local monitored network)
|
|
stack_passwordless_sudo: true
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Docker
|
|
# ---------------------------------------------------------------------------
|
|
docker_packages:
|
|
- docker-ce
|
|
- docker-ce-cli
|
|
- containerd.io
|
|
- docker-buildx-plugin
|
|
- docker-compose-plugin
|
|
|
|
docker_daemon_json:
|
|
log-driver: json-file
|
|
log-opts:
|
|
max-size: "50m"
|
|
max-file: "5"
|
|
# Leave room for media + inference
|
|
default-address-pools:
|
|
- base: 172.30.0.0/16
|
|
size: 24
|
|
# Enable cgroup device access patterns used by /dev/dri
|
|
features:
|
|
buildkit: true
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Firewall (UFW) — default deny in, allow out; open stack ports to LAN only
|
|
# ---------------------------------------------------------------------------
|
|
ufw_enabled: true
|
|
ufw_default_incoming: deny
|
|
ufw_default_outgoing: allow
|
|
|
|
# SSH from anywhere on LAN (and optionally world — keep LAN-only by default)
|
|
ufw_allow_ssh_from_anywhere: false
|
|
|
|
ufw_lan_tcp_ports:
|
|
- { port: 22, comment: "SSH" }
|
|
- { port: 8080, comment: "qBittorrent" }
|
|
- { port: 8096, comment: "Jellyfin" }
|
|
- { port: 8989, comment: "Sonarr" }
|
|
- { port: 7878, comment: "Radarr" }
|
|
- { port: 9696, comment: "Prowlarr" }
|
|
- { port: 6767, comment: "Bazarr" }
|
|
- { port: 8686, comment: "Lidarr" }
|
|
- { port: 3000, comment: "Open WebUI" }
|
|
- { port: 8081, comment: "Bonsai llama-server" }
|
|
- { port: 3001, comment: "OpenHands (optional)" }
|
|
- { port: 3002, comment: "Forgejo HTTP" }
|
|
- { port: 2222, comment: "Forgejo Git SSH" }
|
|
- { port: 8085, comment: "SABnzbd" }
|
|
|
|
# WireGuard peer hostname for gluetun-endpoint-watch
|
|
wireguard_endpoint_host: las-183-wg.whiskergalaxy.com
|
|
wireguard_endpoint_port: "443"
|
|
|
|
# Forgejo (self-hosted Git)
|
|
forgejo_domain: "192.168.8.123"
|
|
forgejo_http_port: 3002
|
|
forgejo_ssh_port: 2222
|
|
forgejo_root_url: "http://{{ forgejo_domain }}:{{ forgejo_http_port }}/"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Stack deployment
|
|
# ---------------------------------------------------------------------------
|
|
# Deploy stack *code* to the server.
|
|
# git — /opt/stack is a clone of Forgejo (preferred; use `git pull` on ser5)
|
|
# rsync — push from the control machine (laptop) tree
|
|
stack_deploy_method: git
|
|
deploy_stack_files: true # master switch for code deploy tasks
|
|
|
|
# Forgejo remote used on the server (same host → prefer loopback SSH port)
|
|
stack_git_repo: "ssh://git@127.0.0.1:2222/tim/stack.git"
|
|
stack_git_branch: main
|
|
# Also accept the LAN URL if someone clones from another machine
|
|
stack_git_repo_lan: "ssh://git@192.168.8.123:2222/tim/stack.git"
|
|
|
|
# Paths on the control machine (the machine running ansible-playbook)
|
|
# Default: the arr-stack repo that contains this ansible/ directory
|
|
stack_src: "{{ playbook_dir | dirname }}"
|
|
|
|
# AI defaults for SER5 + Vulkan
|
|
bonsai_backend: vulkan
|
|
bonsai_ngl: "99"
|
|
bonsai_ctx: "16384"
|
|
bonsai_threads: "12"
|
|
bonsai_kv4: "0"
|
|
open_webui_auth: "true"
|
|
|
|
# Media subdirs under storage_root
|
|
media_subdirs:
|
|
- media/movies
|
|
- media/tv
|
|
- media/music
|
|
- torrents/movies
|
|
- torrents/tv
|
|
- torrents/music
|
|
- usenet/incomplete
|
|
- usenet/complete/movies
|
|
- usenet/complete/tv
|
|
- usenet/complete/music
|