3bf1726a99
Expand .env.example with ports, AI, Usenet, WireGuard, demo logins, and bootstrap flags. One script creates dirs, downloads the model, starts compose, heals gluetun, and configures SABnzbd from the same file.
244 lines
6.1 KiB
YAML
244 lines
6.1 KiB
YAML
---
|
|
# ---------------------------------------------------------------------------
|
|
# Host layout
|
|
# ---------------------------------------------------------------------------
|
|
stack_root: /opt/stack
|
|
storage_root: /storage
|
|
stack_owner: tim
|
|
stack_group: tim
|
|
|
|
# Media tree lives on the 1TB disk
|
|
data_dir: "{{ storage_root }}"
|
|
config_dir: "{{ stack_root }}/config"
|
|
models_dir: "{{ stack_root }}/models/bonsai"
|
|
workspace_dir: "{{ stack_root }}/workspace"
|
|
wireguard_dir: "{{ stack_root }}/wireguard"
|
|
|
|
# LAN (SER5 is 192.168.8.123)
|
|
lan_subnet: 192.168.8.0/24
|
|
timezone: America/Los_Angeles
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Packages
|
|
# ---------------------------------------------------------------------------
|
|
# Always-on essentials (explicit — also listed in common_packages)
|
|
essential_packages:
|
|
- curl
|
|
- wget
|
|
- nano
|
|
- build-essential
|
|
- net-tools
|
|
|
|
# Microsoft Edit (https://github.com/microsoft/edit) — terminal editor
|
|
ms_edit_version: "2.0.0"
|
|
ms_edit_install: true
|
|
|
|
common_packages:
|
|
# essentials
|
|
- curl
|
|
- wget
|
|
- nano
|
|
- build-essential
|
|
- net-tools
|
|
# system / packaging
|
|
- ca-certificates
|
|
- gnupg
|
|
- apt-transport-https
|
|
- software-properties-common
|
|
- git
|
|
- python3
|
|
- python3-pip
|
|
- python3-venv
|
|
- cmake
|
|
- ninja-build
|
|
- pkg-config
|
|
# editors / viewers
|
|
- vim
|
|
- less
|
|
# monitoring / disk
|
|
- htop
|
|
- btop
|
|
- iotop
|
|
- iftop
|
|
- ncdu
|
|
- duf
|
|
- sysstat
|
|
- smartmontools
|
|
- lm-sensors
|
|
- nvme-cli
|
|
# network
|
|
- iproute2
|
|
- dnsutils
|
|
- traceroute
|
|
- mtr-tiny
|
|
- nmap
|
|
- tcpdump
|
|
# utils
|
|
- tree
|
|
- jq
|
|
- ripgrep
|
|
- fd-find
|
|
- fzf
|
|
- tmux
|
|
- rsync
|
|
- unzip
|
|
- zip
|
|
- p7zip-full
|
|
- lsof
|
|
- strace
|
|
- pciutils
|
|
- usbutils
|
|
- plocate
|
|
- bat
|
|
- aria2
|
|
# security / updates
|
|
- fail2ban
|
|
- unattended-upgrades
|
|
- update-notifier-common
|
|
|
|
# Start stack on boot (docker compose up -d); pairs with restart: unless-stopped
|
|
stack_systemd_enable: true
|
|
stack_compose_profiles: [] # e.g. ["coding"] to also start openhands
|
|
|
|
# AMD / Vulkan / media accel (Radeon 680M on SER5 PRO)
|
|
# Note: Ubuntu 24.04 uses mesa-va-drivers (not the older libva-mesa-driver name).
|
|
# Many of these live in the "universe" component — role enables it first.
|
|
amd_vulkan_packages:
|
|
- linux-firmware
|
|
- mesa-vulkan-drivers
|
|
- mesa-utils
|
|
- libvulkan1
|
|
- vulkan-tools
|
|
- libgl1-mesa-dri
|
|
- libegl1
|
|
- libgles2
|
|
- vainfo
|
|
- libva2
|
|
- libva-drm2
|
|
- mesa-va-drivers
|
|
- mesa-vdpau-drivers
|
|
- clinfo
|
|
|
|
# Groups for operator account (tim) — local trusted host, convenience over lockdown
|
|
extra_user_groups:
|
|
- sudo
|
|
- docker
|
|
- video
|
|
- render
|
|
- adm
|
|
- disk
|
|
- plugdev
|
|
- dialout
|
|
- cdrom
|
|
- users
|
|
- systemd-journal
|
|
# present on many Ubuntu images; harmless if already primary
|
|
- tim
|
|
|
|
# Passwordless full sudo for stack_owner (local monitored network)
|
|
stack_passwordless_sudo: true
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Docker
|
|
# ---------------------------------------------------------------------------
|
|
docker_packages:
|
|
- docker-ce
|
|
- docker-ce-cli
|
|
- containerd.io
|
|
- docker-buildx-plugin
|
|
- docker-compose-plugin
|
|
|
|
docker_daemon_json:
|
|
log-driver: json-file
|
|
log-opts:
|
|
max-size: "50m"
|
|
max-file: "5"
|
|
# Leave room for media + inference
|
|
default-address-pools:
|
|
- base: 172.30.0.0/16
|
|
size: 24
|
|
# Enable cgroup device access patterns used by /dev/dri
|
|
features:
|
|
buildkit: true
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Firewall (UFW) — default deny in, allow out; open stack ports to LAN only
|
|
# ---------------------------------------------------------------------------
|
|
ufw_enabled: true
|
|
ufw_default_incoming: deny
|
|
ufw_default_outgoing: allow
|
|
|
|
# SSH from anywhere on LAN (and optionally world — keep LAN-only by default)
|
|
ufw_allow_ssh_from_anywhere: false
|
|
|
|
ufw_lan_tcp_ports:
|
|
- { port: 22, comment: "SSH" }
|
|
- { port: 80, comment: "Landing (Caddy)" }
|
|
- { port: 8080, comment: "qBittorrent" }
|
|
- { port: 8096, comment: "Jellyfin" }
|
|
- { port: 8989, comment: "Sonarr" }
|
|
- { port: 7878, comment: "Radarr" }
|
|
- { port: 9696, comment: "Prowlarr" }
|
|
- { port: 6767, comment: "Bazarr" }
|
|
- { port: 8686, comment: "Lidarr" }
|
|
- { port: 3000, comment: "Open WebUI" }
|
|
- { port: 8081, comment: "Bonsai llama-server" }
|
|
- { port: 3001, comment: "OpenHands (optional)" }
|
|
- { port: 3002, comment: "Forgejo HTTP" }
|
|
- { port: 2222, comment: "Forgejo Git SSH" }
|
|
- { port: 8085, comment: "SABnzbd" }
|
|
|
|
# WireGuard peer hostname for gluetun-endpoint-watch
|
|
wireguard_endpoint_host: las-183-wg.whiskergalaxy.com
|
|
wireguard_endpoint_port: "443"
|
|
|
|
# Tech demo shared credentials (local UIs)
|
|
demo_user: tim
|
|
demo_pass: asdfasdf
|
|
openai_api_key: sk-local-bonsai
|
|
|
|
# Forgejo (self-hosted Git)
|
|
forgejo_domain: "192.168.8.123"
|
|
forgejo_http_port: 3002
|
|
forgejo_ssh_port: 2222
|
|
forgejo_root_url: "http://{{ forgejo_domain }}:{{ forgejo_http_port }}/"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Stack deployment
|
|
# ---------------------------------------------------------------------------
|
|
# Deploy stack *code* to the server.
|
|
# git — /opt/stack is a clone of Forgejo (preferred; use `git pull` on ser5)
|
|
# rsync — push from the control machine (laptop) tree
|
|
stack_deploy_method: git
|
|
deploy_stack_files: true # master switch for code deploy tasks
|
|
|
|
# Forgejo remote used on the server (same host → prefer loopback SSH port)
|
|
stack_git_repo: "ssh://git@127.0.0.1:2222/tim/stack.git"
|
|
stack_git_branch: main
|
|
# Also accept the LAN URL if someone clones from another machine
|
|
stack_git_repo_lan: "ssh://git@192.168.8.123:2222/tim/stack.git"
|
|
|
|
# Paths on the control machine (the machine running ansible-playbook)
|
|
# Default: the arr-stack repo that contains this ansible/ directory
|
|
stack_src: "{{ playbook_dir | dirname }}"
|
|
|
|
# AI defaults for SER5 + Vulkan
|
|
bonsai_backend: vulkan
|
|
bonsai_ngl: "99"
|
|
bonsai_ctx: "16384"
|
|
bonsai_threads: "12"
|
|
bonsai_kv4: "0"
|
|
open_webui_auth: "true"
|
|
|
|
# Media subdirs under storage_root
|
|
media_subdirs:
|
|
- media/movies
|
|
- media/tv
|
|
- media/music
|
|
- torrents/movies
|
|
- torrents/tv
|
|
- torrents/music
|
|
- usenet/incomplete
|
|
- usenet/complete/movies
|
|
- usenet/complete/tv
|
|
- usenet/complete/music
|