/
/
/
Ansible role that deployes services on my runner machine
1---
2# Runner Services Role Defaults
3# Multi-service container deployment with NFS integration
4
5# ==============================================================================
6# GENERAL SETTINGS
7# ==============================================================================
8runner_enabled: true
9# Legacy variables - no longer used with consolidated structure
10# runner_docker_dir: "/docker/runner" # Now each service uses /docker/[service]
11# runner_data_dir: "/docker/runner-data" # Now consolidated into each service directory
12runner_nfs_mount_dir: "/mnt/docker"
13runner_snapshot_dir: "{{ runner_nfs_mount_dir }}/frigate/snapshots"
14runner_user: "{{ ansible_user }}"
15runner_group: "users"
16runner_uid: 1000
17runner_gid: 1000
18
19# Timezone configuration
20runner_timezone: "{{ system_timezone }}"
21
22# Docker network for runner services
23runner_docker_network: "runner-network"
24runner_network_subnet: "172.20.0.0/16"
25
26# NFS Configuration
27runner_nfs_enabled: true
28runner_nas_host: "{{ vault_storage.nas_host | default('storage.home') }}"
29runner_nfs_options: "nfsvers=4.1,proto=tcp,hard,timeo=600,retrans=2,rsize=16777216,wsize=16777216,nconnect=8,noatime,_netdev"
30
31# ==============================================================================
32# NFS MOUNT CONFIGURATION
33# ==============================================================================
34runner_nfs_mounts:
35 - name: "frigate"
36 local_path: "{{ runner_nfs_mount_dir }}/frigate"
37 nfs_path: "/mnt/rstorage/cctv-data"
38 host: "{{ runner_nas_host }}"
39 options: "{{ runner_nfs_options }}"
40
41 - name: "immich"
42 local_path: "{{ runner_nfs_mount_dir }}/immich"
43 nfs_path: "/mnt/rstorage/media/pictures"
44 host: "{{ runner_nas_host }}"
45 options: "{{ runner_nfs_options }}"
46
47 - name: "forgejo"
48 local_path: "{{ runner_nfs_mount_dir }}/forgejo"
49 nfs_path: "/mnt/rstorage/code-repo"
50 host: "{{ runner_nas_host }}"
51 options: "{{ runner_nfs_options }}"
52
53 - name: "harbor"
54 local_path: "{{ runner_nfs_mount_dir }}/harbor"
55 nfs_path: "/mnt/rstorage/registry-data"
56 host: "{{ runner_nas_host }}"
57 options: "{{ runner_nfs_options }}"
58
59 - name: "cvat"
60 local_path: "{{ runner_nfs_mount_dir }}/cvat"
61 nfs_path: "/mnt/rstorage/cvat-datasets"
62 host: "{{ runner_nas_host }}"
63 options: "{{ runner_nfs_options }}"
64
65# ==============================================================================
66# SERVICE CONFIGURATIONS
67# ==============================================================================
68
69# LLM Stack - Unified Local AI Infrastructure
70llm_stack_enabled: true
71llm_stack_config_dir: "/docker/llm-stack"
72
73# Unified LLM Stack Configuration
74llm_stack_ollama_port: 9000
75llm_stack_openwebui_port: 9001
76llm_stack_litellm_port: 9002
77
78# Ollama - Local LLM Server
79llm_stack_ollama_data_dir: "{{ llm_stack_config_dir }}/ollama/data"
80# GPU configuration uses global gpu_enabled parameter
81llm_stack_ollama_default_model: "tinyllama"
82llm_stack_ollama_log_level: "info"
83
84# OpenWebUI - Web Interface for Ollama
85llm_stack_openwebui_data_dir: "{{ llm_stack_config_dir }}/openwebui/data"
86llm_stack_openwebui_name: "Local AI Assistant"
87llm_stack_openwebui_description: "Self-hosted AI chat interface"
88llm_stack_openwebui_author: "Home Assistant"
89llm_stack_openwebui_default_models: "tinyllama"
90llm_stack_openwebui_log_level: "info"
91
92# LiteLLM - Unified LLM Proxy
93llm_stack_litellm_data_dir: "{{ llm_stack_config_dir }}/litellm/data"
94llm_stack_litellm_model_list: "tinyllama"
95llm_stack_litellm_completion_model: "ollama/tinyllama"
96llm_stack_litellm_streaming_enabled: true
97llm_stack_litellm_log_level: "info"
98
99# Frigate - AI NVR System
100frigate_enabled: true
101frigate_port: 5000
102frigate_rtmp_port: 1935
103frigate_rtsp_port: 8554
104frigate_go2rtc_port: 1984
105frigate_config_dir: "/docker/frigate"
106frigate_data_dir: "{{ runner_nfs_mount_dir }}/frigate"
107frigate_mqtt_enabled: true
108mqtt_host: "homeassistant.home"
109mqtt_port: 1883
110frigate_hardware_acceleration: "vaapi" # vaapi, nvdec, nvenc, qsv, or none
111
112# Frigate ONVIF default settings
113frigate_onvif_autotracking: false
114
115# Frigate cameras configuration (from vault)
116frigate_cameras:
117 - name: "dining-room"
118 host: "{{ vault_runner.dining_room_camera_host | default('') }}"
119 username: "{{ vault_runner.dining_room_camera_user | default('') }}"
120 password: "{{ vault_runner.dining_room_camera_pass | default('') }}"
121 path: "/live0"
122 enabled: true
123
124 - name: "living-room"
125 host: "{{ vault_runner.living_room_camera_host | default('') }}"
126 username: "{{ vault_runner.living_room_camera_user | default('') }}"
127 password: "{{ vault_runner.living_room_camera_pass | default('') }}"
128 path: "/live0"
129 enabled: true
130
131 - name: "bed-room"
132 host: "{{ vault_runner.bed_room_camera_host | default('') }}"
133 username: "{{ vault_runner.bed_room_camera_user | default('') }}"
134 password: "{{ vault_runner.bed_room_camera_pass | default('') }}"
135 path: "/live0"
136 enabled: true
137
138 - name: "alina-office"
139 host: "{{ vault_runner.alina_office_camera_host | default('') }}"
140 username: "{{ vault_runner.alina_office_camera_user | default('') }}"
141 password: "{{ vault_runner.alina_office_camera_pass | default('') }}"
142 path: "/live0"
143 enabled: true
144
145 - name: "tapo-cam"
146 host: "{{ vault_runner.tapocam_host | default('') }}"
147 username: "{{ vault_runner.tapocam_user | default('') }}"
148 password: "{{ vault_runner.tapocam_pass | default('') }}"
149 path: "/stream1"
150 port: 554
151 enabled: true
152
153 - name: "tapo-test-cam"
154 host: "{{ vault_runner.tapo_test_cam_host | default('') }}"
155 username: "{{ vault_runner.tapo_test_cam_user | default('') }}"
156 password: "{{ vault_runner.tapo_test_cam_pass | default('') }}"
157 path: "/stream1"
158 port: 554
159 enabled: true
160 detect_enabled: false
161
162 - name: "pi-cam"
163 host: "{{ vault_runner.pi_cam_host | default('') }}"
164 username: "{{ vault_runner.pi_cam_user | default('') }}"
165 password: "{{ vault_runner.pi_cam_pass | default('') }}"
166 path: "{{ vault_runner.pi_cam_path | default('/doorbell') }}"
167 port: 8554
168 enabled: true
169 detect_enabled: false
170
171# Cameras with ONVIF support (for PTZ control)
172frigate_onvif_cameras:
173 - name: "tapo-cam"
174 host: "{{ vault_runner.tapocam_host | default('') }}"
175 port: 2020
176 username: "{{ vault_runner.tapocam_user | default('') }}"
177 password: "{{ vault_runner.tapocam_pass | default('') }}"
178 - name: "tapo-test-cam"
179 host: "{{ vault_runner.tapo_test_cam_host | default('') }}"
180 port: 2020
181 username: "{{ vault_runner.tapo_test_cam_user | default('') }}"
182 password: "{{ vault_runner.tapo_test_cam_pass | default('') }}"
183
184# Cameras for snapshot container (comma-separated)
185frigate_snapshot_cameras:
186 - "living-room"
187 - "dining-room"
188 - "bed-room"
189 - "alina-office"
190
191# Per-camera record override (cameras listed here have recording disabled)
192frigate_cameras_record_disabled:
193 - "bed-room"
194
195# Immich - Photo Management
196immich_enabled: true
197immich_server_port: 2283
198immich_ml_port: 3003
199immich_config_dir: "/docker/immich"
200immich_data_dir: "/docker/immich"
201immich_upload_dir: "{{ runner_nfs_mount_dir }}/immich/library"
202immich_db_name: "{{ vault_runner.postgres_db | default('') }}"
203immich_db_user: "{{ vault_runner.postgres_user | default('') }}"
204immich_redis_enabled: true
205immich_ml_enabled: true
206immich_facial_recognition: true
207immich_hardware_acceleration: "none" # none, vaapi, nvdec, nvenc, or qsv
208
209# External library mounts (read-only photo libraries from NFS)
210immich_external_libraries:
211 - name: "yannick"
212 host_path: "{{ runner_nfs_mount_dir }}/immich/yannick"
213 container_path: "/yannick"
214 - name: "alina"
215 host_path: "{{ runner_nfs_mount_dir }}/immich/alina"
216 container_path: "/alina"
217
218# Forgejo - Git Server
219forgejo_enabled: true
220forgejo_http_port: 3010
221forgejo_ssh_port: 2222
222forgejo_config_dir: "/docker/forgejo"
223forgejo_data_dir: "{{ runner_nfs_mount_dir }}/forgejo"
224forgejo_db_type: "sqlite3"
225forgejo_app_name: "Forgejo Git Service"
226forgejo_domain: "forgejo.home"
227forgejo_ssh_domain: "{{ ansible_default_ipv4.address }}"
228
229# Forgejo Runner Configuration
230forgejo_runner_enabled: true
231forgejo_runner_token: "{{ vault_runner.forgejo_runner_token | default('changeme') }}"
232forgejo_runner_name: "default-runner"
233forgejo_runner_capacity: 2
234forgejo_runner_loglevel: info
235forgejo_runner_base_image: ubuntu:22.04
236forgejo_runner_user: runner
237forgejo_runner_uid: 1000
238forgejo_runner_version: 9.1.1
239
240# Forgejo Ansible Runner (for running Ansible playbooks in CI)
241forgejo_ansible_runner_enabled: true
242forgejo_ansible_runner_token: "{{ vault_runner.forgejo_ansible_runner_token | default('changeme') }}"
243forgejo_ansible_runner_name: "ansible-runner"
244forgejo_ansible_runner_capacity: 1
245forgejo_ansible_runner_version: 9.1.1
246
247# Stirling-PDF - PDF Processing
248stirling_pdf_enabled: true
249stirling_pdf_port: 8080
250stirling_pdf_config_dir: "/docker/stirling-pdf"
251stirling_pdf_data_dir: "/docker/stirling-pdf"
252
253# Tandoor - Recipe Manager
254tandoor_enabled: true
255tandoor_port: 8010
256tandoor_config_dir: "/docker/tandoor"
257tandoor_data_dir: "/docker/tandoor"
258tandoor_media_dir: "{{ tandoor_data_dir }}/media"
259tandoor_static_dir: "{{ tandoor_data_dir }}/static"
260tandoor_db_engine: "django.db.backends.postgresql"
261
262# Ghost CMS - Headless CMS
263ghost_enabled: true
264ghost_port: 2368
265ghost_config_dir: "/docker/ghost"
266ghost_data_dir: "/docker/ghost"
267ghost_content_dir: "{{ ghost_data_dir }}/content"
268ghost_db_client: "mysql"
269ghost_db_host: "ghost-mysql"
270ghost_db_name: "ghost"
271ghost_db_user: "ghost"
272ghost_url: "http://ghost.home"
273
274cvat_config_dir: "/docker/cvat"
275# CVAT - Data labeling
276cvat_enabled: true
277
278cvat_repo_url: "https://github.com/cvat-ai/cvat.git"
279cvat_repo_version: "{{ cvat_image_tag }}"
280
281cvat_admin_username: admin
282cvat_admin_password: "{{ vault_runner.cvat_admin_password | default('change-me') }}"
283cvat_admin_email: "{{ vault_runner.cvat_admin_email | default('change-me') }}"
284
285# Networking / access
286cvat_domain: "cvat.home" # used by Traefik routing in CVAT compose
287cvat_http_port: 8990 # Traefik "web" entrypoint in the default compose
288cvat_https_enabled: false # add CVAT's https overlay when true
289
290cvat_share_dir: >-
291 {{ (runner_nfs_mounts
292 | selectattr('name','equalto','cvat')
293 | map(attribute='local_path')
294 | first)
295 | default(runner_nfs_mount_dir ~ '/cvat', true) }}
296
297# Versioning / images
298cvat_image_tag: "v2.44.3" # pulled via CVAT_VERSION; align with the git tag you run
299
300# Optional: serverless auto-annotation overlay (Nuclio/SAM/YOLO assist in CVAT)
301cvat_serverless_enabled: false
302
303# Optional: use an external Postgres instead of the bundled one
304cvat_external_db_enabled: false
305cvat_db_host: "postgres.internal"
306cvat_db_port: 5432
307cvat_db_name: "cvat"
308cvat_db_user: "cvat_user"
309cvat_db_password: "{{ vault_runner.cvat_db_password | default('change-me') }}"
310
311# Optional: expose Traefik dashboard (binds host port below)
312cvat_traefik_dashboard_enabled: false
313cvat_dashboard_port: 8899
314
315# Optional: GPU reservation for CVAT server container (you must have host GPU runtime ready)
316cvat_gpu_enabled: false
317cvat_gpu_driver: "nvidia"
318cvat_gpu_count: "all" # or a number like "1"
319
320# ==============================================================================
321# DATABASE CONFIGURATIONS
322# ==============================================================================
323
324# PostgreSQL (Immich)
325postgres_enabled: "{{ immich_enabled }}"
326postgres_config_dir: "/docker/immich/postgres"
327postgres_db: "{{ vault_runner.postgres_db | default('') }}"
328postgres_user: "{{ vault_runner.postgres_user | default('') }}"
329postgres_version: "14"
330
331# Redis (Immich)
332redis_enabled: "{{ immich_redis_enabled }}"
333redis_config_dir: "/docker/immich/redis"
334redis_port: 6379
335
336# MySQL (Ghost CMS)
337mysql_enabled: "{{ ghost_enabled }}"
338mysql_config_dir: "/docker/ghost/mysql"
339mysql_db: "{{ ghost_db_name }}"
340mysql_user: "{{ ghost_db_user }}"
341mysql_version: "8.0"
342
343# ==============================================================================
344# SECURITY SETTINGS (FROM VAULT)
345# ==============================================================================
346
347# Database passwords
348postgres_password: "{{ vault_runner.postgres_password | default('') }}"
349mysql_password: "{{ vault_runner.mysql_password | default('') }}"
350mysql_root_password: "{{ vault_runner.mysql_root_password | default('') }}"
351
352# Service secrets
353immich_jwt_secret: "{{ vault_runner.immich_jwt_secret | default('') }}"
354ghost_database_password: "{{ vault_runner.ghost_database_password | default('') }}"
355tandoor_secret_key: "{{ vault_runner.tandoor_secret_key | default('') }}"
356
357# MQTT credentials (from vault - top-level, shared across all roles)
358mqtt_username: ""
359mqtt_password: ""
360
361# ==============================================================================
362# DIRECTORY STRUCTURE
363# ==============================================================================
364
365# Local configuration directories
366runner_config_directories:
367 - "{{ llm_stack_config_dir }}"
368 - "{{ llm_stack_ollama_data_dir }}"
369 - "{{ llm_stack_openwebui_data_dir }}"
370 - "{{ llm_stack_litellm_data_dir }}"
371 - "{{ frigate_config_dir }}"
372 - "{{ immich_config_dir }}"
373 - "{{ immich_config_dir }}/postgres"
374 - "{{ immich_config_dir }}/redis"
375 - "{{ immich_config_dir }}/library"
376 - "{{ immich_config_dir }}/cache"
377 - "{{ immich_config_dir }}/model-cache"
378 - "{{ immich_config_dir }}/postgres-init"
379 - "{{ forgejo_config_dir }}"
380 - "{{ forgejo_config_dir }}/forgejo-runner-data"
381 - "{{ forgejo_config_dir }}/forgejo-ansible-runner-data"
382 - "{{ stirling_pdf_config_dir }}"
383 - "{{ tandoor_config_dir }}"
384 - "{{ tandoor_data_dir }}/db"
385 - "{{ tandoor_data_dir }}/media"
386 - "{{ tandoor_data_dir }}/static"
387 - "{{ ghost_config_dir }}/config"
388 - "{{ ghost_config_dir }}/content"
389 - "{{ ghost_config_dir }}/mysql"
390
391# NFS mount directories
392runner_nfs_directories:
393 - "{{ runner_nfs_mount_dir }}"
394 - "{{ runner_nfs_mount_dir }}/frigate"
395 - "{{ runner_nfs_mount_dir }}/immich"
396 - "{{ runner_nfs_mount_dir }}/forgejo"
397 - "{{ runner_nfs_mount_dir }}/harbor"
398 - "{{ runner_nfs_mount_dir }}/cvat"
399
400# ==============================================================================
401# PERFORMANCE SETTINGS
402# ==============================================================================
403
404# Network performance tuning for NFS
405runner_performance_tuning_enabled: true
406runner_sysctl_settings:
407 # Extreme performance network buffers for Ryzen 7 + 32GB RAM
408 net.core.rmem_max: 268435456 # 256MB socket receive buffer
409 net.core.wmem_max: 268435456 # 256MB socket send buffer
410 net.core.rmem_default: 33554432 # 32MB default receive buffer
411 net.core.wmem_default: 33554432 # 32MB default send buffer
412 net.ipv4.tcp_rmem: "4096 131072 268435456" # TCP receive: 4KB min, 128KB default, 256MB max
413 net.ipv4.tcp_wmem: "4096 131072 268435456" # TCP send: 4KB min, 128KB default, 256MB max
414 net.core.netdev_max_backlog: 30000 # Handle high connection burst (32 connections)
415 net.ipv4.tcp_congestion_control: "bbr" # BBR congestion control
416 net.ipv4.tcp_window_scaling: 1 # Enable TCP window scaling
417 net.ipv4.tcp_timestamps: 1 # Enable TCP timestamps for RTT calculation
418 net.ipv4.tcp_sack: 1 # Enable selective acknowledgments
419 # NFS client cache tuning for 32GB RAM
420 vm.dirty_background_ratio: 3 # Start writeback at 3% (more aggressive)
421 vm.dirty_ratio: 8 # Force writeback at 8% (more aggressive)
422 vm.vfs_cache_pressure: 25 # Keep even more file cache (25% vs 50%)
423 vm.min_free_kbytes: 131072 # Keep 128MB free for network buffers
424
425# Harbor Configuration (external deployment)
426harbor_enabled: true
427harbor_config_dir: "/docker/harbor"
428harbor_version: "2.13.2"
429harbor_hostname: "{{ vault_runner.harbor_hostname | default('registry.local') }}"
430harbor_http_port: 8080
431harbor_registry_port: 5000
432harbor_admin_password: "{{ vault_runner.harbor_admin_password | default('changeme') }}"
433harbor_db_password: "{{ vault_runner.harbor_db_password | default('changeme') }}"
434harbor_data_volume: "{{ runner_nfs_mount_dir }}/harbor"
435
436# Docker resource limits
437default_memory_limit: "1g"
438default_cpu_limit: "1"
439
440# Health check configuration
441health_check_interval: "30s"
442health_check_timeout: "30s"
443health_check_retries: 5
444health_check_start_period: "60s"
445
446# ==============================================================================
447# SERVICE HEALTH ENDPOINTS
448# ==============================================================================
449service_endpoints:
450 ollama: "http://localhost:{{ llm_stack_ollama_port }}/api/tags"
451 openwebui: "http://localhost:{{ llm_stack_openwebui_port }}/api/health"
452 litellm: "http://localhost:{{ llm_stack_litellm_port }}/"
453 frigate: "http://localhost:{{ frigate_port }}/api/config"
454 immich: "http://localhost:{{ immich_server_port }}/api/server-info/ping"
455 forgejo: "http://localhost:{{ forgejo_http_port }}/api/v1/version"
456 stirling_pdf: "http://localhost:{{ stirling_pdf_port }}/api/v1/info/status"
457 tandoor: "http://localhost:{{ tandoor_port }}/accounts/login/"
458 ghost: "http://localhost:{{ ghost_port }}/ghost/api/admin/site/"
459
460# ==============================================================================
461# LOGGING CONFIGURATION
462# ==============================================================================
463logging_driver: "json-file"
464logging_max_size: "10m"
465logging_max_file: "3"
466
467# Service-specific logging levels (unified LLM stack uses llm_stack_* variables)
468# ollama_log_level: "info" # Now uses llm_stack_ollama_log_level
469# openwebui_log_level: "info" # Now uses llm_stack_openwebui_log_level
470# litellm_log_level: "info" # Now uses llm_stack_litellm_log_level
471frigate_log_level: "info"
472immich_log_level: "log"
473forgejo_log_level: "Info"
474ghost_logging: "info"
475
476