/
/
/
Ansible role that deployes services on my runner machine
1---
2# Runner Services Role Defaults
3# Multi-service container deployment with NFS integration
4
5# ==============================================================================
6# GENERAL SETTINGS
7# ==============================================================================
8runner_enabled: true
9# Legacy variables - no longer used with consolidated structure
10# runner_docker_dir: "/docker/runner" # Now each service uses /docker/[service]
11# runner_data_dir: "/docker/runner-data" # Now consolidated into each service directory
12runner_nfs_mount_dir: "/mnt/docker"
13runner_user: "{{ ansible_user }}"
14runner_group: "users"
15runner_uid: 1000
16runner_gid: 1000
17
18# Timezone configuration
19runner_timezone: "Europe/Amsterdam"
20
21# Docker network for runner services
22runner_docker_network: "runner-network"
23runner_network_subnet: "172.20.0.0/16"
24
25# NFS Configuration
26runner_nfs_enabled: true
27runner_nas_host: "{{ vault_storage.nas_host | default('storage.home') }}"
28runner_nfs_options: "nfsvers=4.1,proto=tcp,hard,timeo=600,retrans=2,rsize=16777216,wsize=16777216,nconnect=8,noatime,_netdev"
29
30# ==============================================================================
31# NFS MOUNT CONFIGURATION
32# ==============================================================================
33runner_nfs_mounts:
34 - name: "frigate"
35 local_path: "{{ runner_nfs_mount_dir }}/frigate"
36 nfs_path: "/mnt/rstorage/cctv-data"
37 host: "{{ runner_nas_host }}"
38 options: "{{ runner_nfs_options }}"
39
40 - name: "immich"
41 local_path: "{{ runner_nfs_mount_dir }}/immich"
42 nfs_path: "/mnt/rstorage/media/pictures"
43 host: "{{ runner_nas_host }}"
44 options: "{{ runner_nfs_options }}"
45
46 - name: "forgejo"
47 local_path: "{{ runner_nfs_mount_dir }}/forgejo"
48 nfs_path: "/mnt/rstorage/code-repo"
49 host: "{{ runner_nas_host }}"
50 options: "{{ runner_nfs_options }}"
51
52 - name: "harbor"
53 local_path: "{{ runner_nfs_mount_dir }}/harbor"
54 nfs_path: "/mnt/rstorage/registry-data"
55 host: "{{ runner_nas_host }}"
56 options: "{{ runner_nfs_options }}"
57
58 - name: "cvat"
59 local_path: "{{ runner_nfs_mount_dir }}/cvat"
60 nfs_path: "/mnt/rstorage/cvat-datasets"
61 host: "{{ runner_nas_host }}"
62 options: "{{ runner_nfs_options }}"
63
64# ==============================================================================
65# SERVICE CONFIGURATIONS
66# ==============================================================================
67
68# LLM Stack - Unified Local AI Infrastructure
69llm_stack_enabled: true
70llm_stack_config_dir: "/docker/llm-stack"
71
72# Unified LLM Stack Configuration
73llm_stack_ollama_port: 9000
74llm_stack_openwebui_port: 9001
75llm_stack_litellm_port: 9002
76
77# Ollama - Local LLM Server
78llm_stack_ollama_data_dir: "{{ llm_stack_config_dir }}/ollama/data"
79# GPU configuration uses global gpu_enabled parameter
80llm_stack_ollama_default_model: "tinyllama"
81llm_stack_ollama_log_level: "info"
82
83# OpenWebUI - Web Interface for Ollama
84llm_stack_openwebui_data_dir: "{{ llm_stack_config_dir }}/openwebui/data"
85llm_stack_openwebui_name: "Local AI Assistant"
86llm_stack_openwebui_description: "Self-hosted AI chat interface"
87llm_stack_openwebui_author: "Home Assistant"
88llm_stack_openwebui_default_models: "tinyllama"
89llm_stack_openwebui_log_level: "info"
90
91# LiteLLM - Unified LLM Proxy
92llm_stack_litellm_data_dir: "{{ llm_stack_config_dir }}/litellm/data"
93llm_stack_litellm_model_list: "tinyllama"
94llm_stack_litellm_completion_model: "ollama/tinyllama"
95llm_stack_litellm_streaming_enabled: true
96llm_stack_litellm_log_level: "info"
97
98# Frigate - AI NVR System
99frigate_enabled: true
100frigate_port: 5000
101frigate_rtmp_port: 1935
102frigate_rtsp_port: 8554
103frigate_go2rtc_port: 1984
104frigate_config_dir: "/docker/frigate"
105frigate_data_dir: "{{ runner_nfs_mount_dir }}/frigate"
106frigate_mqtt_enabled: true
107frigate_mqtt_host: "{{ vault_runner.frigate_mqtt_host | default('192.168.34.94') }}"
108frigate_mqtt_port: "{{ vault_runner.frigate_mqtt_port | default(1883) }}"
109frigate_hardware_acceleration: "vaapi" # vaapi, nvdec, nvenc, qsv, or none
110
111# Frigate cameras configuration (from vault)
112frigate_cameras:
113 - name: "dining-room"
114 host: "{{ vault_runner.dining_room_camera_host | default('') }}"
115 username: "{{ vault_runner.dining_room_camera_user | default('') }}"
116 password: "{{ vault_runner.dining_room_camera_pass | default('') }}"
117 path: "/live0"
118 enabled: true
119
120 - name: "living-room"
121 host: "{{ vault_runner.living_room_camera_host | default('') }}"
122 username: "{{ vault_runner.living_room_camera_user | default('') }}"
123 password: "{{ vault_runner.living_room_camera_pass | default('') }}"
124 path: "/live0"
125 enabled: true
126
127 - name: "bed-room"
128 host: "{{ vault_runner.bed_room_camera_host | default('') }}"
129 username: "{{ vault_runner.bed_room_camera_user | default('') }}"
130 password: "{{ vault_runner.bed_room_camera_pass | default('') }}"
131 path: "/live0"
132 enabled: true
133
134 - name: "alina-office"
135 host: "{{ vault_runner.alina_office_camera_host | default('') }}"
136 username: "{{ vault_runner.alina_office_camera_user | default('') }}"
137 password: "{{ vault_runner.alina_office_camera_pass | default('') }}"
138 path: "/live0"
139 enabled: true
140
141 - name: "tapo-cam"
142 host: "{{ vault_runner.tapocam_host | default('') }}"
143 username: "{{ vault_runner.tapocam_user | default('') }}"
144 password: "{{ vault_runner.tapocam_pass | default('') }}"
145 path: "/stream1"
146 port: 554
147 enabled: true
148
149# Immich - Photo Management
150immich_enabled: true
151immich_server_port: 2283
152immich_ml_port: 3003
153immich_config_dir: "/docker/immich"
154immich_data_dir: "/docker/immich"
155immich_upload_dir: "{{ runner_nfs_mount_dir }}/immich"
156immich_db_name: "{{ vault_runner.postgres_db | default('') }}"
157immich_db_user: "{{ vault_runner.postgres_user | default('') }}"
158immich_redis_enabled: true
159immich_ml_enabled: true
160immich_facial_recognition: true
161immich_hardware_acceleration: "none" # none, vaapi, nvdec, nvenc, or qsv
162
163# Forgejo - Git Server
164forgejo_enabled: true
165forgejo_http_port: 3010
166forgejo_ssh_port: 2222
167forgejo_config_dir: "/docker/forgejo"
168forgejo_data_dir: "{{ runner_nfs_mount_dir }}/forgejo"
169forgejo_db_type: "sqlite3"
170forgejo_app_name: "Forgejo Git Service"
171forgejo_domain: "forgejo.home"
172forgejo_ssh_domain: "{{ ansible_default_ipv4.address }}"
173
174# Forgejo Runner Configuration
175forgejo_runner_enabled: true
176forgejo_runner_token: "AWPjaLooCGjNn6aOuDj6pFrMsp9vE7XLCW4PFIeF"
177forgejo_runner_name: "default-runner"
178forgejo_runner_capacity: 2
179forgejo_runner_loglevel: info
180forgejo_runner_base_image: ubuntu:22.04
181forgejo_runner_user: runner
182forgejo_runner_uid: 1000
183forgejo_runner_version: 9.1.1
184
185# Stirling-PDF - PDF Processing
186stirling_pdf_enabled: true
187stirling_pdf_port: 8080
188stirling_pdf_config_dir: "/docker/stirling-pdf"
189stirling_pdf_data_dir: "/docker/stirling-pdf"
190
191# Tandoor - Recipe Manager
192tandoor_enabled: true
193tandoor_port: 8010
194tandoor_config_dir: "/docker/tandoor"
195tandoor_data_dir: "/docker/tandoor"
196tandoor_media_dir: "{{ tandoor_data_dir }}/media"
197tandoor_static_dir: "{{ tandoor_data_dir }}/static"
198tandoor_db_engine: "django.db.backends.postgresql"
199
200# Ghost CMS - Headless CMS
201ghost_enabled: true
202ghost_port: 2368
203ghost_config_dir: "/docker/ghost"
204ghost_data_dir: "/docker/ghost"
205ghost_content_dir: "{{ ghost_data_dir }}/content"
206ghost_db_client: "mysql"
207ghost_db_host: "ghost-mysql"
208ghost_db_name: "ghost"
209ghost_db_user: "ghost"
210ghost_url: "http://ghost.home"
211
212cvat_config_dir: "/docker/cvat"
213# CVAT - Data labeling
214cvat_enabled: true
215
216cvat_repo_url: "https://github.com/cvat-ai/cvat.git"
217cvat_repo_version: "{{ cvat_image_tag }}"
218
219cvat_admin_username: admin
220cvat_admin_password: "{{ vault_runner.cvat_admin_password | default('change-me') }}"
221cvat_admin_email: "{{ vault_runner.cvat_admin_email | default('change-me') }}"
222
223# Networking / access
224cvat_domain: "cvat.home" # used by Traefik routing in CVAT compose
225cvat_http_port: 8990 # Traefik "web" entrypoint in the default compose
226cvat_https_enabled: false # add CVAT's https overlay when true
227
228cvat_share_dir: >-
229 {{ (runner_nfs_mounts
230 | selectattr('name','equalto','cvat')
231 | map(attribute='local_path')
232 | first)
233 | default(runner_nfs_mount_dir ~ '/cvat', true) }}
234
235# Versioning / images
236cvat_image_tag: "v2.44.3" # pulled via CVAT_VERSION; align with the git tag you run
237
238# Optional: serverless auto-annotation overlay (Nuclio/SAM/YOLO assist in CVAT)
239cvat_serverless_enabled: false
240
241# Optional: use an external Postgres instead of the bundled one
242cvat_external_db_enabled: false
243cvat_db_host: "postgres.internal"
244cvat_db_port: 5432
245cvat_db_name: "cvat"
246cvat_db_user: "cvat_user"
247cvat_db_password: "{{ vault_runner.cvat_db_password | default('change-me') }}"
248
249# Optional: expose Traefik dashboard (binds host port below)
250cvat_traefik_dashboard_enabled: false
251cvat_dashboard_port: 8899
252
253# Optional: GPU reservation for CVAT server container (you must have host GPU runtime ready)
254cvat_gpu_enabled: false
255cvat_gpu_driver: "nvidia"
256cvat_gpu_count: "all" # or a number like "1"
257
258# ==============================================================================
259# DATABASE CONFIGURATIONS
260# ==============================================================================
261
262# PostgreSQL (Immich)
263postgres_enabled: "{{ immich_enabled }}"
264postgres_config_dir: "/docker/immich/postgres"
265postgres_db: "{{ vault_runner.postgres_db | default('') }}"
266postgres_user: "{{ vault_runner.postgres_user | default('') }}"
267postgres_version: "14"
268
269# Redis (Immich)
270redis_enabled: "{{ immich_redis_enabled }}"
271redis_config_dir: "/docker/immich/redis"
272redis_port: 6379
273
274# MySQL (Ghost CMS)
275mysql_enabled: "{{ ghost_enabled }}"
276mysql_config_dir: "/docker/ghost/mysql"
277mysql_db: "{{ ghost_db_name }}"
278mysql_user: "{{ ghost_db_user }}"
279mysql_version: "8.0"
280
281# ==============================================================================
282# SECURITY SETTINGS (FROM VAULT)
283# ==============================================================================
284
285# Database passwords
286postgres_password: "{{ vault_runner.postgres_password | default('') }}"
287mysql_password: "{{ vault_runner.mysql_password | default('') }}"
288mysql_root_password: "{{ vault_runner.mysql_root_password | default('') }}"
289
290# Service secrets
291immich_jwt_secret: "{{ vault_runner.immich_jwt_secret | default('') }}"
292ghost_database_password: "{{ vault_runner.ghost_database_password | default('') }}"
293tandoor_secret_key: "{{ vault_runner.tandoor_secret_key | default('') }}"
294
295# MQTT credentials (from vault) - centralized definitions
296frigate_mqtt_username: "{{ vault_runner.frigate_mqtt_username | default('') }}"
297frigate_mqtt_password: "{{ vault_runner.frigate_mqtt_password | default('') }}"
298
299# ==============================================================================
300# DIRECTORY STRUCTURE
301# ==============================================================================
302
303# Local configuration directories
304runner_config_directories:
305 - "{{ llm_stack_config_dir }}"
306 - "{{ llm_stack_ollama_data_dir }}"
307 - "{{ llm_stack_openwebui_data_dir }}"
308 - "{{ llm_stack_litellm_data_dir }}"
309 - "{{ frigate_config_dir }}"
310 - "{{ immich_config_dir }}"
311 - "{{ immich_config_dir }}/postgres"
312 - "{{ immich_config_dir }}/redis"
313 - "{{ immich_config_dir }}/library"
314 - "{{ immich_config_dir }}/cache"
315 - "{{ immich_config_dir }}/model-cache"
316 - "{{ immich_config_dir }}/postgres-init"
317 - "{{ forgejo_config_dir }}"
318 - "{{ forgejo_config_dir }}/forgejo-runner-data"
319 - "{{ stirling_pdf_config_dir }}"
320 - "{{ tandoor_config_dir }}"
321 - "{{ tandoor_data_dir }}/db"
322 - "{{ tandoor_data_dir }}/media"
323 - "{{ tandoor_data_dir }}/static"
324 - "{{ ghost_config_dir }}/config"
325 - "{{ ghost_config_dir }}/content"
326 - "{{ ghost_config_dir }}/mysql"
327
328# NFS mount directories
329runner_nfs_directories:
330 - "{{ runner_nfs_mount_dir }}"
331 - "{{ runner_nfs_mount_dir }}/frigate"
332 - "{{ runner_nfs_mount_dir }}/immich"
333 - "{{ runner_nfs_mount_dir }}/forgejo"
334 - "{{ runner_nfs_mount_dir }}/harbor"
335 - "{{ runner_nfs_mount_dir }}/cvat"
336
337# ==============================================================================
338# PERFORMANCE SETTINGS
339# ==============================================================================
340
341# Network performance tuning for NFS
342runner_performance_tuning_enabled: true
343runner_sysctl_settings:
344 # Extreme performance network buffers for Ryzen 7 + 32GB RAM
345 net.core.rmem_max: 268435456 # 256MB socket receive buffer
346 net.core.wmem_max: 268435456 # 256MB socket send buffer
347 net.core.rmem_default: 33554432 # 32MB default receive buffer
348 net.core.wmem_default: 33554432 # 32MB default send buffer
349 net.ipv4.tcp_rmem: "4096 131072 268435456" # TCP receive: 4KB min, 128KB default, 256MB max
350 net.ipv4.tcp_wmem: "4096 131072 268435456" # TCP send: 4KB min, 128KB default, 256MB max
351 net.core.netdev_max_backlog: 30000 # Handle high connection burst (32 connections)
352 net.ipv4.tcp_congestion_control: "bbr" # BBR congestion control
353 net.ipv4.tcp_window_scaling: 1 # Enable TCP window scaling
354 net.ipv4.tcp_timestamps: 1 # Enable TCP timestamps for RTT calculation
355 net.ipv4.tcp_sack: 1 # Enable selective acknowledgments
356 # NFS client cache tuning for 32GB RAM
357 vm.dirty_background_ratio: 3 # Start writeback at 3% (more aggressive)
358 vm.dirty_ratio: 8 # Force writeback at 8% (more aggressive)
359 vm.vfs_cache_pressure: 25 # Keep even more file cache (25% vs 50%)
360 vm.min_free_kbytes: 131072 # Keep 128MB free for network buffers
361
362# Harbor Configuration (external deployment)
363harbor_enabled: true
364harbor_config_dir: "/docker/harbor"
365harbor_version: "2.13.0"
366harbor_hostname: "registry.local"
367harbor_http_port: 8080
368harbor_registry_port: 5000
369harbor_admin_password: "Harbor12345"
370harbor_checksum: "b4a3b0e7d8e3a8b1c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1"
371
372# ==============================================================================
373# CONTAINER IMAGES
374# ==============================================================================
375
376# Centralized container image mapping for version control
377# Note: Frigate and Immich use conditional images based on hardware acceleration
378container_images:
379
380 # LLM Stack services
381 ollama: "ollama/ollama:latest"
382 openwebui: "ghcr.io/open-webui/open-webui:main"
383 litellm: "ghcr.io/berriai/litellm:main-latest"
384
385 # Core services
386 forgejo: "codeberg.org/forgejo/forgejo:12"
387 forgejo_runner: "data.forgejo.org/forgejo/runner:9.1.1"
388
389 # Productivity services
390 stirling_pdf: "frooodle/s-pdf:latest"
391 tandoor: "vabene1111/recipes:latest"
392 ghost: "ghost:5-alpine"
393
394 # Database services
395 postgres: "postgres:14-alpine"
396 mysql: "mysql:8.0"
397 redis: "redis:7-alpine"
398
399# Docker resource limits
400default_memory_limit: "1g"
401default_cpu_limit: "1"
402
403# Health check configuration
404health_check_interval: "30s"
405health_check_timeout: "30s"
406health_check_retries: 5
407health_check_start_period: "60s"
408
409# ==============================================================================
410# SERVICE HEALTH ENDPOINTS
411# ==============================================================================
412service_endpoints:
413 ollama: "http://localhost:{{ llm_stack_ollama_port }}/api/tags"
414 openwebui: "http://localhost:{{ llm_stack_openwebui_port }}/api/health"
415 litellm: "http://localhost:{{ llm_stack_litellm_port }}/"
416 frigate: "http://localhost:{{ frigate_port }}/api/config"
417 immich: "http://localhost:{{ immich_server_port }}/api/server-info/ping"
418 forgejo: "http://localhost:{{ forgejo_http_port }}/api/v1/version"
419 stirling_pdf: "http://localhost:{{ stirling_pdf_port }}/api/v1/info/status"
420 tandoor: "http://localhost:{{ tandoor_port }}/accounts/login/"
421 ghost: "http://localhost:{{ ghost_port }}/ghost/api/admin/site/"
422
423# ==============================================================================
424# LOGGING CONFIGURATION
425# ==============================================================================
426logging_driver: "json-file"
427logging_max_size: "10m"
428logging_max_file: "3"
429
430# Service-specific logging levels (unified LLM stack uses llm_stack_* variables)
431# ollama_log_level: "info" # Now uses llm_stack_ollama_log_level
432# openwebui_log_level: "info" # Now uses llm_stack_openwebui_log_level
433# litellm_log_level: "info" # Now uses llm_stack_litellm_log_level
434frigate_log_level: "info"
435immich_log_level: "log"
436forgejo_log_level: "Info"
437ghost_logging: "info"
438
439