/
/
/
Ansible role that deployes services on my runner machine
1---
2# Runner Services Role Defaults
3# Multi-service container deployment with NFS integration
4
5# ==============================================================================
6# GENERAL SETTINGS
7# ==============================================================================
8runner_enabled: true
9# Legacy variables - no longer used with consolidated structure
10# runner_docker_dir: "/docker/runner" # Now each service uses /docker/[service]
11# runner_data_dir: "/docker/runner-data" # Now consolidated into each service directory
12runner_nfs_mount_dir: "/mnt/docker"
13runner_snapshot_dir: "{{ runner_nfs_mount_dir }}/frigate/snapshots"
14runner_user: "{{ ansible_user }}"
15runner_group: "users"
16runner_uid: 1000
17runner_gid: 1000
18
19# Timezone configuration
20runner_timezone: "{{ system_timezone }}"
21
22# Docker network for runner services
23runner_docker_network: "runner-network"
24runner_network_subnet: "172.20.0.0/16"
25
26# NFS Configuration
27runner_nfs_enabled: true
28runner_nas_host: "{{ vault_storage.nas_host | default('storage.home') }}"
29runner_nfs_options: "nfsvers=4.1,proto=tcp,hard,timeo=600,retrans=2,rsize=16777216,wsize=16777216,nconnect=8,noatime,_netdev"
30
31# ==============================================================================
32# NFS MOUNT CONFIGURATION
33# ==============================================================================
34runner_nfs_mounts:
35 - name: "frigate"
36 local_path: "{{ runner_nfs_mount_dir }}/frigate"
37 nfs_path: "/mnt/rstorage/cctv-data"
38 host: "{{ runner_nas_host }}"
39 options: "{{ runner_nfs_options }}"
40
41 - name: "immich"
42 local_path: "{{ runner_nfs_mount_dir }}/immich"
43 nfs_path: "/mnt/rstorage/media/pictures"
44 host: "{{ runner_nas_host }}"
45 options: "{{ runner_nfs_options }}"
46
47 - name: "forgejo"
48 local_path: "{{ runner_nfs_mount_dir }}/forgejo"
49 nfs_path: "/mnt/rstorage/code-repo"
50 host: "{{ runner_nas_host }}"
51 options: "{{ runner_nfs_options }}"
52
53 - name: "harbor"
54 local_path: "{{ runner_nfs_mount_dir }}/harbor"
55 nfs_path: "/mnt/rstorage/registry-data"
56 host: "{{ runner_nas_host }}"
57 options: "{{ runner_nfs_options }}"
58
59 - name: "cvat"
60 local_path: "{{ runner_nfs_mount_dir }}/cvat"
61 nfs_path: "/mnt/rstorage/cvat-datasets"
62 host: "{{ runner_nas_host }}"
63 options: "{{ runner_nfs_options }}"
64
65 # D&D session agent: ambience, effects, recordings, transcripts and the
66 # campaign knowledge base all live under one mount.
67 - name: "dnd"
68 local_path: "{{ runner_nfs_mount_dir }}/dnd"
69 nfs_path: "/mnt/rstorage/media/dnd"
70 host: "{{ runner_nas_host }}"
71 options: "{{ runner_nfs_options }}"
72
73# ==============================================================================
74# SERVICE CONFIGURATIONS
75# ==============================================================================
76
77# LLM Stack - Unified Local AI Infrastructure
78llm_stack_enabled: true
79llm_stack_config_dir: "/docker/llm-stack"
80
81# Unified LLM Stack Configuration
82llm_stack_ollama_port: 9000
83llm_stack_openwebui_port: 9001
84llm_stack_litellm_port: 9002
85
86# Ollama - Local LLM Server
87llm_stack_ollama_data_dir: "{{ llm_stack_config_dir }}/ollama/data"
88# GPU configuration uses global gpu_enabled parameter
89llm_stack_ollama_default_model: "qwen3:14b"
90llm_stack_ollama_keep_alive: "1h"
91llm_stack_ollama_log_level: "info"
92
93# Pull declared models on deploy. Only models absent from Ollama are fetched,
94# so re-runs are cheap. Set false to manage the model set by hand.
95llm_stack_pull_models: true
96llm_stack_model_pull_timeout: 3600
97
98# Model lineup
99llm_stack_models:
100 - name: "qwen3:14b"
101 role: "default"
102 description: "General-purpose daily driver"
103 - name: "phi4:14b"
104 role: "coder"
105 description: "Coding and analytical tasks"
106 - name: "qwen2.5-coder:14b"
107 role: "coder"
108 description: "Coding specialist (Qwen 2.5 generation)"
109 - name: "deepseek-r1:14b"
110 role: "reasoning"
111 description: "Complex reasoning and chain-of-thought"
112 - name: "qwen3:8b"
113 role: "fast"
114 description: "Lightweight fast tasks"
115 - name: "qwen3:4b"
116 role: "minimal"
117 description: "Quick lightweight tasks; D&D live cue selection"
118 - name: "qwen2.5vl:7b"
119 role: "vision"
120 description: "Battlemap frame understanding for session chronicles"
121
122# OpenWebUI - Web Interface for Ollama
123llm_stack_openwebui_data_dir: "{{ llm_stack_config_dir }}/openwebui/data"
124llm_stack_openwebui_name: "Local AI Assistant"
125llm_stack_openwebui_description: "Self-hosted AI chat interface"
126llm_stack_openwebui_author: "Home Assistant"
127llm_stack_openwebui_default_models: "qwen3:14b"
128llm_stack_openwebui_log_level: "info"
129
130# LiteLLM - Unified LLM Proxy
131llm_stack_litellm_data_dir: "{{ llm_stack_config_dir }}/litellm/data"
132llm_stack_litellm_streaming_enabled: true
133llm_stack_litellm_log_level: "info"
134
135# =============================================================================
136# D&D Session Agent - The Thaumaturgeon
137# One compose project, one switch: dnd_enabled: false removes all of it.
138# =============================================================================
139dnd_enabled: false
140dnd_config_dir: "/docker/dnd"
141
142# Ambience, effects, recordings, transcripts and the campaign knowledge base
143# all live on the NAS under one mount.
144dnd_media_dir: "{{ runner_nfs_mount_dir }}/dnd"
145
146# Files written here are read by people and by the storage host, so the
147# container runs as the storage owner rather than root.
148dnd_uid: 1000
149dnd_gid: 100
150
151# The LiveKit room the agent joins. A stable name, not the random id Meet's
152# "Start Meeting" button generates.
153dnd_room: "dnd"
154dnd_avatar_url: "{{ 'https://' ~ livekit_domain ~ '/' ~ livekit_agent_avatar_filename }}"
155
156# Built on the runner from a checkout: the application changes far more often
157# than the infrastructure around it.
158dnd_build_from_source: true
159dnd_build_images: true
160dnd_source_dir: "/home/yannick/personal/dnd-agent"
161dnd_agent_version: "0.1.0"
162
163# Post-session processing
164dnd_chronicle_model: "qwen3:14b"
165dnd_model_dir: "{{ dnd_config_dir }}/models"
166# cuda when the driver matches torch's build; cpu still runs above realtime.
167dnd_diarize_device: "cuda"
168
169# Speech to text (Speaches / faster-whisper). Generic and OpenAI-compatible,
170# so anything else on the runner can use it too.
171dnd_stt_model_dir: "{{ dnd_config_dir }}/stt-models"
172dnd_stt_host_port: 9010
173
174# distil-large-v3 is near large-v3 accuracy for English at a fraction of the
175# VRAM, which matters because STT shares the 12 GB card with the cue-selection
176# model during a live session.
177dnd_stt_model: "Systran/faster-distil-whisper-large-v3"
178dnd_stt_compute_type: "int8_float16"
179
180# -1 keeps the model resident forever. Sessions have long silent gaps and a
181# cold reload would add seconds to the live path.
182dnd_stt_model_ttl: -1
183dnd_stt_start_period: "300s"
184dnd_stt_model_download_timeout: 900
185dnd_stt_log_level: "info"
186
187# --- D&D table server -------------------------------------------------------
188# Renders the kiosk page with headless Chromium and streams it to the table Pi,
189# which only hardware-decodes it. This is why the Pi can be a thin appliance:
190# all the rendering happens here, where there is a GPU and no thermal limit.
191#
192# Unlike dnd-agent, this image is pulled from Harbor rather than built here --
193# it is also deployed to the Pi, so one build serves both.
194dnd_table_enabled: false
195dnd_table_registry: "{{ vault_runner.harbor_hostname | default('ys-registry.com') }}"
196dnd_table_registry_project: "my-services"
197
198# Ansible runs as root, which has its own docker credential store, so a login
199# is needed even though this host serves the registry.
200dnd_table_registry_username: "{{ (vault_dnd_table | default({})).registry_username | default('admin') }}"
201dnd_table_registry_password: >-
202 {{ (vault_dnd_table | default({})).registry_password
203 | default(vault_runner.harbor_admin_password) }}
204dnd_table_runner_version: "0.3.0"
205dnd_table_runner_image: >-
206 {{ dnd_table_registry }}/{{ dnd_table_registry_project }}/dnd-runner:{{ dnd_table_runner_version }}
207
208# Where the kiosk stream is sent. Must match the Pi's TABLE_RTP_PORT.
209dnd_table_pi_host: "dnd-table.home"
210dnd_table_rtp_port: 5600
211
212# 720p to match the projector's native panel; sending 1080p would add a
213# scaling pass on a display that cannot show it.
214dnd_table_width: 1280
215dnd_table_height: 720
216dnd_table_fps: 30
217dnd_table_bitrate_kbps: 4000
218
219# The DM control surface.
220dnd_table_http_port: 8081
221
222# Maps and handouts. Lives on the NAS beside the rest of the campaign media.
223dnd_table_media_dir: "{{ dnd_media_dir }}/table"
224
225# Frigate - AI NVR System
226frigate_enabled: true
227frigate_port: 5000
228frigate_rtmp_port: 1935
229frigate_rtsp_port: 8554
230frigate_go2rtc_port: 1984
231frigate_config_dir: "/docker/frigate"
232frigate_data_dir: "{{ runner_nfs_mount_dir }}/frigate"
233frigate_mqtt_enabled: true
234mqtt_host: "homeassistant.home"
235mqtt_port: 1883
236frigate_hardware_acceleration: "vaapi" # vaapi, nvdec, nvenc, qsv, or none
237
238# Frigate ONVIF default settings
239frigate_onvif_autotracking: false
240
241# Frigate cameras configuration (from vault)
242frigate_cameras:
243 - name: "dining-room"
244 host: "{{ vault_runner.dining_room_camera_host | default('') }}"
245 username: "{{ vault_runner.dining_room_camera_user | default('') }}"
246 password: "{{ vault_runner.dining_room_camera_pass | default('') }}"
247 path: "/stream1"
248 port: 554
249 onvif_port: 2020
250 enabled: true
251
252 - name: "living-room"
253 host: "{{ vault_runner.living_room_camera_host | default('') }}"
254 username: "{{ vault_runner.living_room_camera_user | default('') }}"
255 password: "{{ vault_runner.living_room_camera_pass | default('') }}"
256 path: "/stream1"
257 port: 554
258 onvif_port: 2020
259 enabled: true
260
261 - name: "bed-room"
262 host: "{{ vault_runner.bed_room_camera_host | default('') }}"
263 username: "{{ vault_runner.bed_room_camera_user | default('') }}"
264 password: "{{ vault_runner.bed_room_camera_pass | default('') }}"
265 path: "/stream1"
266 port: 554
267 onvif_port: 2020
268 enabled: true
269
270 - name: "alina-office"
271 host: "{{ vault_runner.alina_office_camera_host | default('') }}"
272 username: "{{ vault_runner.alina_office_camera_user | default('') }}"
273 password: "{{ vault_runner.alina_office_camera_pass | default('') }}"
274 path: "/stream1"
275 port: 554
276 onvif_port: 2020
277 enabled: true
278
279 - name: "street-cam"
280 host: "{{ vault_runner.street_cam_host | default('') }}"
281 username: "{{ vault_runner.street_cam_user | default('') }}"
282 password: "{{ vault_runner.street_cam_pass | default('') }}"
283 path: "/stream1"
284 port: 554
285 onvif_port: 2020
286 enabled: true
287
288 - name: "pi-cam"
289 host: "{{ vault_runner.pi_cam_host | default('') }}"
290 username: "{{ vault_runner.pi_cam_user | default('') }}"
291 password: "{{ vault_runner.pi_cam_pass | default('') }}"
292 path: "{{ vault_runner.pi_cam_path | default('/doorbell') }}"
293 port: 8554
294 enabled: true
295
296# Cameras with ONVIF support (for PTZ control)
297frigate_onvif_cameras:
298 - name: "dining-room"
299 host: "{{ vault_runner.dining_room_camera_host | default('') }}"
300 port: 2020
301 username: "{{ vault_runner.dining_room_camera_user | default('') }}"
302 password: "{{ vault_runner.dining_room_camera_pass | default('') }}"
303 - name: "living-room"
304 host: "{{ vault_runner.living_room_camera_host | default('') }}"
305 port: 2020
306 username: "{{ vault_runner.living_room_camera_user | default('') }}"
307 password: "{{ vault_runner.living_room_camera_pass | default('') }}"
308 - name: "bed-room"
309 host: "{{ vault_runner.bed_room_camera_host | default('') }}"
310 port: 2020
311 username: "{{ vault_runner.bed_room_camera_user | default('') }}"
312 password: "{{ vault_runner.bed_room_camera_pass | default('') }}"
313 - name: "alina-office"
314 host: "{{ vault_runner.alina_office_camera_host | default('') }}"
315 port: 2020
316 username: "{{ vault_runner.alina_office_camera_user | default('') }}"
317 password: "{{ vault_runner.alina_office_camera_pass | default('') }}"
318 - name: "street-cam"
319 host: "{{ vault_runner.street_cam_host | default('') }}"
320 port: 2020
321 username: "{{ vault_runner.street_cam_user | default('') }}"
322 password: "{{ vault_runner.street_cam_pass | default('') }}"
323
324# Cameras for snapshot capture
325frigate_snapshot_cameras:
326 - "living-room"
327 - "dining-room"
328 - "bed-room"
329 - "alina-office"
330 - "street-cam"
331 - "pi-cam"
332
333# Per-camera record override (cameras listed here have recording disabled)
334frigate_cameras_record_disabled:
335 - "bed-room"
336
337# Frigate profile system (home=record-only, away=full detection)
338frigate_profiles:
339 home:
340 detect_enabled: false
341 detectors_enabled: false
342 cameras:
343 - street-cam
344 - pi-cam
345 hwaccel_override_cameras:
346 - street-cam
347 - pi-cam
348 default_profile: false
349 away:
350 detect_enabled: true
351 detectors_enabled: true
352 cameras:
353 - living-room
354 - dining-room
355 - bed-room
356 - alina-office
357 - street-cam
358 - pi-cam
359 default_profile: true
360
361# Frigate manager service
362frigate_manager_enabled: true
363frigate_snapshot_interval_minutes: 30
364frigate_profile_switch_timeout: 120
365
366# Immich - Photo Management
367immich_enabled: true
368immich_server_port: 2283
369immich_ml_port: 3003
370immich_config_dir: "/docker/immich"
371immich_data_dir: "/docker/immich"
372immich_upload_dir: "{{ runner_nfs_mount_dir }}/immich/library"
373immich_db_name: "{{ vault_runner.postgres_db | default('') }}"
374immich_db_user: "{{ vault_runner.postgres_user | default('') }}"
375immich_redis_enabled: true
376immich_ml_enabled: true
377immich_facial_recognition: true
378immich_hardware_acceleration: "none" # none, vaapi, nvdec, nvenc, or qsv
379
380# External library mounts (read-only photo libraries from NFS)
381immich_external_libraries:
382 - name: "yannick"
383 host_path: "{{ runner_nfs_mount_dir }}/immich/yannick"
384 container_path: "/yannick"
385 - name: "alina"
386 host_path: "{{ runner_nfs_mount_dir }}/immich/alina"
387 container_path: "/alina"
388
389# Forgejo - Git Server
390forgejo_enabled: true
391forgejo_http_port: 3010
392forgejo_ssh_port: 2222
393forgejo_config_dir: "/docker/forgejo"
394forgejo_data_dir: "{{ runner_nfs_mount_dir }}/forgejo"
395forgejo_db_type: "sqlite3"
396forgejo_app_name: "Forgejo Git Service"
397forgejo_domain: "forgejo.home"
398forgejo_ssh_domain: "{{ ansible_default_ipv4.address }}"
399
400# Forgejo Runner Configuration
401forgejo_runner_enabled: true
402forgejo_runner_token: "{{ vault_runner.forgejo_runner_token | default('changeme') }}"
403forgejo_runner_name: "default-runner"
404forgejo_runner_capacity: 2
405forgejo_runner_loglevel: info
406forgejo_runner_base_image: ubuntu:22.04
407forgejo_runner_user: runner
408forgejo_runner_uid: 1000
409forgejo_runner_version: 9.1.1
410
411# Forgejo Ansible Runner (for running Ansible playbooks in CI)
412forgejo_ansible_runner_enabled: true
413forgejo_ansible_runner_token: "{{ vault_runner.forgejo_ansible_runner_token | default('changeme') }}"
414forgejo_ansible_runner_name: "ansible-runner"
415forgejo_ansible_runner_capacity: 1
416forgejo_ansible_runner_version: 9.1.1
417
418# Web Tools - PDF Processing, File Conversion, Data Analysis, Developer Utilities
419web_tools_enabled: true
420web_tools_config_dir: "/docker/web-tools"
421web_tools_data_dir: "/docker/web-tools"
422
423# Stirling-PDF
424web_tools_stirling_port: 8090
425web_tools_stirling_max_file_size: 100
426
427# ConvertX
428web_tools_convertx_port: 8091
429web_tools_convertx_jwt_secret: "{{ vault_runner.web_tools_convertx_jwt_secret | default('changeme-generate-a-real-secret') }}"
430web_tools_convertx_auto_delete_hours: 24
431
432# CyberChef
433web_tools_cyberchef_port: 8092
434
435# IT-Tools
436web_tools_it_tools_port: 8093
437
438# Tandoor - Recipe Manager
439tandoor_enabled: true
440tandoor_port: 8010
441tandoor_config_dir: "/docker/tandoor"
442tandoor_data_dir: "/docker/tandoor"
443tandoor_media_dir: "{{ tandoor_data_dir }}/media"
444tandoor_static_dir: "{{ tandoor_data_dir }}/static"
445tandoor_db_engine: "django.db.backends.postgresql"
446
447# Ghost CMS - Headless CMS
448ghost_enabled: true
449ghost_port: 2368
450ghost_config_dir: "/docker/ghost"
451ghost_data_dir: "/docker/ghost"
452ghost_content_dir: "{{ ghost_data_dir }}/content"
453ghost_db_client: "mysql"
454ghost_db_host: "ghost-mysql"
455ghost_db_name: "ghost"
456ghost_db_user: "ghost"
457ghost_url: "http://ghost.home"
458
459# ==============================================================================
460# LIVEKIT - WebRTC Conferencing (SFU) + Meet frontend
461# ==============================================================================
462# LiveKit is a WebRTC SFU. Unlike the other runner services it runs on
463# network_mode: host because Docker's userland proxy rewrites UDP source
464# addresses, which breaks ICE candidate resolution and silently kills media.
465livekit_enabled: true
466livekit_config_dir: "/docker/livekit"
467livekit_data_dir: "{{ livekit_config_dir }}/data"
468
469# Signaling / API (HTTP + WebSocket)
470livekit_port: 7880
471# WebRTC over TCP (ICE/TCP fallback for restrictive networks)
472livekit_tcp_port: 7881
473# WebRTC over UDP - single-port mux, avoids the 50000-60000 range entirely
474livekit_udp_port: 7882
475# Meet frontend (bridge network, normal published port)
476livekit_meet_port: 7883
477
478# Public hostnames handed to browser clients. When fronted by a reverse proxy
479# these are the proxy's names; otherwise they resolve straight to this host.
480livekit_domain: "livekit.home"
481livekit_sfu_domain: "{{ livekit_domain }}"
482
483# Set true when a reverse proxy terminates TLS in front of both hostnames.
484# Browsers require a secure context for getUserMedia, and a page served over
485# HTTPS may not open a ws:// socket, so this must be on for any non-localhost
486# browser access.
487livekit_tls_enabled: false
488
489# Behind a proxy the public URLs carry no port (443 is implied). Direct access
490# needs the explicit container ports.
491livekit_public_url: >-
492 {{ 'https://' ~ livekit_domain
493 if livekit_tls_enabled
494 else 'http://' ~ livekit_domain ~ ':' ~ livekit_meet_port }}
495livekit_public_ws_url: >-
496 {{ 'wss://' ~ livekit_sfu_domain
497 if livekit_tls_enabled
498 else 'ws://' ~ livekit_sfu_domain ~ ':' ~ livekit_port }}
499
500# API credentials (from vault). Generate with:
501# docker run --rm livekit/livekit-server generate-keys
502livekit_api_key: "{{ vault_runner.livekit_api_key | default('') }}"
503livekit_api_secret: "{{ vault_runner.livekit_api_secret | default('') }}"
504
505livekit_log_level: "info"
506
507# Avatar for the session agent, served by Meet at the site root so it can be
508# shown in place of a video tile (the agent publishes no camera).
509livekit_agent_avatar_enabled: true
510livekit_agent_avatar_filename: "thaumaturgeon.png"
511livekit_agent_avatar_src: "files/thaumaturgeon.png"
512
513# Room behaviour
514livekit_room_auto_create: true
515livekit_room_empty_timeout: 300 # seconds before an empty room closes
516livekit_room_departure_timeout: 20
517
518# Meet frontend build. Upstream publishes no release tags, so this is pinned to
519# a specific commit SHA rather than tracking the main branch. Bump deliberately.
520livekit_meet_repo_url: "https://github.com/livekit-examples/meet.git"
521livekit_meet_repo_version: "665e1cb7841ab872de0d8e5c310744009a763b08"
522# Matches the packageManager field in Meet's package.json
523livekit_meet_pnpm_version: "10.18.2"
524livekit_meet_node_version: "20-alpine"
525
526# Resource limits
527livekit_memory_limit: "2g"
528livekit_cpu_limit: "2"
529livekit_meet_memory_limit: "1g"
530livekit_meet_cpu_limit: "1"
531
532cvat_config_dir: "/docker/cvat"
533# CVAT - Data labeling
534cvat_enabled: true
535
536cvat_repo_url: "https://github.com/cvat-ai/cvat.git"
537cvat_repo_version: "{{ cvat_image_tag }}"
538
539cvat_admin_username: admin
540cvat_admin_password: "{{ vault_runner.cvat_admin_password | default('change-me') }}"
541cvat_admin_email: "{{ vault_runner.cvat_admin_email | default('change-me') }}"
542
543# Networking / access
544cvat_domain: "cvat.home" # used by Traefik routing in CVAT compose
545cvat_http_port: 8990 # Traefik "web" entrypoint in the default compose
546cvat_https_enabled: false # add CVAT's https overlay when true
547
548cvat_share_dir: >-
549 {{ (runner_nfs_mounts
550 | selectattr('name','equalto','cvat')
551 | map(attribute='local_path')
552 | first)
553 | default(runner_nfs_mount_dir ~ '/cvat', true) }}
554
555# Versioning / images
556cvat_image_tag: "v2.44.3" # pulled via CVAT_VERSION; align with the git tag you run
557
558# Optional: serverless auto-annotation overlay (Nuclio/SAM/YOLO assist in CVAT)
559cvat_serverless_enabled: false
560
561# Optional: use an external Postgres instead of the bundled one
562cvat_external_db_enabled: false
563cvat_db_host: "postgres.internal"
564cvat_db_port: 5432
565cvat_db_name: "cvat"
566cvat_db_user: "cvat_user"
567cvat_db_password: "{{ vault_runner.cvat_db_password | default('change-me') }}"
568
569# Optional: expose Traefik dashboard (binds host port below)
570cvat_traefik_dashboard_enabled: false
571cvat_dashboard_port: 8899
572
573# Optional: GPU reservation for CVAT server container (you must have host GPU runtime ready)
574cvat_gpu_enabled: false
575cvat_gpu_driver: "nvidia"
576cvat_gpu_count: "all" # or a number like "1"
577
578# ==============================================================================
579# DATABASE CONFIGURATIONS
580# ==============================================================================
581
582# PostgreSQL (Immich)
583postgres_enabled: "{{ immich_enabled }}"
584postgres_config_dir: "/docker/immich/postgres"
585postgres_db: "{{ vault_runner.postgres_db | default('') }}"
586postgres_user: "{{ vault_runner.postgres_user | default('') }}"
587postgres_version: "14"
588
589# Redis (Immich)
590redis_enabled: "{{ immich_redis_enabled }}"
591redis_config_dir: "/docker/immich/redis"
592redis_port: 6379
593
594# MySQL (Ghost CMS)
595mysql_enabled: "{{ ghost_enabled }}"
596mysql_config_dir: "/docker/ghost/mysql"
597mysql_db: "{{ ghost_db_name }}"
598mysql_user: "{{ ghost_db_user }}"
599mysql_version: "8.0"
600
601# ==============================================================================
602# SECURITY SETTINGS (FROM VAULT)
603# ==============================================================================
604
605# Database passwords
606postgres_password: "{{ vault_runner.postgres_password | default('') }}"
607mysql_password: "{{ vault_runner.mysql_password | default('') }}"
608mysql_root_password: "{{ vault_runner.mysql_root_password | default('') }}"
609
610# Service secrets
611immich_jwt_secret: "{{ vault_runner.immich_jwt_secret | default('') }}"
612ghost_database_password: "{{ vault_runner.ghost_database_password | default('') }}"
613tandoor_secret_key: "{{ vault_runner.tandoor_secret_key | default('') }}"
614
615# MQTT credentials (from vault - top-level, shared across all roles)
616mqtt_username: ""
617mqtt_password: ""
618
619# ==============================================================================
620# DIRECTORY STRUCTURE
621# ==============================================================================
622
623# Local configuration directories
624runner_config_directories:
625 - "{{ llm_stack_config_dir }}"
626 - "{{ llm_stack_ollama_data_dir }}"
627 - "{{ llm_stack_openwebui_data_dir }}"
628 - "{{ llm_stack_litellm_data_dir }}"
629 - "{{ frigate_config_dir }}"
630 - "{{ immich_config_dir }}"
631 - "{{ immich_config_dir }}/postgres"
632 - "{{ immich_config_dir }}/redis"
633 - "{{ immich_config_dir }}/library"
634 - "{{ immich_config_dir }}/cache"
635 - "{{ immich_config_dir }}/model-cache"
636 - "{{ immich_config_dir }}/postgres-init"
637 - "{{ forgejo_config_dir }}"
638 - "{{ forgejo_config_dir }}/forgejo-runner-data"
639 - "{{ forgejo_config_dir }}/forgejo-ansible-runner-data"
640 - "{{ web_tools_config_dir }}"
641 - "{{ tandoor_config_dir }}"
642 - "{{ tandoor_data_dir }}/db"
643 - "{{ tandoor_data_dir }}/media"
644 - "{{ tandoor_data_dir }}/static"
645 - "{{ ghost_config_dir }}/config"
646 - "{{ ghost_config_dir }}/content"
647 - "{{ ghost_config_dir }}/mysql"
648
649# NFS mount directories
650runner_nfs_directories:
651 - "{{ runner_nfs_mount_dir }}"
652 - "{{ runner_nfs_mount_dir }}/frigate"
653 - "{{ runner_nfs_mount_dir }}/immich"
654 - "{{ runner_nfs_mount_dir }}/forgejo"
655 - "{{ runner_nfs_mount_dir }}/harbor"
656 - "{{ runner_nfs_mount_dir }}/cvat"
657
658# ==============================================================================
659# PERFORMANCE SETTINGS
660# ==============================================================================
661
662# Network performance tuning for NFS
663runner_performance_tuning_enabled: true
664runner_sysctl_settings:
665 # Extreme performance network buffers for Ryzen 7 + 32GB RAM
666 net.core.rmem_max: 268435456 # 256MB socket receive buffer
667 net.core.wmem_max: 268435456 # 256MB socket send buffer
668 net.core.rmem_default: 33554432 # 32MB default receive buffer
669 net.core.wmem_default: 33554432 # 32MB default send buffer
670 net.ipv4.tcp_rmem: "4096 131072 268435456" # TCP receive: 4KB min, 128KB default, 256MB max
671 net.ipv4.tcp_wmem: "4096 131072 268435456" # TCP send: 4KB min, 128KB default, 256MB max
672 net.core.netdev_max_backlog: 30000 # Handle high connection burst (32 connections)
673 net.ipv4.tcp_congestion_control: "bbr" # BBR congestion control
674 net.ipv4.tcp_window_scaling: 1 # Enable TCP window scaling
675 net.ipv4.tcp_timestamps: 1 # Enable TCP timestamps for RTT calculation
676 net.ipv4.tcp_sack: 1 # Enable selective acknowledgments
677 # NFS client cache tuning for 32GB RAM
678 vm.dirty_background_ratio: 3 # Start writeback at 3% (more aggressive)
679 vm.dirty_ratio: 8 # Force writeback at 8% (more aggressive)
680 vm.vfs_cache_pressure: 25 # Keep even more file cache (25% vs 50%)
681 vm.min_free_kbytes: 131072 # Keep 128MB free for network buffers
682
683# Harbor Configuration (external deployment)
684harbor_enabled: true
685harbor_config_dir: "/docker/harbor"
686harbor_version: "2.13.2"
687harbor_hostname: "{{ vault_runner.harbor_hostname | default('registry.local') }}"
688harbor_http_port: 8080
689harbor_registry_port: 5000
690harbor_admin_password: "{{ vault_runner.harbor_admin_password | default('changeme') }}"
691harbor_db_password: "{{ vault_runner.harbor_db_password | default('changeme') }}"
692harbor_data_volume: "{{ runner_nfs_mount_dir }}/harbor"
693
694# Docker resource limits
695default_memory_limit: "1g"
696default_cpu_limit: "1"
697
698# Health check configuration
699health_check_interval: "30s"
700health_check_timeout: "30s"
701health_check_retries: 5
702health_check_start_period: "60s"
703
704# ==============================================================================
705# SERVICE HEALTH ENDPOINTS
706# ==============================================================================
707service_endpoints:
708 ollama: "http://localhost:{{ llm_stack_ollama_port }}/api/tags"
709 openwebui: "http://localhost:{{ llm_stack_openwebui_port }}/api/health"
710 litellm: "http://localhost:{{ llm_stack_litellm_port }}/"
711 frigate: "http://localhost:{{ frigate_port }}/api/config"
712 immich: "http://localhost:{{ immich_server_port }}/api/server-info/ping"
713 forgejo: "http://localhost:{{ forgejo_http_port }}/api/v1/version"
714 stirling_pdf: "http://localhost:{{ web_tools_stirling_port }}/api/v1/info/status"
715 convertx: "http://localhost:{{ web_tools_convertx_port }}/"
716 cyberchef: "http://localhost:{{ web_tools_cyberchef_port }}/"
717 it_tools: "http://localhost:{{ web_tools_it_tools_port }}/"
718 tandoor: "http://localhost:{{ tandoor_port }}/accounts/login/"
719 ghost: "http://localhost:{{ ghost_port }}/ghost/api/admin/site/"
720 livekit: "http://localhost:{{ livekit_port }}/"
721 livekit_meet: "http://localhost:{{ livekit_meet_port }}/"
722
723# ==============================================================================
724# LOGGING CONFIGURATION
725# ==============================================================================
726logging_driver: "json-file"
727logging_max_size: "10m"
728logging_max_file: "3"
729
730# Service-specific logging levels (unified LLM stack uses llm_stack_* variables)
731# ollama_log_level: "info" # Now uses llm_stack_ollama_log_level
732# openwebui_log_level: "info" # Now uses llm_stack_openwebui_log_level
733# litellm_log_level: "info" # Now uses llm_stack_litellm_log_level
734frigate_log_level: "info"
735immich_log_level: "log"
736forgejo_log_level: "Info"
737ghost_logging: "info"
738
739