/
/
/
Ansible role that deployes services on my runner machine
1---
2# Runner Services Role Defaults
3# Multi-service container deployment with NFS integration
4
5# ==============================================================================
6# GENERAL SETTINGS
7# ==============================================================================
8runner_enabled: true
9# Legacy variables - no longer used with consolidated structure
10# runner_docker_dir: "/docker/runner" # Now each service uses /docker/[service]
11# runner_data_dir: "/docker/runner-data" # Now consolidated into each service directory
12runner_nfs_mount_dir: "/mnt/docker"
13runner_snapshot_dir: "{{ runner_nfs_mount_dir }}/frigate/snapshots"
14runner_user: "{{ ansible_user }}"
15runner_group: "users"
16runner_uid: 1000
17runner_gid: 1000
18
19# Timezone configuration
20runner_timezone: "{{ system_timezone }}"
21
22# Docker network for runner services
23runner_docker_network: "runner-network"
24runner_network_subnet: "172.20.0.0/16"
25
26# NFS Configuration
27runner_nfs_enabled: true
28runner_nas_host: "{{ vault_storage.nas_host | default('storage.home') }}"
29runner_nfs_options: "nfsvers=4.1,proto=tcp,hard,timeo=600,retrans=2,rsize=16777216,wsize=16777216,nconnect=8,noatime,_netdev"
30
31# ==============================================================================
32# NFS MOUNT CONFIGURATION
33# ==============================================================================
34runner_nfs_mounts:
35 - name: "frigate"
36 local_path: "{{ runner_nfs_mount_dir }}/frigate"
37 nfs_path: "/mnt/rstorage/cctv-data"
38 host: "{{ runner_nas_host }}"
39 options: "{{ runner_nfs_options }}"
40
41 - name: "immich"
42 local_path: "{{ runner_nfs_mount_dir }}/immich"
43 nfs_path: "/mnt/rstorage/media/pictures"
44 host: "{{ runner_nas_host }}"
45 options: "{{ runner_nfs_options }}"
46
47 - name: "forgejo"
48 local_path: "{{ runner_nfs_mount_dir }}/forgejo"
49 nfs_path: "/mnt/rstorage/code-repo"
50 host: "{{ runner_nas_host }}"
51 options: "{{ runner_nfs_options }}"
52
53 - name: "harbor"
54 local_path: "{{ runner_nfs_mount_dir }}/harbor"
55 nfs_path: "/mnt/rstorage/registry-data"
56 host: "{{ runner_nas_host }}"
57 options: "{{ runner_nfs_options }}"
58
59 - name: "cvat"
60 local_path: "{{ runner_nfs_mount_dir }}/cvat"
61 nfs_path: "/mnt/rstorage/cvat-datasets"
62 host: "{{ runner_nas_host }}"
63 options: "{{ runner_nfs_options }}"
64
65# ==============================================================================
66# SERVICE CONFIGURATIONS
67# ==============================================================================
68
69# LLM Stack - Unified Local AI Infrastructure
70llm_stack_enabled: true
71llm_stack_config_dir: "/docker/llm-stack"
72
73# Unified LLM Stack Configuration
74llm_stack_ollama_port: 9000
75llm_stack_openwebui_port: 9001
76llm_stack_litellm_port: 9002
77
78# Ollama - Local LLM Server
79llm_stack_ollama_data_dir: "{{ llm_stack_config_dir }}/ollama/data"
80# GPU configuration uses global gpu_enabled parameter
81llm_stack_ollama_default_model: "tinyllama"
82llm_stack_ollama_log_level: "info"
83
84# OpenWebUI - Web Interface for Ollama
85llm_stack_openwebui_data_dir: "{{ llm_stack_config_dir }}/openwebui/data"
86llm_stack_openwebui_name: "Local AI Assistant"
87llm_stack_openwebui_description: "Self-hosted AI chat interface"
88llm_stack_openwebui_author: "Home Assistant"
89llm_stack_openwebui_default_models: "tinyllama"
90llm_stack_openwebui_log_level: "info"
91
92# LiteLLM - Unified LLM Proxy
93llm_stack_litellm_data_dir: "{{ llm_stack_config_dir }}/litellm/data"
94llm_stack_litellm_model_list: "tinyllama"
95llm_stack_litellm_completion_model: "ollama/tinyllama"
96llm_stack_litellm_streaming_enabled: true
97llm_stack_litellm_log_level: "info"
98
99# Frigate - AI NVR System
100frigate_enabled: true
101frigate_port: 5000
102frigate_rtmp_port: 1935
103frigate_rtsp_port: 8554
104frigate_go2rtc_port: 1984
105frigate_config_dir: "/docker/frigate"
106frigate_data_dir: "{{ runner_nfs_mount_dir }}/frigate"
107frigate_mqtt_enabled: true
108mqtt_host: "homeassistant.home"
109mqtt_port: 1883
110frigate_hardware_acceleration: "vaapi" # vaapi, nvdec, nvenc, qsv, or none
111
112# Frigate ONVIF default settings
113frigate_onvif_autotracking: false
114
115# Frigate cameras configuration (from vault)
116frigate_cameras:
117 - name: "dining-room"
118 host: "{{ vault_runner.dining_room_camera_host | default('') }}"
119 username: "{{ vault_runner.dining_room_camera_user | default('') }}"
120 password: "{{ vault_runner.dining_room_camera_pass | default('') }}"
121 path: "/live0"
122 enabled: true
123
124 - name: "living-room"
125 host: "{{ vault_runner.living_room_camera_host | default('') }}"
126 username: "{{ vault_runner.living_room_camera_user | default('') }}"
127 password: "{{ vault_runner.living_room_camera_pass | default('') }}"
128 path: "/live0"
129 enabled: true
130
131 - name: "bed-room"
132 host: "{{ vault_runner.bed_room_camera_host | default('') }}"
133 username: "{{ vault_runner.bed_room_camera_user | default('') }}"
134 password: "{{ vault_runner.bed_room_camera_pass | default('') }}"
135 path: "/live0"
136 enabled: true
137
138 - name: "alina-office"
139 host: "{{ vault_runner.alina_office_camera_host | default('') }}"
140 username: "{{ vault_runner.alina_office_camera_user | default('') }}"
141 password: "{{ vault_runner.alina_office_camera_pass | default('') }}"
142 path: "/live0"
143 enabled: true
144
145 - name: "tapo-cam"
146 host: "{{ vault_runner.tapocam_host | default('') }}"
147 username: "{{ vault_runner.tapocam_user | default('') }}"
148 password: "{{ vault_runner.tapocam_pass | default('') }}"
149 path: "/stream1"
150 port: 554
151 enabled: true
152
153 - name: "tapo-test-cam"
154 host: "{{ vault_runner.tapo_test_cam_host | default('') }}"
155 username: "{{ vault_runner.tapo_test_cam_user | default('') }}"
156 password: "{{ vault_runner.tapo_test_cam_pass | default('') }}"
157 path: "/stream1"
158 port: 554
159 enabled: true
160
161 - name: "pi-cam"
162 host: "{{ vault_runner.pi_cam_host | default('') }}"
163 username: "{{ vault_runner.pi_cam_user | default('') }}"
164 password: "{{ vault_runner.pi_cam_pass | default('') }}"
165 path: "/live0"
166 enabled: true
167
168# Cameras with ONVIF support (for PTZ control)
169frigate_onvif_cameras:
170 - name: "tapo-cam"
171 host: "{{ vault_runner.tapocam_host | default('') }}"
172 port: 2020
173 username: "{{ vault_runner.tapocam_user | default('') }}"
174 password: "{{ vault_runner.tapocam_pass | default('') }}"
175 - name: "tapo-test-cam"
176 host: "{{ vault_runner.tapo_test_cam_host | default('') }}"
177 port: 2020
178 username: "{{ vault_runner.tapo_test_cam_user | default('') }}"
179 password: "{{ vault_runner.tapo_test_cam_pass | default('') }}"
180
181# Cameras for snapshot container (comma-separated)
182frigate_snapshot_cameras:
183 - "living-room"
184 - "dining-room"
185 - "bed-room"
186 - "alina-office"
187
188# Per-camera record override (cameras listed here have recording disabled)
189frigate_cameras_record_disabled:
190 - "bed-room"
191
192# Immich - Photo Management
193immich_enabled: true
194immich_server_port: 2283
195immich_ml_port: 3003
196immich_config_dir: "/docker/immich"
197immich_data_dir: "/docker/immich"
198immich_upload_dir: "{{ runner_nfs_mount_dir }}/immich"
199immich_db_name: "{{ vault_runner.postgres_db | default('') }}"
200immich_db_user: "{{ vault_runner.postgres_user | default('') }}"
201immich_redis_enabled: true
202immich_ml_enabled: true
203immich_facial_recognition: true
204immich_hardware_acceleration: "none" # none, vaapi, nvdec, nvenc, or qsv
205
206# External library mounts (read-only photo libraries from NFS)
207immich_external_libraries:
208 - name: "yannick"
209 host_path: "{{ runner_nfs_mount_dir }}/immich/yannick"
210 container_path: "/yannick"
211 - name: "alina"
212 host_path: "{{ runner_nfs_mount_dir }}/immich/alina"
213 container_path: "/alina"
214
215# Forgejo - Git Server
216forgejo_enabled: true
217forgejo_http_port: 3010
218forgejo_ssh_port: 2222
219forgejo_config_dir: "/docker/forgejo"
220forgejo_data_dir: "{{ runner_nfs_mount_dir }}/forgejo"
221forgejo_db_type: "sqlite3"
222forgejo_app_name: "Forgejo Git Service"
223forgejo_domain: "forgejo.home"
224forgejo_ssh_domain: "{{ ansible_default_ipv4.address }}"
225
226# Forgejo Runner Configuration
227forgejo_runner_enabled: true
228forgejo_runner_token: "{{ vault_runner.forgejo_runner_token | default('changeme') }}"
229forgejo_runner_name: "default-runner"
230forgejo_runner_capacity: 2
231forgejo_runner_loglevel: info
232forgejo_runner_base_image: ubuntu:22.04
233forgejo_runner_user: runner
234forgejo_runner_uid: 1000
235forgejo_runner_version: 9.1.1
236
237# Forgejo Ansible Runner (for running Ansible playbooks in CI)
238forgejo_ansible_runner_enabled: true
239forgejo_ansible_runner_token: "{{ vault_runner.forgejo_ansible_runner_token | default('changeme') }}"
240forgejo_ansible_runner_name: "ansible-runner"
241forgejo_ansible_runner_capacity: 1
242forgejo_ansible_runner_version: 9.1.1
243
244# Stirling-PDF - PDF Processing
245stirling_pdf_enabled: true
246stirling_pdf_port: 8080
247stirling_pdf_config_dir: "/docker/stirling-pdf"
248stirling_pdf_data_dir: "/docker/stirling-pdf"
249
250# Tandoor - Recipe Manager
251tandoor_enabled: true
252tandoor_port: 8010
253tandoor_config_dir: "/docker/tandoor"
254tandoor_data_dir: "/docker/tandoor"
255tandoor_media_dir: "{{ tandoor_data_dir }}/media"
256tandoor_static_dir: "{{ tandoor_data_dir }}/static"
257tandoor_db_engine: "django.db.backends.postgresql"
258
259# Ghost CMS - Headless CMS
260ghost_enabled: true
261ghost_port: 2368
262ghost_config_dir: "/docker/ghost"
263ghost_data_dir: "/docker/ghost"
264ghost_content_dir: "{{ ghost_data_dir }}/content"
265ghost_db_client: "mysql"
266ghost_db_host: "ghost-mysql"
267ghost_db_name: "ghost"
268ghost_db_user: "ghost"
269ghost_url: "http://ghost.home"
270
271cvat_config_dir: "/docker/cvat"
272# CVAT - Data labeling
273cvat_enabled: true
274
275cvat_repo_url: "https://github.com/cvat-ai/cvat.git"
276cvat_repo_version: "{{ cvat_image_tag }}"
277
278cvat_admin_username: admin
279cvat_admin_password: "{{ vault_runner.cvat_admin_password | default('change-me') }}"
280cvat_admin_email: "{{ vault_runner.cvat_admin_email | default('change-me') }}"
281
282# Networking / access
283cvat_domain: "cvat.home" # used by Traefik routing in CVAT compose
284cvat_http_port: 8990 # Traefik "web" entrypoint in the default compose
285cvat_https_enabled: false # add CVAT's https overlay when true
286
287cvat_share_dir: >-
288 {{ (runner_nfs_mounts
289 | selectattr('name','equalto','cvat')
290 | map(attribute='local_path')
291 | first)
292 | default(runner_nfs_mount_dir ~ '/cvat', true) }}
293
294# Versioning / images
295cvat_image_tag: "v2.44.3" # pulled via CVAT_VERSION; align with the git tag you run
296
297# Optional: serverless auto-annotation overlay (Nuclio/SAM/YOLO assist in CVAT)
298cvat_serverless_enabled: false
299
300# Optional: use an external Postgres instead of the bundled one
301cvat_external_db_enabled: false
302cvat_db_host: "postgres.internal"
303cvat_db_port: 5432
304cvat_db_name: "cvat"
305cvat_db_user: "cvat_user"
306cvat_db_password: "{{ vault_runner.cvat_db_password | default('change-me') }}"
307
308# Optional: expose Traefik dashboard (binds host port below)
309cvat_traefik_dashboard_enabled: false
310cvat_dashboard_port: 8899
311
312# Optional: GPU reservation for CVAT server container (you must have host GPU runtime ready)
313cvat_gpu_enabled: false
314cvat_gpu_driver: "nvidia"
315cvat_gpu_count: "all" # or a number like "1"
316
317# ==============================================================================
318# DATABASE CONFIGURATIONS
319# ==============================================================================
320
321# PostgreSQL (Immich)
322postgres_enabled: "{{ immich_enabled }}"
323postgres_config_dir: "/docker/immich/postgres"
324postgres_db: "{{ vault_runner.postgres_db | default('') }}"
325postgres_user: "{{ vault_runner.postgres_user | default('') }}"
326postgres_version: "14"
327
328# Redis (Immich)
329redis_enabled: "{{ immich_redis_enabled }}"
330redis_config_dir: "/docker/immich/redis"
331redis_port: 6379
332
333# MySQL (Ghost CMS)
334mysql_enabled: "{{ ghost_enabled }}"
335mysql_config_dir: "/docker/ghost/mysql"
336mysql_db: "{{ ghost_db_name }}"
337mysql_user: "{{ ghost_db_user }}"
338mysql_version: "8.0"
339
340# ==============================================================================
341# SECURITY SETTINGS (FROM VAULT)
342# ==============================================================================
343
344# Database passwords
345postgres_password: "{{ vault_runner.postgres_password | default('') }}"
346mysql_password: "{{ vault_runner.mysql_password | default('') }}"
347mysql_root_password: "{{ vault_runner.mysql_root_password | default('') }}"
348
349# Service secrets
350immich_jwt_secret: "{{ vault_runner.immich_jwt_secret | default('') }}"
351ghost_database_password: "{{ vault_runner.ghost_database_password | default('') }}"
352tandoor_secret_key: "{{ vault_runner.tandoor_secret_key | default('') }}"
353
354# MQTT credentials (from vault - top-level, shared across all roles)
355mqtt_username: ""
356mqtt_password: ""
357
358# ==============================================================================
359# DIRECTORY STRUCTURE
360# ==============================================================================
361
362# Local configuration directories
363runner_config_directories:
364 - "{{ llm_stack_config_dir }}"
365 - "{{ llm_stack_ollama_data_dir }}"
366 - "{{ llm_stack_openwebui_data_dir }}"
367 - "{{ llm_stack_litellm_data_dir }}"
368 - "{{ frigate_config_dir }}"
369 - "{{ immich_config_dir }}"
370 - "{{ immich_config_dir }}/postgres"
371 - "{{ immich_config_dir }}/redis"
372 - "{{ immich_config_dir }}/library"
373 - "{{ immich_config_dir }}/cache"
374 - "{{ immich_config_dir }}/model-cache"
375 - "{{ immich_config_dir }}/postgres-init"
376 - "{{ forgejo_config_dir }}"
377 - "{{ forgejo_config_dir }}/forgejo-runner-data"
378 - "{{ forgejo_config_dir }}/forgejo-ansible-runner-data"
379 - "{{ stirling_pdf_config_dir }}"
380 - "{{ tandoor_config_dir }}"
381 - "{{ tandoor_data_dir }}/db"
382 - "{{ tandoor_data_dir }}/media"
383 - "{{ tandoor_data_dir }}/static"
384 - "{{ ghost_config_dir }}/config"
385 - "{{ ghost_config_dir }}/content"
386 - "{{ ghost_config_dir }}/mysql"
387
388# NFS mount directories
389runner_nfs_directories:
390 - "{{ runner_nfs_mount_dir }}"
391 - "{{ runner_nfs_mount_dir }}/frigate"
392 - "{{ runner_nfs_mount_dir }}/immich"
393 - "{{ runner_nfs_mount_dir }}/forgejo"
394 - "{{ runner_nfs_mount_dir }}/harbor"
395 - "{{ runner_nfs_mount_dir }}/cvat"
396
397# ==============================================================================
398# PERFORMANCE SETTINGS
399# ==============================================================================
400
401# Network performance tuning for NFS
402runner_performance_tuning_enabled: true
403runner_sysctl_settings:
404 # Extreme performance network buffers for Ryzen 7 + 32GB RAM
405 net.core.rmem_max: 268435456 # 256MB socket receive buffer
406 net.core.wmem_max: 268435456 # 256MB socket send buffer
407 net.core.rmem_default: 33554432 # 32MB default receive buffer
408 net.core.wmem_default: 33554432 # 32MB default send buffer
409 net.ipv4.tcp_rmem: "4096 131072 268435456" # TCP receive: 4KB min, 128KB default, 256MB max
410 net.ipv4.tcp_wmem: "4096 131072 268435456" # TCP send: 4KB min, 128KB default, 256MB max
411 net.core.netdev_max_backlog: 30000 # Handle high connection burst (32 connections)
412 net.ipv4.tcp_congestion_control: "bbr" # BBR congestion control
413 net.ipv4.tcp_window_scaling: 1 # Enable TCP window scaling
414 net.ipv4.tcp_timestamps: 1 # Enable TCP timestamps for RTT calculation
415 net.ipv4.tcp_sack: 1 # Enable selective acknowledgments
416 # NFS client cache tuning for 32GB RAM
417 vm.dirty_background_ratio: 3 # Start writeback at 3% (more aggressive)
418 vm.dirty_ratio: 8 # Force writeback at 8% (more aggressive)
419 vm.vfs_cache_pressure: 25 # Keep even more file cache (25% vs 50%)
420 vm.min_free_kbytes: 131072 # Keep 128MB free for network buffers
421
422# Harbor Configuration (external deployment)
423harbor_enabled: true
424harbor_config_dir: "/docker/harbor"
425harbor_version: "2.13.0"
426harbor_hostname: "{{ vault_runner.harbor_hostname | default('registry.local') }}"
427harbor_http_port: 8080
428harbor_registry_port: 5000
429harbor_admin_password: "{{ vault_runner.harbor_admin_password | default('changeme') }}"
430harbor_db_password: "{{ vault_runner.harbor_db_password | default('changeme') }}"
431harbor_data_volume: "{{ runner_nfs_mount_dir }}/harbor"
432
433# Docker resource limits
434default_memory_limit: "1g"
435default_cpu_limit: "1"
436
437# Health check configuration
438health_check_interval: "30s"
439health_check_timeout: "30s"
440health_check_retries: 5
441health_check_start_period: "60s"
442
443# ==============================================================================
444# SERVICE HEALTH ENDPOINTS
445# ==============================================================================
446service_endpoints:
447 ollama: "http://localhost:{{ llm_stack_ollama_port }}/api/tags"
448 openwebui: "http://localhost:{{ llm_stack_openwebui_port }}/api/health"
449 litellm: "http://localhost:{{ llm_stack_litellm_port }}/"
450 frigate: "http://localhost:{{ frigate_port }}/api/config"
451 immich: "http://localhost:{{ immich_server_port }}/api/server-info/ping"
452 forgejo: "http://localhost:{{ forgejo_http_port }}/api/v1/version"
453 stirling_pdf: "http://localhost:{{ stirling_pdf_port }}/api/v1/info/status"
454 tandoor: "http://localhost:{{ tandoor_port }}/accounts/login/"
455 ghost: "http://localhost:{{ ghost_port }}/ghost/api/admin/site/"
456
457# ==============================================================================
458# LOGGING CONFIGURATION
459# ==============================================================================
460logging_driver: "json-file"
461logging_max_size: "10m"
462logging_max_file: "3"
463
464# Service-specific logging levels (unified LLM stack uses llm_stack_* variables)
465# ollama_log_level: "info" # Now uses llm_stack_ollama_log_level
466# openwebui_log_level: "info" # Now uses llm_stack_openwebui_log_level
467# litellm_log_level: "info" # Now uses llm_stack_litellm_log_level
468frigate_log_level: "info"
469immich_log_level: "log"
470forgejo_log_level: "Info"
471ghost_logging: "info"
472
473