/
/
/
Ansible role that deployes services on my runner machine
1---
2# Runner Services Role Defaults
3# Multi-service container deployment with NFS integration
4
5# ==============================================================================
6# GENERAL SETTINGS
7# ==============================================================================
8runner_enabled: true
9# Legacy variables - no longer used with consolidated structure
10# runner_docker_dir: "/docker/runner" # Now each service uses /docker/[service]
11# runner_data_dir: "/docker/runner-data" # Now consolidated into each service directory
12runner_nfs_mount_dir: "/mnt/docker"
13runner_snapshot_dir: "{{ runner_nfs_mount_dir }}/frigate/snapshots"
14runner_user: "{{ ansible_user }}"
15runner_group: "users"
16runner_uid: 1000
17runner_gid: 1000
18
19# Timezone configuration
20runner_timezone: "{{ system_timezone }}"
21
22# Docker network for runner services
23runner_docker_network: "runner-network"
24runner_network_subnet: "172.20.0.0/16"
25
26# NFS Configuration
27runner_nfs_enabled: true
28runner_nas_host: "{{ vault_storage.nas_host | default('storage.home') }}"
29runner_nfs_options: "nfsvers=4.1,proto=tcp,hard,timeo=600,retrans=2,rsize=16777216,wsize=16777216,nconnect=8,noatime,_netdev"
30
31# ==============================================================================
32# NFS MOUNT CONFIGURATION
33# ==============================================================================
34runner_nfs_mounts:
35 - name: "frigate"
36 local_path: "{{ runner_nfs_mount_dir }}/frigate"
37 nfs_path: "/mnt/rstorage/cctv-data"
38 host: "{{ runner_nas_host }}"
39 options: "{{ runner_nfs_options }}"
40
41 - name: "immich"
42 local_path: "{{ runner_nfs_mount_dir }}/immich"
43 nfs_path: "/mnt/rstorage/media/pictures"
44 host: "{{ runner_nas_host }}"
45 options: "{{ runner_nfs_options }}"
46
47 - name: "forgejo"
48 local_path: "{{ runner_nfs_mount_dir }}/forgejo"
49 nfs_path: "/mnt/rstorage/code-repo"
50 host: "{{ runner_nas_host }}"
51 options: "{{ runner_nfs_options }}"
52
53 - name: "harbor"
54 local_path: "{{ runner_nfs_mount_dir }}/harbor"
55 nfs_path: "/mnt/rstorage/registry-data"
56 host: "{{ runner_nas_host }}"
57 options: "{{ runner_nfs_options }}"
58
59 - name: "cvat"
60 local_path: "{{ runner_nfs_mount_dir }}/cvat"
61 nfs_path: "/mnt/rstorage/cvat-datasets"
62 host: "{{ runner_nas_host }}"
63 options: "{{ runner_nfs_options }}"
64
65# ==============================================================================
66# SERVICE CONFIGURATIONS
67# ==============================================================================
68
69# LLM Stack - Unified Local AI Infrastructure
70llm_stack_enabled: true
71llm_stack_config_dir: "/docker/llm-stack"
72
73# Unified LLM Stack Configuration
74llm_stack_ollama_port: 9000
75llm_stack_openwebui_port: 9001
76llm_stack_litellm_port: 9002
77
78# Ollama - Local LLM Server
79llm_stack_ollama_data_dir: "{{ llm_stack_config_dir }}/ollama/data"
80# GPU configuration uses global gpu_enabled parameter
81llm_stack_ollama_default_model: "tinyllama"
82llm_stack_ollama_log_level: "info"
83
84# OpenWebUI - Web Interface for Ollama
85llm_stack_openwebui_data_dir: "{{ llm_stack_config_dir }}/openwebui/data"
86llm_stack_openwebui_name: "Local AI Assistant"
87llm_stack_openwebui_description: "Self-hosted AI chat interface"
88llm_stack_openwebui_author: "Home Assistant"
89llm_stack_openwebui_default_models: "tinyllama"
90llm_stack_openwebui_log_level: "info"
91
92# LiteLLM - Unified LLM Proxy
93llm_stack_litellm_data_dir: "{{ llm_stack_config_dir }}/litellm/data"
94llm_stack_litellm_model_list: "tinyllama"
95llm_stack_litellm_completion_model: "ollama/tinyllama"
96llm_stack_litellm_streaming_enabled: true
97llm_stack_litellm_log_level: "info"
98
99# Frigate - AI NVR System
100frigate_enabled: true
101frigate_port: 5000
102frigate_rtmp_port: 1935
103frigate_rtsp_port: 8554
104frigate_go2rtc_port: 1984
105frigate_config_dir: "/docker/frigate"
106frigate_data_dir: "{{ runner_nfs_mount_dir }}/frigate"
107frigate_mqtt_enabled: true
108mqtt_host: "homeassistant.home"
109mqtt_port: 1883
110frigate_hardware_acceleration: "vaapi" # vaapi, nvdec, nvenc, qsv, or none
111
112# Frigate ONVIF default settings
113frigate_onvif_autotracking: false
114
115# Frigate cameras configuration (from vault)
116frigate_cameras:
117 - name: "dining-room"
118 host: "{{ vault_runner.dining_room_camera_host | default('') }}"
119 username: "{{ vault_runner.dining_room_camera_user | default('') }}"
120 password: "{{ vault_runner.dining_room_camera_pass | default('') }}"
121 path: "/live0"
122 enabled: true
123
124 - name: "living-room"
125 host: "{{ vault_runner.living_room_camera_host | default('') }}"
126 username: "{{ vault_runner.living_room_camera_user | default('') }}"
127 password: "{{ vault_runner.living_room_camera_pass | default('') }}"
128 path: "/live0"
129 enabled: true
130
131 - name: "bed-room"
132 host: "{{ vault_runner.bed_room_camera_host | default('') }}"
133 username: "{{ vault_runner.bed_room_camera_user | default('') }}"
134 password: "{{ vault_runner.bed_room_camera_pass | default('') }}"
135 path: "/live0"
136 enabled: true
137
138 - name: "alina-office"
139 host: "{{ vault_runner.alina_office_camera_host | default('') }}"
140 username: "{{ vault_runner.alina_office_camera_user | default('') }}"
141 password: "{{ vault_runner.alina_office_camera_pass | default('') }}"
142 path: "/live0"
143 enabled: true
144
145 - name: "tapo-cam"
146 host: "{{ vault_runner.tapocam_host | default('') }}"
147 username: "{{ vault_runner.tapocam_user | default('') }}"
148 password: "{{ vault_runner.tapocam_pass | default('') }}"
149 path: "/stream1"
150 port: 554
151 enabled: true
152
153 - name: "tapo-test-cam"
154 host: "{{ vault_runner.tapo_test_cam_host | default('') }}"
155 username: "{{ vault_runner.tapo_test_cam_user | default('') }}"
156 password: "{{ vault_runner.tapo_test_cam_pass | default('') }}"
157 path: "/stream1"
158 port: 554
159 enabled: true
160 detect_enabled: false
161
162 - name: "pi-cam"
163 host: "{{ vault_runner.pi_cam_host | default('') }}"
164 username: "{{ vault_runner.pi_cam_user | default('') }}"
165 password: "{{ vault_runner.pi_cam_pass | default('') }}"
166 path: "{{ vault_runner.pi_cam_path | default('/live0') }}"
167 enabled: true
168 detect_enabled: false
169
170# Cameras with ONVIF support (for PTZ control)
171frigate_onvif_cameras:
172 - name: "tapo-cam"
173 host: "{{ vault_runner.tapocam_host | default('') }}"
174 port: 2020
175 username: "{{ vault_runner.tapocam_user | default('') }}"
176 password: "{{ vault_runner.tapocam_pass | default('') }}"
177 - name: "tapo-test-cam"
178 host: "{{ vault_runner.tapo_test_cam_host | default('') }}"
179 port: 2020
180 username: "{{ vault_runner.tapo_test_cam_user | default('') }}"
181 password: "{{ vault_runner.tapo_test_cam_pass | default('') }}"
182
183# Cameras for snapshot container (comma-separated)
184frigate_snapshot_cameras:
185 - "living-room"
186 - "dining-room"
187 - "bed-room"
188 - "alina-office"
189
190# Per-camera record override (cameras listed here have recording disabled)
191frigate_cameras_record_disabled:
192 - "bed-room"
193
194# Immich - Photo Management
195immich_enabled: true
196immich_server_port: 2283
197immich_ml_port: 3003
198immich_config_dir: "/docker/immich"
199immich_data_dir: "/docker/immich"
200immich_upload_dir: "{{ runner_nfs_mount_dir }}/immich/library"
201immich_db_name: "{{ vault_runner.postgres_db | default('') }}"
202immich_db_user: "{{ vault_runner.postgres_user | default('') }}"
203immich_redis_enabled: true
204immich_ml_enabled: true
205immich_facial_recognition: true
206immich_hardware_acceleration: "none" # none, vaapi, nvdec, nvenc, or qsv
207
208# External library mounts (read-only photo libraries from NFS)
209immich_external_libraries:
210 - name: "yannick"
211 host_path: "{{ runner_nfs_mount_dir }}/immich/yannick"
212 container_path: "/yannick"
213 - name: "alina"
214 host_path: "{{ runner_nfs_mount_dir }}/immich/alina"
215 container_path: "/alina"
216
217# Forgejo - Git Server
218forgejo_enabled: true
219forgejo_http_port: 3010
220forgejo_ssh_port: 2222
221forgejo_config_dir: "/docker/forgejo"
222forgejo_data_dir: "{{ runner_nfs_mount_dir }}/forgejo"
223forgejo_db_type: "sqlite3"
224forgejo_app_name: "Forgejo Git Service"
225forgejo_domain: "forgejo.home"
226forgejo_ssh_domain: "{{ ansible_default_ipv4.address }}"
227
228# Forgejo Runner Configuration
229forgejo_runner_enabled: true
230forgejo_runner_token: "{{ vault_runner.forgejo_runner_token | default('changeme') }}"
231forgejo_runner_name: "default-runner"
232forgejo_runner_capacity: 2
233forgejo_runner_loglevel: info
234forgejo_runner_base_image: ubuntu:22.04
235forgejo_runner_user: runner
236forgejo_runner_uid: 1000
237forgejo_runner_version: 9.1.1
238
239# Forgejo Ansible Runner (for running Ansible playbooks in CI)
240forgejo_ansible_runner_enabled: true
241forgejo_ansible_runner_token: "{{ vault_runner.forgejo_ansible_runner_token | default('changeme') }}"
242forgejo_ansible_runner_name: "ansible-runner"
243forgejo_ansible_runner_capacity: 1
244forgejo_ansible_runner_version: 9.1.1
245
246# Stirling-PDF - PDF Processing
247stirling_pdf_enabled: true
248stirling_pdf_port: 8080
249stirling_pdf_config_dir: "/docker/stirling-pdf"
250stirling_pdf_data_dir: "/docker/stirling-pdf"
251
252# Tandoor - Recipe Manager
253tandoor_enabled: true
254tandoor_port: 8010
255tandoor_config_dir: "/docker/tandoor"
256tandoor_data_dir: "/docker/tandoor"
257tandoor_media_dir: "{{ tandoor_data_dir }}/media"
258tandoor_static_dir: "{{ tandoor_data_dir }}/static"
259tandoor_db_engine: "django.db.backends.postgresql"
260
261# Ghost CMS - Headless CMS
262ghost_enabled: true
263ghost_port: 2368
264ghost_config_dir: "/docker/ghost"
265ghost_data_dir: "/docker/ghost"
266ghost_content_dir: "{{ ghost_data_dir }}/content"
267ghost_db_client: "mysql"
268ghost_db_host: "ghost-mysql"
269ghost_db_name: "ghost"
270ghost_db_user: "ghost"
271ghost_url: "http://ghost.home"
272
273cvat_config_dir: "/docker/cvat"
274# CVAT - Data labeling
275cvat_enabled: true
276
277cvat_repo_url: "https://github.com/cvat-ai/cvat.git"
278cvat_repo_version: "{{ cvat_image_tag }}"
279
280cvat_admin_username: admin
281cvat_admin_password: "{{ vault_runner.cvat_admin_password | default('change-me') }}"
282cvat_admin_email: "{{ vault_runner.cvat_admin_email | default('change-me') }}"
283
284# Networking / access
285cvat_domain: "cvat.home" # used by Traefik routing in CVAT compose
286cvat_http_port: 8990 # Traefik "web" entrypoint in the default compose
287cvat_https_enabled: false # add CVAT's https overlay when true
288
289cvat_share_dir: >-
290 {{ (runner_nfs_mounts
291 | selectattr('name','equalto','cvat')
292 | map(attribute='local_path')
293 | first)
294 | default(runner_nfs_mount_dir ~ '/cvat', true) }}
295
296# Versioning / images
297cvat_image_tag: "v2.44.3" # pulled via CVAT_VERSION; align with the git tag you run
298
299# Optional: serverless auto-annotation overlay (Nuclio/SAM/YOLO assist in CVAT)
300cvat_serverless_enabled: false
301
302# Optional: use an external Postgres instead of the bundled one
303cvat_external_db_enabled: false
304cvat_db_host: "postgres.internal"
305cvat_db_port: 5432
306cvat_db_name: "cvat"
307cvat_db_user: "cvat_user"
308cvat_db_password: "{{ vault_runner.cvat_db_password | default('change-me') }}"
309
310# Optional: expose Traefik dashboard (binds host port below)
311cvat_traefik_dashboard_enabled: false
312cvat_dashboard_port: 8899
313
314# Optional: GPU reservation for CVAT server container (you must have host GPU runtime ready)
315cvat_gpu_enabled: false
316cvat_gpu_driver: "nvidia"
317cvat_gpu_count: "all" # or a number like "1"
318
319# ==============================================================================
320# DATABASE CONFIGURATIONS
321# ==============================================================================
322
323# PostgreSQL (Immich)
324postgres_enabled: "{{ immich_enabled }}"
325postgres_config_dir: "/docker/immich/postgres"
326postgres_db: "{{ vault_runner.postgres_db | default('') }}"
327postgres_user: "{{ vault_runner.postgres_user | default('') }}"
328postgres_version: "14"
329
330# Redis (Immich)
331redis_enabled: "{{ immich_redis_enabled }}"
332redis_config_dir: "/docker/immich/redis"
333redis_port: 6379
334
335# MySQL (Ghost CMS)
336mysql_enabled: "{{ ghost_enabled }}"
337mysql_config_dir: "/docker/ghost/mysql"
338mysql_db: "{{ ghost_db_name }}"
339mysql_user: "{{ ghost_db_user }}"
340mysql_version: "8.0"
341
342# ==============================================================================
343# SECURITY SETTINGS (FROM VAULT)
344# ==============================================================================
345
346# Database passwords
347postgres_password: "{{ vault_runner.postgres_password | default('') }}"
348mysql_password: "{{ vault_runner.mysql_password | default('') }}"
349mysql_root_password: "{{ vault_runner.mysql_root_password | default('') }}"
350
351# Service secrets
352immich_jwt_secret: "{{ vault_runner.immich_jwt_secret | default('') }}"
353ghost_database_password: "{{ vault_runner.ghost_database_password | default('') }}"
354tandoor_secret_key: "{{ vault_runner.tandoor_secret_key | default('') }}"
355
356# MQTT credentials (from vault - top-level, shared across all roles)
357mqtt_username: ""
358mqtt_password: ""
359
360# ==============================================================================
361# DIRECTORY STRUCTURE
362# ==============================================================================
363
364# Local configuration directories
365runner_config_directories:
366 - "{{ llm_stack_config_dir }}"
367 - "{{ llm_stack_ollama_data_dir }}"
368 - "{{ llm_stack_openwebui_data_dir }}"
369 - "{{ llm_stack_litellm_data_dir }}"
370 - "{{ frigate_config_dir }}"
371 - "{{ immich_config_dir }}"
372 - "{{ immich_config_dir }}/postgres"
373 - "{{ immich_config_dir }}/redis"
374 - "{{ immich_config_dir }}/library"
375 - "{{ immich_config_dir }}/cache"
376 - "{{ immich_config_dir }}/model-cache"
377 - "{{ immich_config_dir }}/postgres-init"
378 - "{{ forgejo_config_dir }}"
379 - "{{ forgejo_config_dir }}/forgejo-runner-data"
380 - "{{ forgejo_config_dir }}/forgejo-ansible-runner-data"
381 - "{{ stirling_pdf_config_dir }}"
382 - "{{ tandoor_config_dir }}"
383 - "{{ tandoor_data_dir }}/db"
384 - "{{ tandoor_data_dir }}/media"
385 - "{{ tandoor_data_dir }}/static"
386 - "{{ ghost_config_dir }}/config"
387 - "{{ ghost_config_dir }}/content"
388 - "{{ ghost_config_dir }}/mysql"
389
390# NFS mount directories
391runner_nfs_directories:
392 - "{{ runner_nfs_mount_dir }}"
393 - "{{ runner_nfs_mount_dir }}/frigate"
394 - "{{ runner_nfs_mount_dir }}/immich"
395 - "{{ runner_nfs_mount_dir }}/forgejo"
396 - "{{ runner_nfs_mount_dir }}/harbor"
397 - "{{ runner_nfs_mount_dir }}/cvat"
398
399# ==============================================================================
400# PERFORMANCE SETTINGS
401# ==============================================================================
402
403# Network performance tuning for NFS
404runner_performance_tuning_enabled: true
405runner_sysctl_settings:
406 # Extreme performance network buffers for Ryzen 7 + 32GB RAM
407 net.core.rmem_max: 268435456 # 256MB socket receive buffer
408 net.core.wmem_max: 268435456 # 256MB socket send buffer
409 net.core.rmem_default: 33554432 # 32MB default receive buffer
410 net.core.wmem_default: 33554432 # 32MB default send buffer
411 net.ipv4.tcp_rmem: "4096 131072 268435456" # TCP receive: 4KB min, 128KB default, 256MB max
412 net.ipv4.tcp_wmem: "4096 131072 268435456" # TCP send: 4KB min, 128KB default, 256MB max
413 net.core.netdev_max_backlog: 30000 # Handle high connection burst (32 connections)
414 net.ipv4.tcp_congestion_control: "bbr" # BBR congestion control
415 net.ipv4.tcp_window_scaling: 1 # Enable TCP window scaling
416 net.ipv4.tcp_timestamps: 1 # Enable TCP timestamps for RTT calculation
417 net.ipv4.tcp_sack: 1 # Enable selective acknowledgments
418 # NFS client cache tuning for 32GB RAM
419 vm.dirty_background_ratio: 3 # Start writeback at 3% (more aggressive)
420 vm.dirty_ratio: 8 # Force writeback at 8% (more aggressive)
421 vm.vfs_cache_pressure: 25 # Keep even more file cache (25% vs 50%)
422 vm.min_free_kbytes: 131072 # Keep 128MB free for network buffers
423
424# Harbor Configuration (external deployment)
425harbor_enabled: true
426harbor_config_dir: "/docker/harbor"
427harbor_version: "2.13.2"
428harbor_hostname: "{{ vault_runner.harbor_hostname | default('registry.local') }}"
429harbor_http_port: 8080
430harbor_registry_port: 5000
431harbor_admin_password: "{{ vault_runner.harbor_admin_password | default('changeme') }}"
432harbor_db_password: "{{ vault_runner.harbor_db_password | default('changeme') }}"
433harbor_data_volume: "{{ runner_nfs_mount_dir }}/harbor"
434
435# Docker resource limits
436default_memory_limit: "1g"
437default_cpu_limit: "1"
438
439# Health check configuration
440health_check_interval: "30s"
441health_check_timeout: "30s"
442health_check_retries: 5
443health_check_start_period: "60s"
444
445# ==============================================================================
446# SERVICE HEALTH ENDPOINTS
447# ==============================================================================
448service_endpoints:
449 ollama: "http://localhost:{{ llm_stack_ollama_port }}/api/tags"
450 openwebui: "http://localhost:{{ llm_stack_openwebui_port }}/api/health"
451 litellm: "http://localhost:{{ llm_stack_litellm_port }}/"
452 frigate: "http://localhost:{{ frigate_port }}/api/config"
453 immich: "http://localhost:{{ immich_server_port }}/api/server-info/ping"
454 forgejo: "http://localhost:{{ forgejo_http_port }}/api/v1/version"
455 stirling_pdf: "http://localhost:{{ stirling_pdf_port }}/api/v1/info/status"
456 tandoor: "http://localhost:{{ tandoor_port }}/accounts/login/"
457 ghost: "http://localhost:{{ ghost_port }}/ghost/api/admin/site/"
458
459# ==============================================================================
460# LOGGING CONFIGURATION
461# ==============================================================================
462logging_driver: "json-file"
463logging_max_size: "10m"
464logging_max_file: "3"
465
466# Service-specific logging levels (unified LLM stack uses llm_stack_* variables)
467# ollama_log_level: "info" # Now uses llm_stack_ollama_log_level
468# openwebui_log_level: "info" # Now uses llm_stack_openwebui_log_level
469# litellm_log_level: "info" # Now uses llm_stack_litellm_log_level
470frigate_log_level: "info"
471immich_log_level: "log"
472forgejo_log_level: "Info"
473ghost_logging: "info"
474
475