Reconcile group_vars/inventory with live deployment state: IP to home LAN (192.168.1.24), remove Ollama/Cockpit remnants, add zram+swapfile decision, case info; confirm phase-3 filesystem role fixes
This commit is contained in:
parent
cd132578a1
commit
773fd4ce4f
GPG key ID:
306E507219506D4E
3 changed files with 175 additions and 43 deletions
|
|
@ -1,106 +1,237 @@
|
|||
---
|
||||
# BigBoy Hardware-Specific Variables
|
||||
# Used by all Ansible roles in the deployment playbook
|
||||
#
|
||||
# Last reconciled: 2026-07-19, after Phase 1-5 completed successfully.
|
||||
|
||||
# ============================================================================
|
||||
# Hostname and Network
|
||||
# ============================================================================
|
||||
|
||||
hostname: bigboy
|
||||
domain: local
|
||||
ip_address: 192.168.0.240
|
||||
|
||||
# NVMe OS Drive (500GB Samsung 980)
|
||||
# Current, permanent address — home LAN, statically reserved on the
|
||||
# FritzBox to match BigBoy's role.
|
||||
ip_address: "192.168.1.24"
|
||||
|
||||
# History: BigBoy ran on the workbench bench LAN for the entire initial
|
||||
# deploy (Phase 1 through the first successful chat test), first at
|
||||
# .240, then .241 after a DHCP reassignment — both were genuinely correct
|
||||
# at the time, not mistakes. It moved to the home LAN address above once
|
||||
# chat-interface testing required reaching it from another device on
|
||||
# 192.168.1.0/24. The bench LAN range (192.168.0.0/24) is still allowed
|
||||
# through the firewall for any future maintenance back on that segment.
|
||||
|
||||
# ============================================================================
|
||||
# NVMe OS Drive (500GB Samsung 980) — root stays xfs, deliberately
|
||||
# ============================================================================
|
||||
#
|
||||
# No supported in-place xfs-to-btrfs conversion exists. Root's eventual
|
||||
# conversion (clone/reformat/restore via debusb) is deferred until real-
|
||||
# world testing has run for a while — not before ~a month out from
|
||||
# 2026-07-17. This is a decision, not a gap.
|
||||
|
||||
nvme_device: /dev/nvme0n1
|
||||
nvme_boot_partition: /dev/nvme0n1p1
|
||||
nvme_root_partition: /dev/nvme0n1p2
|
||||
uuid_nvme_root: "5daac1d7-10b3-498a-82b0-a4498d7e0717"
|
||||
uuid_nvme_boot: "8DCA-6B31"
|
||||
|
||||
# Data Drive UUIDs (from lsblk output after kickstart)
|
||||
uuid_rag_library: "18b9accd-754a-46f3-b994-da3c7ae795cd"
|
||||
uuid_prompt_library: "82a240c4-390a-4167-8232-6a04ce4d84bb"
|
||||
uuid_backup: "15b69400-f1f7-4cfd-82cb-4d1244951503"
|
||||
uuid_ai_logs: "1e57a52a-9c9d-44ef-a352-3cc542808d13"
|
||||
# ============================================================================
|
||||
# Data Drives — by-id targeting (stable across boots), real UUIDs below
|
||||
# for reference only
|
||||
# ============================================================================
|
||||
#
|
||||
# Phase 3 converts these from the kickstart's forced xfs to real btrfs.
|
||||
# Ansible roles target drives by the by-id paths below and discover the
|
||||
# resulting filesystem UUID at runtime via blkid — the UUIDs are NOT
|
||||
# consumed directly by any role, since they don't exist until mkfs.btrfs
|
||||
# actually runs. They're recorded here purely as a point-in-time record
|
||||
# of the current, live, post-conversion state (confirmed 2026-07-19).
|
||||
# If a drive is ever reformatted again, this record goes stale — trust
|
||||
# `blkid`/`findmnt` on the live system over this file for anything
|
||||
# operationally important.
|
||||
|
||||
drive_backup_byid: "ata-Lexar_SSD_NS100_256GB_QM9370R0291730S340"
|
||||
drive_rag_byid: "ata-Samsung_SSD_870_EVO_500GB_S6PYNL0T620757H"
|
||||
drive_ai_logs_byid: "ata-Samsung_SSD_870_EVO_250GB_S61WNJ0R458541M"
|
||||
drive_prompt_byid: "ata-Lexar_SSD_NS100_256GB_QM9370R0290370S340"
|
||||
|
||||
# Current live btrfs UUIDs, recorded 2026-07-19 for reference only:
|
||||
# backup: 877b45fc-27ce-41e7-9ccc-a2ce61848cd6
|
||||
# rag-library: 039ff7fd-1540-4095-97e2-665c3a054e78
|
||||
# ai-logs: 07c23328-385c-4e73-a61d-7d9e67311c04
|
||||
# prompt-library: b6ee289b-3176-48b4-a577-1b9af6c7e098
|
||||
|
||||
# Data Drives Configuration
|
||||
data_drives:
|
||||
- { name: rag-library, uuid: "{{ uuid_rag_library }}", mount: /srv/rag-library }
|
||||
- { name: prompt-library, uuid: "{{ uuid_prompt_library }}", mount: /srv/prompt-library }
|
||||
- { name: backup, uuid: "{{ uuid_backup }}", mount: /srv/backup }
|
||||
- { name: ai-logs, uuid: "{{ uuid_ai_logs }}", mount: /srv/ai-logs }
|
||||
- { name: backup, mount: /srv/backup }
|
||||
- { name: rag-library, mount: /srv/rag-library }
|
||||
- { name: ai-logs, mount: /srv/ai-logs }
|
||||
- { name: prompt-library, mount: /srv/prompt-library }
|
||||
|
||||
# Filesystem options (all btrfs drives)
|
||||
btrfs_mount_options: "compress=zstd,noatime,nofail"
|
||||
# Confirmed actual mount options in use (mkfs.btrfs defaults to zstd:3):
|
||||
btrfs_mount_options: "compress=zstd,noatime"
|
||||
|
||||
# ============================================================================
|
||||
# NVIDIA GPU Configuration
|
||||
# ============================================================================
|
||||
|
||||
nvidia_gpu_pci_id: "10de:2d04" # RTX 5060 Ti Blackwell
|
||||
nvidia_driver_version: "595.84"
|
||||
|
||||
# NEEDS A LIVE CHECK — nvicia-smi output was never captured in the
|
||||
# deployment conversation; Phase 4 completed successfully ("smooth as
|
||||
# silk") but the actual installed version was never recorded. Run
|
||||
# `nvidia-smi` on BigBoy and replace this placeholder with the real
|
||||
# value — do not assume this number is correct.
|
||||
nvidia_driver_version: "CHECK-WITH-nvidia-smi"
|
||||
|
||||
cuda_visible_devices: "0"
|
||||
cuda_toolkit_version: "13.3.0" # confirmed via nvcc --version during Phase 5
|
||||
|
||||
# Ollama Configuration
|
||||
ollama_host_ip: "127.0.0.1"
|
||||
ollama_port: 11434
|
||||
ollama_max_loaded_models: 1
|
||||
ollama_keep_alive: "5m"
|
||||
ollama_flash_attention: 1
|
||||
ollama_gpu_overhead: 536870912 # 512MB
|
||||
ollama_max_queue: 4
|
||||
# ============================================================================
|
||||
# llama.cpp / Model Configuration
|
||||
# ============================================================================
|
||||
|
||||
llama_cpp_tag: "b9968" # pinned, verified against real commit dates — do not track master
|
||||
model_repo: "mistralai/Ministral-3-14B-Instruct-2512-GGUF"
|
||||
model_quant: "Q4_K_M"
|
||||
|
||||
llama_server_host: "127.0.0.1" # bound to localhost only — nginx fronts it
|
||||
llama_server_port: 8080
|
||||
|
||||
# API key: DO NOT put the real key here. This file is committed to a
|
||||
# public repo. Use ansible-vault, or an untracked file following the
|
||||
# same pattern as ansible/keys/workbench.pub (gitignored, deployed
|
||||
# locally on whichever machine runs the playbook) — not a plaintext
|
||||
# variable in this file, even as a placeholder value that might get
|
||||
# overwritten with something real and accidentally committed later.
|
||||
|
||||
# ============================================================================
|
||||
# System Resources
|
||||
# ============================================================================
|
||||
|
||||
total_memory_gb: 16
|
||||
zram_percentage: 50 # 50% of RAM = 8GB zram
|
||||
cpu_count: 6
|
||||
gpu_vram_gb: 16
|
||||
|
||||
# Both of these are active simultaneously, by decision (2026-07-19) —
|
||||
# zram as a fast, compressed first tier; the swapfile as the larger,
|
||||
# slower fallback. The swapfile was what actually resolved the OOM kill
|
||||
# during the llama.cpp CUDA build; zram is a deliberate complementary
|
||||
# addition, not a replacement for it.
|
||||
zram_percentage: 50 # 50% of RAM = 8GB zram, NOT YET IMPLEMENTED — see below
|
||||
swapfile_path: /swapfile
|
||||
swapfile_size_gb: 16 # implemented 2026-07-19, persistent via /etc/fstab
|
||||
|
||||
# NEEDS IMPLEMENTATION — zram_percentage above is not yet acted on by
|
||||
# any role. Decision made to keep it and implement properly (systemd
|
||||
# zram-generator or equivalent) rather than remove it; this is tracked
|
||||
# work, not done yet.
|
||||
|
||||
# ============================================================================
|
||||
# Network NIC
|
||||
# ============================================================================
|
||||
|
||||
network_interface: enp4s0
|
||||
network_mac_address: "9c:6b:00:33:e0:ac" # For future pinning
|
||||
network_mac_address: "9c:6b:00:33:e0:ac" # for future pinning
|
||||
|
||||
# ============================================================================
|
||||
# Firewall
|
||||
firewall_enabled: true
|
||||
firewall_ssh_port: 22
|
||||
firewall_open_webui_port: 8080
|
||||
firewall_cockpit_port: 9090
|
||||
firewall_zone: public # Can be changed to 'internal' for LAN-only access
|
||||
# ============================================================================
|
||||
|
||||
firewall_enabled: true
|
||||
firewall_zone: public
|
||||
|
||||
# SSH allowed from both ranges — home LAN (current) and bench LAN
|
||||
# (previous, kept open for any future maintenance there)
|
||||
firewall_ssh_port: 22
|
||||
firewall_allowed_ranges:
|
||||
- "192.168.1.0/24" # home LAN — current
|
||||
- "192.168.0.0/24" # workbench bench LAN — used during initial deploy
|
||||
|
||||
# nginx reverse-proxy port for llama-server's web UI/API, same LAN
|
||||
# restriction as SSH
|
||||
firewall_http_port: 80
|
||||
|
||||
# Open WebUI was explicitly dropped (llama-server's own built-in UI
|
||||
# covers this). Cockpit was explicitly decided against (2026-07-19) —
|
||||
# not worth the attack surface / resource cost for what it'd add here.
|
||||
# Neither firewall_open_webui_port nor firewall_cockpit_port exist
|
||||
# anymore — removed, not just commented out.
|
||||
|
||||
# ============================================================================
|
||||
# Deployment Logging
|
||||
# ============================================================================
|
||||
|
||||
deployment_log_dir: /srv/deployment-log
|
||||
deployment_log_owner: root
|
||||
deployment_log_group: root
|
||||
deployment_log_mode: "0755"
|
||||
|
||||
# ============================================================================
|
||||
# User Configuration
|
||||
# ============================================================================
|
||||
|
||||
deploy_user: john
|
||||
bigboy_admin_user: "{{ deploy_user }}" # alias — Phase 2 role expects this name
|
||||
deploy_user_groups: ['wheel']
|
||||
deploy_user_shell: /bin/bash
|
||||
deploy_user_password_lock: false # Unlock for SSH key setup
|
||||
|
||||
# ============================================================================
|
||||
# Timezone and Locale
|
||||
# ============================================================================
|
||||
|
||||
timezone: Europe/Rome
|
||||
locale: en_US.UTF-8
|
||||
keyboard_layout: us
|
||||
|
||||
# ============================================================================
|
||||
# Package Update Strategy
|
||||
package_update_method: dnf
|
||||
auto_update_enabled: false # Don't auto-update; let Ansible control it
|
||||
# ============================================================================
|
||||
|
||||
package_update_method: dnf
|
||||
auto_update_enabled: false # don't auto-update; let Ansible control it
|
||||
|
||||
# ============================================================================
|
||||
# Service Configuration
|
||||
# ============================================================================
|
||||
#
|
||||
# Corrected 2026-07-19 — ollama and cockpit were never actually built;
|
||||
# llama-server and nginx are what's actually running.
|
||||
|
||||
services_enabled:
|
||||
- sshd
|
||||
- ollama
|
||||
- cockpit
|
||||
- llama-server
|
||||
- nginx
|
||||
- firewalld
|
||||
|
||||
services_disabled:
|
||||
- avahi-daemon
|
||||
|
||||
# ============================================================================
|
||||
# Kernel Parameters (added during install, may need tuning)
|
||||
# ============================================================================
|
||||
|
||||
kernel_params:
|
||||
- "amd_pstate=active"
|
||||
- "pci=realloc=off" # May be needed if PCI BAR allocation issues
|
||||
- "pci=realloc=off" # may be needed if PCI BAR allocation issues
|
||||
|
||||
# ============================================================================
|
||||
# Hardware Validation
|
||||
# ============================================================================
|
||||
|
||||
validate_gpu_on_boot: true
|
||||
validate_filesystems_on_boot: true
|
||||
validate_network_on_boot: true
|
||||
|
||||
# Phase Control (set via command line or here for manual execution)
|
||||
# phase_to_run: "all" # Or specific phase: "3", "4", "5", etc.
|
||||
# ============================================================================
|
||||
# Physical Case
|
||||
# ============================================================================
|
||||
|
||||
case_model: "Modcase HYPER"
|
||||
case_license_tier: "personal"
|
||||
case_license_purchased: "2026-07-19"
|
||||
case_license_note: >-
|
||||
Personal-use licence only. Do not print for resale or client delivery
|
||||
until the commercial tier is purchased. Digital file redistribution is
|
||||
prohibited under the current licence regardless of tier.
|
||||
|
|
@ -1,13 +1,14 @@
|
|||
[all:vars]
|
||||
# Ansible SSH Configuration
|
||||
ansible_user=<your-actual-admin-username>
|
||||
ansible_user=john
|
||||
ansible_ssh_private_key_file=~/.ssh/id_ed25519
|
||||
ansible_python_interpreter=/usr/bin/python3
|
||||
ansible_gather_facts=yes
|
||||
|
||||
[bigboy]
|
||||
# BigBoy hostname on Fritzy LAN (workbench bench LAN)
|
||||
192.168.0.240 ansible_host=192.168.0.240 ansible_name=bigboy
|
||||
# BigBoy's permanent address on the FritzBox home LAN (static reservation,
|
||||
# 2026-07-19). Previously ran on the workbench bench LAN during initial
|
||||
# deploy (192.168.0.240, then .241 after a DHCP reassignment).
|
||||
192.168.1.24 ansible_host=192.168.1.24 ansible_name=bigboy
|
||||
|
||||
[bigboy:vars]
|
||||
ansible_connection=ssh
|
||||
|
|
|
|||
|
|
@ -38,7 +38,7 @@
|
|||
final_mount: /srv/prompt-library
|
||||
|
||||
- name: Check current filesystem type on each drive
|
||||
ansible.builtin.command: "blkid -o value -s TYPE /dev/disk/by-id/{{ item.byid }}1"
|
||||
ansible.builtin.command: "blkid -o value -s TYPE /dev/disk/by-id/{{ item.byid }}-part1"
|
||||
register: current_fstype
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
|
|
@ -76,13 +76,13 @@
|
|||
- name: Format as btrfs with zstd compression
|
||||
ansible.builtin.command: >
|
||||
mkfs.btrfs -f
|
||||
/dev/disk/by-id/{{ item.byid }}1
|
||||
/dev/disk/by-id/{{ item.byid }}-part1
|
||||
loop: "{{ drives_to_convert }}"
|
||||
loop_control:
|
||||
label: "{{ item.name }}"
|
||||
|
||||
- name: Discover the fresh filesystem UUID for each newly-converted drive
|
||||
ansible.builtin.command: "blkid -o value -s UUID /dev/disk/by-id/{{ item.byid }}1"
|
||||
ansible.builtin.command: "blkid -o value -s UUID /dev/disk/by-id/{{ item.byid }}-part1"
|
||||
register: new_uuids
|
||||
changed_when: false
|
||||
loop: "{{ drives_to_convert }}"
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue