Nik Afiq
5a00f5767b
Stage 4 of REFACTOR_PLAN.md. - Merge ansible/ansible.cfg into root ansible.cfg (single source of truth); the dual-config setup silently broke documented commands and lost host_key_checking=False when run from the ansible/ directory. - Add ansible/requirements.yml pinning community.general, ansible.posix, community.docker -- previously undocumented deps of the glances/watch-party roles that would fail a fresh bootstrap. - Align K3s version to v1.32.4+k3s1 across roles/k3s-server, roles/k3s-agent, and host_vars/gpu-node.yaml defaults (was skewed: .2 vs .4). This only changes what a *future* provision installs -- minisforum/debian are still live on v1.32.2+k3s1 until separately upgraded. - Fix kubeconfig fetch/replace path mismatch in k3s-server role: the `fetch` task (flat: true) writes to ~/.kube/config, but `replace` was targeting a /tmp/k3s-minisforum.yaml nothing creates -- would break a fresh rebuild. - gitea-runner: only remove /run/docker.sock when it's actually a directory (task name implied a check that wasn't there); tighten registration-token systemd unit from 0644 to 0600. - nvidia: stop unconditionally reporting `changed` (and restarting Docker) on every run for an idempotent runtime-configure command. - Gate the K3s join-token debug print and WireGuard client-config/QR display behind opt-in vars (k3s_show_token, wireguard_show_client_configs), default off -- both were printing real secrets to console on every run. - Parameterize the docker role for Debian and Ubuntu; homeassistant now depends on it (meta/main.yaml) instead of duplicating a Debian-only Docker install inline. - FQCN cleanup across wireguard, homeassistant, and ollama roles/handlers (bare module names -> ansible.builtin.*/community.general.*/ansible.posix.*), plus a few ansible-lint name-casing/idiom fixes. Handler renames verified against their `notify:` call sites so notifications still fire. - Update ansible/README.md and root README.md: add gpu-node/gpu_workstation (4th host, previously undocumented), docker/nvidia roles, setup-gpu-node.yaml, homeassistant.yaml, requirements.yml install step; correct the "Legacy" homeassistant label (it's the only thing serving ha.home.arpa); correct the Gitea ingress/backup-storage doc-drift; flag the Grafana/Loki static-PV binding drift discovered via live cluster check. Verified: all playbooks pass `ansible-playbook --syntax-check`, yamllint clean. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
86 lines
2.8 KiB
YAML
86 lines
2.8 KiB
YAML
---
|
|
# Part of role: nvidia
|
|
# Called by: ansible/playbooks/setup-gpu-node.yaml
|
|
# Description: Installs NVIDIA drivers, CUDA toolkit, and nvidia-container-toolkit.
|
|
# Configures Docker and K3s containerd runtimes for GPU access.
|
|
|
|
- name: Add NVIDIA CUDA apt keyring
|
|
ansible.builtin.shell:
|
|
cmd: >
|
|
curl -fsSL
|
|
https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2404/x86_64/cuda-keyring_1.1-1_all.deb
|
|
-o /tmp/cuda-keyring.deb && dpkg -i /tmp/cuda-keyring.deb
|
|
creates: /usr/share/keyrings/cuda-archive-keyring.gpg
|
|
|
|
- name: Add NVIDIA container toolkit keyring
|
|
ansible.builtin.shell:
|
|
cmd: >
|
|
curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey |
|
|
gpg --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg
|
|
creates: /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg
|
|
|
|
- name: Add NVIDIA container toolkit repo
|
|
ansible.builtin.shell:
|
|
cmd: >
|
|
curl -fsSL https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list |
|
|
sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' |
|
|
tee /etc/apt/sources.list.d/nvidia-container-toolkit.list
|
|
creates: /etc/apt/sources.list.d/nvidia-container-toolkit.list
|
|
|
|
- name: Update apt cache
|
|
ansible.builtin.apt:
|
|
update_cache: true
|
|
|
|
- name: Install NVIDIA driver
|
|
ansible.builtin.apt:
|
|
name: "nvidia-driver-{{ nvidia_driver_version }}"
|
|
state: present
|
|
register: nvidia_driver_install
|
|
|
|
- name: Install CUDA toolkit
|
|
ansible.builtin.apt:
|
|
name: "cuda-toolkit-{{ cuda_version }}"
|
|
state: present
|
|
|
|
- name: Install nvidia-container-toolkit
|
|
ansible.builtin.apt:
|
|
name: nvidia-container-toolkit
|
|
state: present
|
|
|
|
- name: Add CUDA to system PATH
|
|
ansible.builtin.copy:
|
|
dest: /etc/profile.d/cuda.sh
|
|
content: |
|
|
export PATH=/usr/local/cuda/bin:$PATH
|
|
export LD_LIBRARY_PATH=/usr/local/cuda/lib64:$LD_LIBRARY_PATH
|
|
mode: "0644"
|
|
|
|
- name: Check if Docker already has the NVIDIA runtime configured
|
|
ansible.builtin.command:
|
|
cmd: grep -q '"nvidia"' /etc/docker/daemon.json
|
|
register: nvidia_docker_runtime_check
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Configure Docker runtime for NVIDIA
|
|
ansible.builtin.command:
|
|
cmd: nvidia-ctk runtime configure --runtime=docker
|
|
when: nvidia_docker_runtime_check.rc != 0
|
|
changed_when: true
|
|
notify: Restart docker
|
|
|
|
- name: Reboot if driver was just installed
|
|
ansible.builtin.reboot:
|
|
reboot_timeout: 300
|
|
when: nvidia_driver_install.changed
|
|
|
|
- name: Verify NVIDIA driver loaded
|
|
ansible.builtin.command: nvidia-smi
|
|
changed_when: false
|
|
failed_when: false
|
|
register: nvidia_smi_check
|
|
|
|
- name: Assert nvidia-smi succeeded
|
|
ansible.builtin.assert:
|
|
that: nvidia_smi_check.rc == 0
|
|
fail_msg: "nvidia-smi failed — driver may not have loaded correctly" |