From d2ff39b5e660d5e14b9135d730e4faf7e49fd251 Mon Sep 17 00:00:00 2001 From: Tom Alexander Date: Sun, 13 Oct 2024 22:49:12 -0400 Subject: [PATCH] Move my home server over to linfi. --- ansible/environments/home/host_vars/homeserver | 11 ++++++++++- ansible/environments/home/hosts | 2 +- .../environments/laptop/host_vars/odofreebsd | 7 +++++++ ansible/playbook.yaml | 1 + ansible/roles/docker/tasks/linux.yaml | 1 + ansible/roles/firewall/files/homeserver_pf.conf | 10 +++++----- ansible/roles/firewall/files/rc.conf | 2 +- ansible/roles/linfi/defaults/main.yaml | 7 +++++++ ansible/roles/linfi/files/devmatch_rc.conf | 2 -- ansible/roles/linfi/files/launch_linfi.bash | 3 ++- ansible/roles/linfi/files/linfi_loader.conf | 3 --- ansible/roles/linfi/tasks/freebsd.yaml | 17 +++++++++++++---- ansible/roles/linfi/tasks/main.yaml | 2 +- .../roles/linfi/templates/devmatch_rc.conf.j2 | 2 ++ .../linfi/{files/linfi => templates/linfi.j2} | 2 +- .../roles/linfi/templates/linfi_loader.conf.j2 | 5 +++++ .../roles/network/files/homeserver_network.conf | 8 ++++---- 17 files changed, 61 insertions(+), 24 deletions(-) create mode 100644 ansible/roles/linfi/defaults/main.yaml delete mode 100644 ansible/roles/linfi/files/devmatch_rc.conf delete mode 100644 ansible/roles/linfi/files/linfi_loader.conf create mode 100644 ansible/roles/linfi/templates/devmatch_rc.conf.j2 rename ansible/roles/linfi/{files/linfi => templates/linfi.j2} (86%) create mode 100644 ansible/roles/linfi/templates/linfi_loader.conf.j2 diff --git a/ansible/environments/home/host_vars/homeserver b/ansible/environments/home/host_vars/homeserver index 785b6b1..e23f546 100644 --- a/ansible/environments/home/host_vars/homeserver +++ b/ansible/environments/home/host_vars/homeserver @@ -77,8 +77,17 @@ jail_list: # - name: mumbledb # mount: /var/db/murmur bhyve_dataset: zmass/encrypted/vm -bhyve_canmount: "on" +# Disable mounting bhyve dataset so it doesn't hide the unencrypted linfi vm +bhyve_canmount: "off" +bhyve_mountpoint: "none" bhyve_bemount: "on" wireguard_directory: homeserver enabled_wireguard: - wgh +linfi: + enabled: true + zfs_dataset: zmass/unencrypted/vm/linfi + zfs_mountpoint: /vm/linfi + driver_blocklist: "ath if_ath if_ath_pci ath_hal" + pci_blocklist: "6/0/0" + amd: false diff --git a/ansible/environments/home/hosts b/ansible/environments/home/hosts index 6fd0c33..5c22779 100644 --- a/ansible/environments/home/hosts +++ b/ansible/environments/home/hosts @@ -1,2 +1,2 @@ [headless] -homeserver ansible_user=talexander ansible_host=10.216.1.1 +homeserver ansible_user=talexander ansible_host=homeserver diff --git a/ansible/environments/laptop/host_vars/odofreebsd b/ansible/environments/laptop/host_vars/odofreebsd index 9112ecf..c2f530a 100644 --- a/ansible/environments/laptop/host_vars/odofreebsd +++ b/ansible/environments/laptop/host_vars/odofreebsd @@ -59,3 +59,10 @@ enabled_wireguard: - wgh - drmario - colo +linfi: + enabled: true + zfs_dataset: zroot/freebsd/current/vm/linfi + zfs_mountpoint: /vm/linfi + driver_blocklist: "if_iwm if_iwlwifi" + pci_blocklist: "1/0/0" + amd: true diff --git a/ansible/playbook.yaml b/ansible/playbook.yaml index bb7c89b..ffbfea3 100644 --- a/ansible/playbook.yaml +++ b/ansible/playbook.yaml @@ -133,6 +133,7 @@ vars: ansible_become: True roles: + - linfi - homeserver - hosts: odowork diff --git a/ansible/roles/docker/tasks/linux.yaml b/ansible/roles/docker/tasks/linux.yaml index 3f5c2cf..3b852c2 100644 --- a/ansible/roles/docker/tasks/linux.yaml +++ b/ansible/roles/docker/tasks/linux.yaml @@ -3,6 +3,7 @@ name: - docker - docker-compose + - docker-buildx state: present - name: Create docker zfs dataset diff --git a/ansible/roles/firewall/files/homeserver_pf.conf b/ansible/roles/firewall/files/homeserver_pf.conf index 2e1dddf..1a9db62 100644 --- a/ansible/roles/firewall/files/homeserver_pf.conf +++ b/ansible/roles/firewall/files/homeserver_pf.conf @@ -1,5 +1,5 @@ -ext_if = "{ igb0 igb1 ix0 ix1 wlan0 }" -not_ext_if = "{ !igb0 !igb1 !ix0 !ix1 !wlan0 }" +ext_if = "{ igb0 igb1 ix0 ix1 linfi_host }" +not_ext_if = "{ !igb0 !igb1 !ix0 !ix1 !linfi_host }" jail_nat_v4 = "{ 10.215.1.0/24 }" not_jail_nat_v4 = "{ any, !10.215.1.0/24 }" restricted_nat_v4 = "{ 10.215.2.0/24 }" @@ -19,17 +19,17 @@ unifi_ports = "{ 8443 3478 10001 8080 1900 8843 8880 6789 5514 }" set skip on lo # queueing -# altq on wlan0 cbq queue { def, stuff } +# altq on linfi_host cbq queue { def, stuff } # queue def cbq(default borrow) # queue stuff bandwidth 8Mb cbq { dagger } # queue dagger cbq(borrow) # redirections -nat pass on $ext_if inet from $jail_nat_v4 to $not_jail_nat_v4 -> (wlan0) +nat pass on $ext_if inet from $jail_nat_v4 to $not_jail_nat_v4 -> (linfi_host) rdr pass on $not_ext_if proto {tcp, udp} from any to 10.215.1.1 port 53 -> 172.16.0.1 port 53 # cloak -nat pass on $ext_if inet from 10.215.2.0/24 to !10.215.2.0/24 -> (wlan0) +nat pass on $ext_if inet from 10.215.2.0/24 to !10.215.2.0/24 -> (linfi_host) rdr pass on $not_ext_if proto {tcp, udp} from any to 10.215.2.1 port 53 -> 172.16.0.1 port 53 # bastion diff --git a/ansible/roles/firewall/files/rc.conf b/ansible/roles/firewall/files/rc.conf index 8d13069..a070d9b 100644 --- a/ansible/roles/firewall/files/rc.conf +++ b/ansible/roles/firewall/files/rc.conf @@ -1,2 +1,2 @@ -pf_enable="NO" +pf_enable="YES" pf_rules="/etc/pf.conf" diff --git a/ansible/roles/linfi/defaults/main.yaml b/ansible/roles/linfi/defaults/main.yaml new file mode 100644 index 0000000..67825a6 --- /dev/null +++ b/ansible/roles/linfi/defaults/main.yaml @@ -0,0 +1,7 @@ +# linfi: +# enabled: true +# zfs_dataset: zroot/freebsd/current/vm/linfi +# zfs_mountpoint: /vm/linfi +# driver_blocklist: "if_iwm if_iwlwifi" +# pci_blocklist: "1/0/0" +# amd: true diff --git a/ansible/roles/linfi/files/devmatch_rc.conf b/ansible/roles/linfi/files/devmatch_rc.conf deleted file mode 100644 index 8a6799a..0000000 --- a/ansible/roles/linfi/files/devmatch_rc.conf +++ /dev/null @@ -1,2 +0,0 @@ -devmatch_enable="YES" -devmatch_blocklist="if_iwm if_iwlwifi" diff --git a/ansible/roles/linfi/files/launch_linfi.bash b/ansible/roles/linfi/files/launch_linfi.bash index 5f01478..3b5d8e9 100644 --- a/ansible/roles/linfi/files/launch_linfi.bash +++ b/ansible/roles/linfi/files/launch_linfi.bash @@ -32,6 +32,7 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" : ${VNC_LISTEN:="127.0.0.1:5900"} : ${VNC_WIDTH:="1920"} : ${VNC_HEIGHT:="1080"} +: ${PASSTHROUGH:="1/0/0"} if [ "$VERBOSE" = "YES" ]; then set -x @@ -142,7 +143,7 @@ function start_vm { -s 0,hostbridge \ -s "4,nvme,/dev/zvol/${zfs_path}/disk0" \ -S \ - -s 7,passthru,1/0/0 \ + -s "7,passthru,${PASSTHROUGH}" \ -s 30,xhci,tablet \ -s 31,lpc -l com1,stdio \ -l "bootrom,/usr/local/share/uefi-firmware/BHYVE_UEFI.fd,${mount_path}/BHYVE_UEFI_VARS.fd" \ diff --git a/ansible/roles/linfi/files/linfi_loader.conf b/ansible/roles/linfi/files/linfi_loader.conf deleted file mode 100644 index a736ddd..0000000 --- a/ansible/roles/linfi/files/linfi_loader.conf +++ /dev/null @@ -1,3 +0,0 @@ -vmm_load="YES" -pptdevs="1/0/0" -hw.vmm.amdvi.enable="1" diff --git a/ansible/roles/linfi/tasks/freebsd.yaml b/ansible/roles/linfi/tasks/freebsd.yaml index 29748fb..aec1ef1 100644 --- a/ansible/roles/linfi/tasks/freebsd.yaml +++ b/ansible/roles/linfi/tasks/freebsd.yaml @@ -1,6 +1,6 @@ - name: Install loader.conf - copy: - src: "files/{{ item }}_loader.conf" + template: + src: "templates/{{ item }}_loader.conf.j2" dest: "/boot/loader.conf.d/{{ item }}.conf" mode: 0644 owner: root @@ -20,8 +20,8 @@ dest: /usr/local/bin/launch_linfi - name: Install rc script - copy: - src: "files/{{ item.src }}" + template: + src: "templates/{{ item.src }}.j2" dest: "/usr/local/etc/rc.d/{{ item.dest|default(item.src) }}" owner: root group: wheel @@ -38,4 +38,13 @@ group: wheel loop: - linfi + +- name: Install service configuration + template: + src: "templates/{{ item }}_rc.conf.j2" + dest: "/etc/rc.conf.d/{{ item }}" + mode: 0644 + owner: root + group: wheel + loop: - devmatch diff --git a/ansible/roles/linfi/tasks/main.yaml b/ansible/roles/linfi/tasks/main.yaml index 6805b9d..9d71469 100644 --- a/ansible/roles/linfi/tasks/main.yaml +++ b/ansible/roles/linfi/tasks/main.yaml @@ -1,2 +1,2 @@ - import_tasks: tasks/common.yaml - # when: foo is defined + when: linfi is defined and linfi.enabled diff --git a/ansible/roles/linfi/templates/devmatch_rc.conf.j2 b/ansible/roles/linfi/templates/devmatch_rc.conf.j2 new file mode 100644 index 0000000..6b158a6 --- /dev/null +++ b/ansible/roles/linfi/templates/devmatch_rc.conf.j2 @@ -0,0 +1,2 @@ +devmatch_enable="YES" +devmatch_blocklist="{{ linfi.driver_blocklist }}" diff --git a/ansible/roles/linfi/files/linfi b/ansible/roles/linfi/templates/linfi.j2 similarity index 86% rename from ansible/roles/linfi/files/linfi rename to ansible/roles/linfi/templates/linfi.j2 index 44e1eba..3d8cc3a 100644 --- a/ansible/roles/linfi/files/linfi +++ b/ansible/roles/linfi/templates/linfi.j2 @@ -14,7 +14,7 @@ load_rc_config $name tmux_name="linfi" linfi_start() { - /usr/local/bin/tmux new-session -d -s "$tmux_name" "/usr/bin/env VNC_ENABLE=YES VNC_LISTEN=0.0.0.0:5900 /usr/local/bin/bash /usr/local/bin/launch_linfi start linfi zroot/freebsd/current/vm/linfi /vm/linfi" + /usr/local/bin/tmux new-session -d -s "$tmux_name" "/usr/bin/env PASSTHROUGH='{{ linfi.pci_blocklist }}' /usr/local/bin/bash /usr/local/bin/launch_linfi start linfi {{ linfi.zfs_dataset }} {{ linfi.zfs_mountpoint }}" # /vm/.iso/alpine-extended-3.20.3-x86_64.iso } diff --git a/ansible/roles/linfi/templates/linfi_loader.conf.j2 b/ansible/roles/linfi/templates/linfi_loader.conf.j2 new file mode 100644 index 0000000..ffbabb5 --- /dev/null +++ b/ansible/roles/linfi/templates/linfi_loader.conf.j2 @@ -0,0 +1,5 @@ +vmm_load="YES" +pptdevs="{{ linfi.pci_blocklist }}" +{% if linfi.amd %} +hw.vmm.amdvi.enable="1" +{% endif %} diff --git a/ansible/roles/network/files/homeserver_network.conf b/ansible/roles/network/files/homeserver_network.conf index 9124ea6..69e68f1 100644 --- a/ansible/roles/network/files/homeserver_network.conf +++ b/ansible/roles/network/files/homeserver_network.conf @@ -1,4 +1,4 @@ -wlans_ath0="wlan0" -ifconfig_wlan0="WPA DHCP" -ifconfig_wlan0_ipv6="inet6 accept_rtadv" -ipv6_cpe_wanif="wlan0" +# wlans_ath0="wlan0" +# ifconfig_wlan0="WPA DHCP" +# ifconfig_wlan0_ipv6="inet6 accept_rtadv" +# ipv6_cpe_wanif="wlan0"