platform: OpenTofu/Ansible für Proxmox, CI, Makefile, Doku-Abgleich

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-12 00:54:23 +02:00
parent cb5a413169
commit f22eaa8449
27 changed files with 623 additions and 6 deletions
@@ -0,0 +1,11 @@
+- name: Docker aus Distribution installieren
+  ansible.builtin.apt:
+    name: [docker.io, docker-compose-v2]
+    state: present
+    update_cache: true
+
+- name: Docker aktivieren
+  ansible.builtin.service:
+    name: docker
+    state: started
+    enabled: true
@@ -0,0 +1,8 @@
+# Treiber pro GPU-Generation fest pinnen (ADR-0001).
+# legacy (Maxwell/Pascal): letzte Treiber-Branch mit Unterstützung; Userland CUDA 12.x
+# Paketnamen (nvidia-driver-<branch>-server) beim Deployment gegen das Gast-OS prüfen.
+# modern (Ada): eigene Branch, unabhängig aktualisierbar (Update = Snapshot + Lifecycle-Kandidat "engine")
+nvidia_driver_branch:
+  legacy: "580"
+  modern: "580"
+nvidia_textfile_dir: /var/lib/node_exporter/textfile
@@ -0,0 +1,12 @@
+- name: configure nvidia runtime
+  ansible.builtin.command: nvidia-ctk runtime configure --runtime=docker
+  notify: restart docker
+
+- name: restart docker
+  ansible.builtin.service:
+    name: docker
+    state: restarted
+
+- name: reload systemd
+  ansible.builtin.systemd:
+    daemon_reload: true
@@ -0,0 +1,84 @@
+- name: Treiber-Branch bestimmen
+  ansible.builtin.set_fact:
+    _branch: "{{ nvidia_driver_branch[driver_generation] }}"
+
+- name: NVIDIA-Treiber (Server-Variante) installieren
+  ansible.builtin.apt:
+    name:
+      - "nvidia-driver-{{ _branch }}-server"
+      - "nvidia-utils-{{ _branch }}-server"
+    state: present
+    update_cache: true
+  register: driver
+
+- name: Treiber gegen ungewollte Updates sperren
+  ansible.builtin.dpkg_selections:
+    name: "{{ item }}"
+    selection: hold
+  loop:
+    - "nvidia-driver-{{ _branch }}-server"
+    - "nvidia-utils-{{ _branch }}-server"
+
+- name: NVIDIA-Container-Toolkit-Repository
+  ansible.builtin.shell: |
+    set -euo pipefail
+    curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey | gpg --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg
+    curl -fsSL https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list \
+      | sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' \
+      > /etc/apt/sources.list.d/nvidia-container-toolkit.list
+  args:
+    creates: /etc/apt/sources.list.d/nvidia-container-toolkit.list
+    executable: /bin/bash
+
+- name: Container-Toolkit installieren und für Docker konfigurieren
+  ansible.builtin.apt:
+    name: nvidia-container-toolkit
+    state: present
+    update_cache: true
+  notify: configure nvidia runtime
+
+- name: Modell-Disk (scsi1) formatieren, falls leer (formatiert nie eine vorhandene Partition um)
+  community.general.filesystem:
+    dev: /dev/sdb
+    fstype: ext4
+    opts: -L models
+  when: ansible_devices.sdb is defined
+
+- name: Modell-Disk einhängen
+  ansible.posix.mount:
+    path: /srv/models
+    src: LABEL=models
+    fstype: ext4
+    state: mounted
+  when: ansible_devices.sdb is defined
+
+- name: Textfile-Verzeichnis für node_exporter
+  ansible.builtin.file:
+    path: "{{ nvidia_textfile_dir }}"
+    state: directory
+    mode: "0755"
+
+- name: Xid-Exporter-Skript
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../../../../deploy/scripts/gpu-xid-textfile.sh"
+    dest: /usr/local/bin/gpu-xid-textfile.sh
+    mode: "0755"
+
+- name: systemd-Service und -Timer für Xid-Exporter
+  ansible.builtin.template:
+    src: "{{ item }}.j2"
+    dest: "/etc/systemd/system/{{ item }}"
+    mode: "0644"
+  loop: [gpu-xid-textfile.service, gpu-xid-textfile.timer]
+  notify: reload systemd
+
+- name: Timer aktivieren
+  ansible.builtin.systemd:
+    name: gpu-xid-textfile.timer
+    enabled: true
+    state: started
+    daemon_reload: true
+
+- name: Neustart nach Treiberinstallation
+  ansible.builtin.reboot:
+  when: driver.changed
@@ -0,0 +1,6 @@
+[Unit]
+Description=NVIDIA-Xid-Fehler für node_exporter zählen
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/gpu-xid-textfile.sh {{ nvidia_textfile_dir }}
@@ -0,0 +1,9 @@
+[Unit]
+Description=NVIDIA-Xid-Fehler minütlich zählen
+
+[Timer]
+OnBootSec=1min
+OnUnitActiveSec=1min
+
+[Install]
+WantedBy=timers.target
@@ -0,0 +1,4 @@
+pve_iommu_cmdline: "intel_iommu=on iommu=pt"
+pve_vfio_modules: [vfio, vfio_iommu_type1, vfio_pci]
+# ZFS-Replikation der Infra-Gäste (ADR-0002), gefüllt aus sites/<site>/proxmox.yaml
+pve_site_file: "{{ playbook_dir }}/../../../../sites/{{ knaster_site }}/proxmox.yaml"
@@ -0,0 +1,3 @@
+- name: refresh boot
+  ansible.builtin.shell: proxmox-boot-tool refresh || update-grub
+  changed_when: true
@@ -0,0 +1,70 @@
+- name: Site-Datei laden
+  ansible.builtin.set_fact:
+    knaster_pve: "{{ lookup('ansible.builtin.file', pve_site_file) | from_yaml }}"
+  run_once: true
+  delegate_to: localhost
+
+- name: Bootloader erkennen (systemd-boot bei ZFS-Root, sonst GRUB)
+  ansible.builtin.stat:
+    path: /etc/kernel/cmdline
+  register: kernel_cmdline
+
+- name: IOMMU aktivieren (systemd-boot)
+  ansible.builtin.replace:
+    path: /etc/kernel/cmdline
+    regexp: '^((?!.*intel_iommu=on).*)$'
+    replace: '\1 {{ pve_iommu_cmdline }}'
+  when: kernel_cmdline.stat.exists
+  notify: refresh boot
+
+- name: IOMMU aktivieren (GRUB)
+  ansible.builtin.lineinfile:
+    path: /etc/default/grub
+    regexp: '^GRUB_CMDLINE_LINUX_DEFAULT="((?!.*intel_iommu=on).*)"$'
+    line: 'GRUB_CMDLINE_LINUX_DEFAULT="\1 {{ pve_iommu_cmdline }}"'
+    backrefs: true
+  when: not kernel_cmdline.stat.exists
+  notify: refresh boot
+
+- name: VFIO-Module laden
+  ansible.builtin.copy:
+    dest: /etc/modules-load.d/vfio.conf
+    content: "{{ pve_vfio_modules | join('\n') }}\n"
+    mode: "0644"
+
+- name: NVIDIA-Treiber auf dem Host sperren (GPU gehört der VM)
+  ansible.builtin.copy:
+    dest: /etc/modprobe.d/blacklist-nvidia.conf
+    content: |
+      blacklist nouveau
+      blacklist nvidia
+      blacklist nvidiafb
+    mode: "0644"
+  notify: refresh boot
+
+- name: ZFS-Pool tank vorhanden?
+  ansible.builtin.command: zpool list -H -o name tank
+  register: tank
+  changed_when: false
+  failed_when: false
+
+- name: Hinweis, falls tank fehlt (Pool wird bewusst NICHT automatisch angelegt – Datenverlustgefahr)
+  ansible.builtin.debug:
+    msg: "Auf {{ inventory_hostname }} fehlt der ZFS-Pool 'tank'. Anlegen z. B.: zpool create -o ashift=12 tank mirror /dev/disk/by-id/<ssd2> /dev/disk/by-id/<ssd3> && pvesm add zfspool tank -pool tank"
+  when: tank.rc != 0
+
+- name: Bestehende Replikationsjobs lesen
+  ansible.builtin.command: pvesr list
+  register: pvesr_jobs
+  changed_when: false
+
+- name: ZFS-Replikation für Infra-Gäste
+  ansible.builtin.command: >
+    pvesr create-local-job {{ item.value.vmid }}-0 {{ item.value.replicate_to }}
+    --schedule '{{ knaster_pve.replication_schedule }}' --comment 'knaster {{ item.key }}'
+  loop: "{{ knaster_pve.containers | dict2items }}"
+  when:
+    - item.value.node == inventory_hostname
+    - item.value.replicate_to is defined
+    - (item.value.vmid | string) + '-0' not in pvesr_jobs.stdout
+  changed_when: true