83 lines
3.1 KiB
Markdown
83 lines
3.1 KiB
Markdown
# Debian Host Bootstrap
|
|
|
|
This layer restores the Debian control-plane and personal desktop package set
|
|
before the OpenTofu/Kubernetes bootstrap runs.
|
|
|
|
Fresh Debian recovery path:
|
|
|
|
```bash
|
|
sudo apt-get update
|
|
sudo apt-get install -y git ansible sudo
|
|
sudo usermod -aG sudo jv
|
|
git clone <repo-url> /home/jv/my-homelab-configs
|
|
cd /home/jv/my-homelab-configs
|
|
ansible-playbook -K -i bootstrap/host/inventory.ini bootstrap/host/playbook.yml
|
|
./jeannie up
|
|
```
|
|
|
|
To also restore captured application behavior/configuration, keep the generated
|
|
`home-configs.tar.gz` outside Git and pass the generated vars file:
|
|
|
|
```bash
|
|
ansible-playbook -K -i bootstrap/host/inventory.ini bootstrap/host/playbook.yml \
|
|
-e @/path/to/debian-pc-ansible-inventory/ansible-vars.yml
|
|
```
|
|
|
|
The playbook:
|
|
|
|
- configures apt repositories for Docker, Kubernetes, Helm, OpenTofu, and Brave
|
|
- installs the captured Debian package set, filtering packages unavailable on
|
|
the current Debian release
|
|
- installs user-level pipx CLI tools such as `yt-dlp`, plus runtime helpers
|
|
such as `ffmpeg` and `nodejs`
|
|
- installs Lynis for report-only host audits through `./jeannie security-host`
|
|
- installs `age` and `sops` for encrypted repo-managed secrets
|
|
- installs and configures Ollama for homelab-local AI helpers when
|
|
`debian_pc_install_ollama` is true
|
|
- installs Zoom from the upstream `.deb` when requested on amd64
|
|
- adds `jv` to expected local groups
|
|
- enables core services such as Docker, containerd, kubelet, ssh, cron, and
|
|
Bluetooth when installed
|
|
- creates homelab persistence directories used by `jeannie up`
|
|
- optionally extracts the captured user config archive into `/home/jv`
|
|
|
|
Secrets and active sessions are intentionally not stored in this repo. Keep
|
|
SSH keys, kubeconfigs, SOPS keys, Docker auth, and browser session/password data
|
|
in a separate encrypted backup if you want them restored.
|
|
|
|
After the playbook finishes, initialize the Debian host's SOPS identity with:
|
|
|
|
```bash
|
|
./jeannie secrets-init
|
|
./jeannie secrets-check
|
|
```
|
|
|
|
Ollama is configured to listen on the LAN and keep models under
|
|
`/data/ollama/models`. The default lightweight model for `jeannie` diagnostics is
|
|
pulled during bootstrap. To apply only the Ollama setup on an existing Debian
|
|
host, run:
|
|
|
|
```bash
|
|
./jeannie ollama-setup
|
|
./jeannie ai-check
|
|
```
|
|
|
|
Installer downloads prefer IPv4 by default because some networks have broken or
|
|
slow IPv6 paths to `ollama.com`. Override with
|
|
`LAB_OLLAMA_INSTALL_CURL_IP_VERSION=` if you want curl's automatic behavior.
|
|
The Ryzen integrated GPU is left disabled for Ollama by default; set
|
|
`LAB_OLLAMA_IGPU_ENABLE=true` or `debian_pc_ollama_igpu_enable: "true"` when
|
|
you intentionally want to test Vulkan/iGPU inference.
|
|
|
|
If the Debian host cannot reach `ollama.com`, download the matching Linux
|
|
tarball from another machine, copy it to Debian, and point `jeannie` at it:
|
|
|
|
```bash
|
|
curl -L https://ollama.com/download/ollama-linux-amd64.tgz -o /tmp/ollama-linux-amd64.tgz
|
|
scp /tmp/ollama-linux-amd64.tgz jv@192.168.100.73:/tmp/
|
|
LAB_OLLAMA_TARBALL_FILE=/tmp/ollama-linux-amd64.tgz ./jeannie ollama-setup
|
|
```
|
|
|
|
The same fallback is available to the Ansible bootstrap with
|
|
`debian_pc_ollama_tarball_file`.
|