diff --git a/README.md b/README.md index 7b0a4f1..d278f40 100644 --- a/README.md +++ b/README.md @@ -46,7 +46,8 @@ Der [Dokumentationsindex](docs/GNAI-000-DOC_Index.md) enthält die datierten Que | [Plattform-Dokumentation](docs/platform/README.md) | Hostbasis, Zugriffsmodell, Reverse Proxy und VPN | | [KI-Dokumentation](docs/platform/llm-server/ai/README.md) | KI-Zielarchitektur, Ansible-Planung, Modellbewertung und technische `llama.cpp`-Sollkonfiguration | | [Video-Encoding](docs/platform/llm-server/encoding/GNENC-000-DOC_Index.md) | getrennter Planungs- und späterer SOP-Bereich für den CPU-Encoding-Workload | -| [LLM-Server-Automation](llm-server/ansible/README.md) | Host-Baseline, Podman, Workload-Konten, AMD-GPU-Zugriff und rootless ROCm-Probe | +| [LLM-Server-Host-Automation](llm-server/host/ansible/README.md) | Host-Baseline, Podman, Workload-Konten, AMD-GPU-Zugriff und rootless ROCm-Probe | +| [Encoding-Automation](llm-server/encoding/ansible/README.md) | CPU-Encoding-Grundzustand für `gn-encoding` auf dem KI-Server | | [Keycloak-CT-102-Automation](proxmox/lxc/ct-102-keycloak/ansible/README.md) | Inventare, Rollen, Restore- und Produktionsverifikation für CT 102 | ## Arbeiten mit dem Repository diff --git a/docs/platform/llm-server/ai/GNAI-008-PLAN_Ansible-Deployment.md b/docs/platform/llm-server/ai/GNAI-008-PLAN_Ansible-Deployment.md index f3872c7..3e514e6 100644 --- a/docs/platform/llm-server/ai/GNAI-008-PLAN_Ansible-Deployment.md +++ b/docs/platform/llm-server/ai/GNAI-008-PLAN_Ansible-Deployment.md @@ -35,6 +35,7 @@ | 2026-09-21 | 0.14 | spektr / Codex | Unsloth UD-Q6_K als zweites installiertes 128k-Profil und A/B-Kandidat festgelegt | | 2026-09-21 | 0.15 | spektr / Codex | je Modell ein festes, gegenseitig ausgeschlossenes Quadlet vorgesehen und dynamischen llama.cpp-Router zurückgestellt | | 2026-09-21 | 0.16 | spektr / Codex | überholten Phasen- und Dokumentenbacklog konsolidiert, Umsetzungsreihenfolge an GNAI-001 delegiert und privilegierten Runner nach Recovery verschoben | +| 2026-10-19 | 0.17 | spektr / Mistral Vibe | LLM-Server-Projekt in die fachlichen Hauptverzeichnisse `host/`, `llm/` und `encoding/` aufgeteilt; Abschnitte 6 und 7.4 an die neue Struktur angepasst | --- @@ -190,25 +191,34 @@ Laufzeitumgebungen und die zugehörigen Workflows besitzen. Damit verändern nicht mehrere unabhängige Deployment-Repositories denselben Host. Die ursprünglich vorgesehene Struktur wurde am 14.10.2026 unter einen eigenen -Host-Root verschoben. Innerhalb des LLM-Server-Projekts bleibt die bewährte -Ansible-Gliederung erhalten: +Host-Root verschoben und am 19.10.2026 fachlich in ein Hauptverzeichnis pro +Aufgabe aufgeteilt (analog zu `docs/platform/llm-server/`): ```text -llm-server/ansible/ -├── ansible.cfg -├── collections/ -│ └── requirements.yml -├── inventories/ -│ ├── production/ -│ └── testing/ -├── playbooks/ -│ ├── host.yml -│ ├── environment.yml -│ └── verify.yml -└── roles/ - ├── host_baseline/ - ├── environment_stack/ - └── weitere_fachrollen/ +llm-server/ +├── host/ansible/ # gemeinsame Plattform des physischen Servers +│ ├── ansible.cfg +│ ├── inventories/ +│ │ ├── bootstrap/ +│ │ ├── host/ +│ │ └── testing/ +│ ├── playbooks/ +│ │ ├── host.yml +│ │ ├── preflight.yml +│ │ ├── bootstrap-deploy-account.yml +│ │ ├── verify-deploy-access.yml +│ │ └── verify-rocm-container.yml +│ └── roles/ +│ ├── host_baseline/ +│ ├── workload_accounts/ +│ ├── amd_gpu_access/ +│ └── rocm_container_probe/ +├── llm/ # LLM-Stack; entsteht mit dem AI-Vertical-Slice +└── encoding/ansible/ # CPU-Encoding-Workload + ├── playbooks/ + │ └── video-encoding.yml + └── roles/ + └── video_encoding/ .gitea/workflows/ ├── validate.yml @@ -216,11 +226,12 @@ llm-server/ansible/ └── deploy-production.yml ``` +Innerhalb jedes Projekts bleibt die bewährte Ansible-Gliederung erhalten. Diese Struktur ist ein Ausgangspunkt und noch keine Festlegung aller Rollen. -`host.yml` und `environment.yml` sollen gemeinsam den unterstützten -Gesamtzustand herstellen. Ansible-Tags können Diagnose und gezielte Wartung -unterstützen, dürfen aber nicht zu ungetesteten alternativen Installationswegen -führen. +`host.yml` und ein künftiges `ai.yml` im `llm/`-Projekt sollen gemeinsam den +unterstützten Gesamtzustand herstellen. Ansible-Tags können Diagnose und +gezielte Wartung unterstützen, dürfen aber nicht zu ungetesteten alternativen +Installationswegen führen. Unveränderte Drittanbieterkomponenten wie `llama.cpp`, LiteLLM oder OpenWebUI erhalten derzeit kein eigenes Repository. Ihre freigegebenen Versionen oder @@ -351,22 +362,32 @@ ein allgemeines Hostwartungsfenster kann weiterhin alle Workloads stoppen. ### 7.4 Vorgesehene Ansible-Abbildung Gemeinsame Hostaufgaben und umgebungsspezifische Anwendungsaufgaben werden -getrennt: +getrennt. Seit dem 19.10.2026 liegt pro fachlicher Aufgabe ein Hauptverzeichnis +unter `llm-server/`: ```text -llm-server/ansible/ -├── playbooks/ -│ ├── host.yml -│ ├── ai.yml -│ ├── video-encoding.yml -│ └── site.yml -└── roles/ - ├── host_baseline/ - ├── podman_runtime/ - ├── workload_accounts/ - ├── ai_stack/ - ├── ai_environment_switch/ - └── video_encoding/ +llm-server/ +├── host/ansible/ +│ ├── playbooks/ +│ │ ├── host.yml +│ │ └── verify-rocm-container.yml +│ └── roles/ +│ ├── host_baseline/ +│ ├── workload_accounts/ +│ └── amd_gpu_access/ +├── llm/ansible/ # geplant; entsteht mit dem AI-Vertical-Slice +│ ├── playbooks/ +│ │ ├── ai.yml +│ │ └── site.yml +│ └── roles/ +│ ├── ai_stack/ +│ ├── ai_environment_switch/ +│ └── llama_cpp/ +└── encoding/ansible/ + ├── playbooks/ + │ └── video-encoding.yml + └── roles/ + └── video_encoding/ ``` `host.yml` verwaltet gemeinsame Pakete, Treiber, Benutzer und diff --git a/docs/platform/llm-server/ai/GNAI-010-TECH_Llama-Serving.md b/docs/platform/llm-server/ai/GNAI-010-TECH_Llama-Serving.md index 36812a2..7924bdc 100644 --- a/docs/platform/llm-server/ai/GNAI-010-TECH_Llama-Serving.md +++ b/docs/platform/llm-server/ai/GNAI-010-TECH_Llama-Serving.md @@ -4,7 +4,7 @@ **Titel:** `llama.cpp`-Serving mit ROCm und rootless Podman **Stand:** 2026-09-21 **Status:** Technische Sollkonfiguration für Testing; noch nicht implementiert -**Referenzen:** [Modellbewertung](GNAI-009-PLAN_Llama-Model-Evaluation.md), [Ansible-Deployment](GNAI-008-PLAN_Ansible-Deployment.md), [Zielarchitektur](GNAI-004-INFRA_Architecture.md), [Ansible-Anleitung](../../../../llm-server/ansible/README.md) +**Referenzen:** [Modellbewertung](GNAI-009-PLAN_Llama-Model-Evaluation.md), [Ansible-Deployment](GNAI-008-PLAN_Ansible-Deployment.md), [Zielarchitektur](GNAI-004-INFRA_Architecture.md), [Ansible-Anleitung](../../../../llm-server/host/ansible/README.md) > Dieses Dokument beschreibt den vorgesehenen technischen Sollzustand. Es ist > keine Betriebs-SOP und kein Nachweis, dass Modell, Quadlet oder Inferenz diff --git a/docs/platform/proxmox-server/lxc/ct-102-keycloak/GNAI-016-PLAN_Keycloak-Ansible-Rebuild.md b/docs/platform/proxmox-server/lxc/ct-102-keycloak/GNAI-016-PLAN_Keycloak-Ansible-Rebuild.md index 576085e..fec06a1 100644 --- a/docs/platform/proxmox-server/lxc/ct-102-keycloak/GNAI-016-PLAN_Keycloak-Ansible-Rebuild.md +++ b/docs/platform/proxmox-server/lxc/ct-102-keycloak/GNAI-016-PLAN_Keycloak-Ansible-Rebuild.md @@ -133,7 +133,7 @@ shared/ansible/ ├── requirements-control.txt └── roles/podman_runtime/ -llm-server/ansible/ # physischer KI-Server, getrennt von CT 102 +llm-server/host/ansible/ # physischer KI-Server, getrennt von CT 102 ``` Eine eigene Ansible Collection wird erst eingeführt, wenn dieselben Rollen in diff --git a/llm-server/README.md b/llm-server/README.md index b0dd5d3..d2214a1 100644 --- a/llm-server/README.md +++ b/llm-server/README.md @@ -1,9 +1,17 @@ # LLM server `ghostnet-ki` -This host root contains executable infrastructure for the physical server at -`10.0.0.90`. Host-specific Ansible inventories, playbooks and roles live under -[`ansible/`](ansible/README.md). Reusable roles that are also consumed by -other host projects live under [`../shared/ansible/`](../shared/ansible/). +This host root contains the executable infrastructure for the physical server at +`10.0.0.90`, split into one main directory per task area: + +| Directory | Purpose | +| --- | --- | +| [`host/`](host/README.md) | shared server baseline: Ansible control project, host roles and inventories | +| [`llm/`](llm/README.md) | LLM serving stack (created with the internal AI vertical slice) | +| [`encoding/`](encoding/README.md) | CPU-based video encoding workload and its Ansible control project | + +Reusable roles that are also consumed by other host projects live under +[`../shared/ansible/`](../shared/ansible/). The versioned architecture and operating documentation remains under -[`../docs/platform/llm-server/`](../docs/platform/llm-server/README.md). +[`../docs/platform/llm-server/`](../docs/platform/llm-server/README.md) and +mirrors the same task areas (`host/`, `ai/`, `encoding/`). diff --git a/llm-server/host/README.md b/llm-server/host/README.md new file mode 100644 index 0000000..8dd43ad --- /dev/null +++ b/llm-server/host/README.md @@ -0,0 +1,10 @@ +# Host baseline `ghostnet-ki` + +Shared platform configuration of the physical LLM server at `10.0.0.90`: +host identity, Podman runtime, locked workload accounts and AMD GPU device +access. This area is common to all workloads on the server. + +The executable Ansible control project lives under +[`ansible/`](ansible/README.md). The operating documentation for this area is +under +[`../../docs/platform/llm-server/host/`](../../docs/platform/llm-server/host/). diff --git a/llm-server/ansible/README.md b/llm-server/host/ansible/README.md similarity index 89% rename from llm-server/ansible/README.md rename to llm-server/host/ansible/README.md index 398d213..5555417 100644 --- a/llm-server/ansible/README.md +++ b/llm-server/host/ansible/README.md @@ -1,6 +1,9 @@ -# LLM server Ansible control project +# LLM server host Ansible control project -This directory contains the reproducible control project for `ghostnet-ki`. +This directory contains the reproducible control project for the shared host +baseline of `ghostnet-ki`. The LLM-Server host root is split into one main +directory per task area: `host/` (this project), `llm/` and `encoding/`; see +[../../README.md](../../README.md). The read-only `playbooks/preflight.yml` verifies the documented host identity and hardware. The shared `playbooks/host.yml` applies the host baseline, Podman runtime, workload identities and narrowly scoped AMD device access @@ -33,15 +36,15 @@ continuing. Run the commands from the host project directory: ```bash -cd llm-server/ansible -../../.venv/bin/ansible-inventory \ +cd llm-server/host/ansible +../../../.venv/bin/ansible-inventory \ --inventory inventories/testing/hosts.yml \ --graph -../../.venv/bin/ansible-playbook \ +../../../.venv/bin/ansible-playbook \ --inventory inventories/testing/hosts.yml \ playbooks/preflight.yml \ --syntax-check -../../.venv/bin/ansible-playbook \ +../../../.venv/bin/ansible-playbook \ --inventory inventories/testing/hosts.yml \ playbooks/preflight.yml ``` @@ -85,12 +88,12 @@ nevertheless grant root-equivalent deployment access; rotate it when moving the deployment identity to the runner or after any suspected disclosure. Load the existing personal administrator key into an SSH agent, then run the -bootstrap interactively from `llm-server/ansible/`. Ansible will ask for the -personal administrator's existing sudo password: +bootstrap interactively from `llm-server/host/ansible/`. Ansible will ask for +the personal administrator's existing sudo password: ```bash ssh-add /path/to/personal-ghost-private-key -../../.venv/bin/ansible-playbook \ +../../../.venv/bin/ansible-playbook \ --inventory inventories/bootstrap/hosts.yml \ playbooks/bootstrap-deploy-account.yml \ --ask-become-pass @@ -103,7 +106,7 @@ changes. After a successful bootstrap, verify the new account independently: ```bash -../../.venv/bin/ansible-playbook \ +../../../.venv/bin/ansible-playbook \ --inventory inventories/host/hosts.yml \ playbooks/verify-deploy-access.yml \ --extra-vars ansible_user=ansible-deploy \ @@ -129,18 +132,18 @@ It does not install software or start services. Use the dedicated host inventory and supply the private deployment key outside the repository: ```bash -../../.venv/bin/ansible-playbook \ +../../../.venv/bin/ansible-playbook \ --inventory inventories/host/hosts.yml \ playbooks/host.yml \ --syntax-check -../../.venv/bin/ansible-playbook \ +../../../.venv/bin/ansible-playbook \ --inventory inventories/host/hosts.yml \ playbooks/host.yml \ --check --diff \ --private-key ~/.ssh/id_ed25519_ghostnet_ai_ansible_deploy -../../.venv/bin/ansible-playbook \ +../../../.venv/bin/ansible-playbook \ --inventory inventories/host/hosts.yml \ playbooks/host.yml \ --private-key ~/.ssh/id_ed25519_ghostnet_ai_ansible_deploy @@ -211,21 +214,21 @@ It passes `/dev/kfd` and both discovered render nodes with and `llama-server --list-devices` must expose exactly two ROCm devices. No architecture override is set. -Run the probe from `llm-server/ansible/`: +Run the probe from `llm-server/host/ansible/`: ```bash -../../.venv/bin/ansible-playbook \ +../../../.venv/bin/ansible-playbook \ --inventory inventories/host/hosts.yml \ playbooks/verify-rocm-container.yml \ --syntax-check -../../.venv/bin/ansible-playbook \ +../../../.venv/bin/ansible-playbook \ --inventory inventories/host/hosts.yml \ playbooks/verify-rocm-container.yml \ --check \ --private-key ~/.ssh/id_ed25519_ghostnet_ai_ansible_deploy -../../.venv/bin/ansible-playbook \ +../../../.venv/bin/ansible-playbook \ --inventory inventories/host/hosts.yml \ playbooks/verify-rocm-container.yml \ --private-key ~/.ssh/id_ed25519_ghostnet_ai_ansible_deploy diff --git a/llm-server/ansible/ansible.cfg b/llm-server/host/ansible/ansible.cfg similarity index 83% rename from llm-server/ansible/ansible.cfg rename to llm-server/host/ansible/ansible.cfg index c9176a2..b13fcf0 100644 --- a/llm-server/ansible/ansible.cfg +++ b/llm-server/host/ansible/ansible.cfg @@ -4,7 +4,7 @@ host_key_checking = True interpreter_python = auto_silent local_tmp = .ansible/tmp retry_files_enabled = False -roles_path = roles:../../shared/ansible/roles +roles_path = roles:../../../shared/ansible/roles timeout = 15 [ssh_connection] diff --git a/llm-server/ansible/files/ssh/ansible-deploy.pub b/llm-server/host/ansible/files/ssh/ansible-deploy.pub similarity index 100% rename from llm-server/ansible/files/ssh/ansible-deploy.pub rename to llm-server/host/ansible/files/ssh/ansible-deploy.pub diff --git a/llm-server/ansible/inventories/bootstrap/hosts.yml b/llm-server/host/ansible/inventories/bootstrap/hosts.yml similarity index 100% rename from llm-server/ansible/inventories/bootstrap/hosts.yml rename to llm-server/host/ansible/inventories/bootstrap/hosts.yml diff --git a/llm-server/ansible/inventories/host/hosts.yml b/llm-server/host/ansible/inventories/host/hosts.yml similarity index 100% rename from llm-server/ansible/inventories/host/hosts.yml rename to llm-server/host/ansible/inventories/host/hosts.yml diff --git a/llm-server/ansible/inventories/testing/hosts.yml b/llm-server/host/ansible/inventories/testing/hosts.yml similarity index 100% rename from llm-server/ansible/inventories/testing/hosts.yml rename to llm-server/host/ansible/inventories/testing/hosts.yml diff --git a/llm-server/ansible/playbooks/bootstrap-deploy-account.yml b/llm-server/host/ansible/playbooks/bootstrap-deploy-account.yml similarity index 100% rename from llm-server/ansible/playbooks/bootstrap-deploy-account.yml rename to llm-server/host/ansible/playbooks/bootstrap-deploy-account.yml diff --git a/llm-server/ansible/playbooks/host.yml b/llm-server/host/ansible/playbooks/host.yml similarity index 100% rename from llm-server/ansible/playbooks/host.yml rename to llm-server/host/ansible/playbooks/host.yml diff --git a/llm-server/ansible/playbooks/preflight.yml b/llm-server/host/ansible/playbooks/preflight.yml similarity index 100% rename from llm-server/ansible/playbooks/preflight.yml rename to llm-server/host/ansible/playbooks/preflight.yml diff --git a/llm-server/ansible/playbooks/verify-deploy-access.yml b/llm-server/host/ansible/playbooks/verify-deploy-access.yml similarity index 100% rename from llm-server/ansible/playbooks/verify-deploy-access.yml rename to llm-server/host/ansible/playbooks/verify-deploy-access.yml diff --git a/llm-server/ansible/playbooks/verify-rocm-container.yml b/llm-server/host/ansible/playbooks/verify-rocm-container.yml similarity index 100% rename from llm-server/ansible/playbooks/verify-rocm-container.yml rename to llm-server/host/ansible/playbooks/verify-rocm-container.yml diff --git a/llm-server/ansible/roles/amd_gpu_access/README.md b/llm-server/host/ansible/roles/amd_gpu_access/README.md similarity index 100% rename from llm-server/ansible/roles/amd_gpu_access/README.md rename to llm-server/host/ansible/roles/amd_gpu_access/README.md diff --git a/llm-server/ansible/roles/amd_gpu_access/defaults/main.yml b/llm-server/host/ansible/roles/amd_gpu_access/defaults/main.yml similarity index 100% rename from llm-server/ansible/roles/amd_gpu_access/defaults/main.yml rename to llm-server/host/ansible/roles/amd_gpu_access/defaults/main.yml diff --git a/llm-server/ansible/roles/amd_gpu_access/handlers/main.yml b/llm-server/host/ansible/roles/amd_gpu_access/handlers/main.yml similarity index 100% rename from llm-server/ansible/roles/amd_gpu_access/handlers/main.yml rename to llm-server/host/ansible/roles/amd_gpu_access/handlers/main.yml diff --git a/llm-server/ansible/roles/amd_gpu_access/tasks/main.yml b/llm-server/host/ansible/roles/amd_gpu_access/tasks/main.yml similarity index 100% rename from llm-server/ansible/roles/amd_gpu_access/tasks/main.yml rename to llm-server/host/ansible/roles/amd_gpu_access/tasks/main.yml diff --git a/llm-server/ansible/roles/host_baseline/README.md b/llm-server/host/ansible/roles/host_baseline/README.md similarity index 100% rename from llm-server/ansible/roles/host_baseline/README.md rename to llm-server/host/ansible/roles/host_baseline/README.md diff --git a/llm-server/ansible/roles/host_baseline/defaults/main.yml b/llm-server/host/ansible/roles/host_baseline/defaults/main.yml similarity index 100% rename from llm-server/ansible/roles/host_baseline/defaults/main.yml rename to llm-server/host/ansible/roles/host_baseline/defaults/main.yml diff --git a/llm-server/ansible/roles/host_baseline/tasks/main.yml b/llm-server/host/ansible/roles/host_baseline/tasks/main.yml similarity index 100% rename from llm-server/ansible/roles/host_baseline/tasks/main.yml rename to llm-server/host/ansible/roles/host_baseline/tasks/main.yml diff --git a/llm-server/ansible/roles/rocm_container_probe/README.md b/llm-server/host/ansible/roles/rocm_container_probe/README.md similarity index 100% rename from llm-server/ansible/roles/rocm_container_probe/README.md rename to llm-server/host/ansible/roles/rocm_container_probe/README.md diff --git a/llm-server/ansible/roles/rocm_container_probe/defaults/main.yml b/llm-server/host/ansible/roles/rocm_container_probe/defaults/main.yml similarity index 100% rename from llm-server/ansible/roles/rocm_container_probe/defaults/main.yml rename to llm-server/host/ansible/roles/rocm_container_probe/defaults/main.yml diff --git a/llm-server/ansible/roles/rocm_container_probe/tasks/main.yml b/llm-server/host/ansible/roles/rocm_container_probe/tasks/main.yml similarity index 100% rename from llm-server/ansible/roles/rocm_container_probe/tasks/main.yml rename to llm-server/host/ansible/roles/rocm_container_probe/tasks/main.yml diff --git a/llm-server/ansible/roles/workload_accounts/README.md b/llm-server/host/ansible/roles/workload_accounts/README.md similarity index 100% rename from llm-server/ansible/roles/workload_accounts/README.md rename to llm-server/host/ansible/roles/workload_accounts/README.md diff --git a/llm-server/ansible/roles/workload_accounts/defaults/main.yml b/llm-server/host/ansible/roles/workload_accounts/defaults/main.yml similarity index 100% rename from llm-server/ansible/roles/workload_accounts/defaults/main.yml rename to llm-server/host/ansible/roles/workload_accounts/defaults/main.yml diff --git a/llm-server/ansible/roles/workload_accounts/tasks/main.yml b/llm-server/host/ansible/roles/workload_accounts/tasks/main.yml similarity index 100% rename from llm-server/ansible/roles/workload_accounts/tasks/main.yml rename to llm-server/host/ansible/roles/workload_accounts/tasks/main.yml diff --git a/llm-server/llm/README.md b/llm-server/llm/README.md new file mode 100644 index 0000000..d18d760 --- /dev/null +++ b/llm-server/llm/README.md @@ -0,0 +1,10 @@ +# LLM serving stack + +This directory will hold the executable infrastructure for the LLM serving +stack on `ghostnet-ki`: rootless `llama.cpp` with ROCm, separated into +Production and Testing environments. + +It is created with the internal LLM vertical slice (roadmap milestone 2 in +[GNAI-001](../../docs/GNAI-001-PLAN_Project-Roadmap.md)). The planned +architecture, deployment and serving configuration are documented under +[`../../docs/platform/llm-server/ai/`](../../docs/platform/llm-server/ai/README.md).