debops.libvirtd_qemu default variables

libvirt features

libvirtd_qemu__kvm_support

Enable or disable support for KVM-based virtual machines.

libvirtd_qemu__kvm_support: '{{ True
                                if (ansible_virtualization_type == "kvm" and
                                    (ansible_virtualization_role == "host" or
                                     libvirtd_qemu__register_hw_virt.stdout != ""))
                                else False }}'

APT packages

libvirtd_qemu__base_packages

List of libvirtd packages which will be installed on all distribution releases, unless overridden.

libvirtd_qemu__base_packages:
  - 'libvirt-daemon-system'
libvirtd_qemu__base_packages_map

Override list of base packages for specific distribution releases.

libvirtd_qemu__base_packages_map:
  'wheezy':  [ 'libvirt-bin' ]
  'precise': [ 'libvirt-bin' ]
  'trusty':  [ 'libvirt-bin' ]
  'xenial':  [ 'libvirt-bin' ]
libvirtd_qemu__kvm_packages

List of QEMU KVM packages to install. They will be installed on all hosts apart from KVM guests, to not create redundant support.

libvirtd_qemu__kvm_packages:
  - 'qemu-system-x86'
  - 'qemu-kvm'
  - 'qemu-utils'
libvirtd_qemu__packages

List of custom packages to install.

libvirtd_qemu__packages: []

QEMU environment

libvirtd_qemu__deployment_mode

Specify the type of the environment a given libvirtd operates in. Possible choices: libvirt, opennebula.

libvirtd_qemu__deployment_mode: '{{ ansible_local.libvirtd.deployment_mode
                                    if (ansible_local|d() and ansible_local.libvirtd|d() and
                                        ansible_local.libvirtd.deployment_mode|d())
                                    else ("opennebula"
                                          if ("debops_service_opennebula_node" in group_names)
                                          else "libvirt") }}'
libvirtd_qemu__user

The UNIX system user account which will be used to run QEMU processes. The Debian default is libvirt-qemu, however OpenNebula requires the use of the oneadmin management account to ensure correct file access.

libvirtd_qemu__user: '{{ (ansible_local.opennebula.user
                          if (ansible_local|d() and ansible_local.opennebula|d() and
                              ansible_local.opennebula.user|d())
                          else "oneadmin")
                         if (libvirtd_qemu__deployment_mode == "opennebula")
                         else "libvirt-qemu" }}'
libvirtd_qemu__group

The UNIX system group which will be used to run QEMU processes. The Debian default is libvirt-qemu, however OpenNebula requires the use of the oneadmin management group to ensure correct file access.

libvirtd_qemu__group: '{{ (ansible_local.opennebula.group
                           if (ansible_local|d() and ansible_local.opennebula|d() and
                               ansible_local.opennebula.group|d())
                           else "oneadmin")
                          if (libvirtd_qemu__deployment_mode == "opennebula")
                          else "libvirt-qemu" }}'

VNC/SPICE remote display options

libvirtd_qemu__remote_display_allow

List of IP addresses or CIDR subnets which will be allowed to connect to the VNC/SPICE service through the firewall. if nothing is specified, nobody can connect to these services.

libvirtd_qemu__remote_display_allow: []
libvirtd_qemu__remote_display_ports

List of TCP ports which should be opened in the firewall to allow access to the VNC/SPICE services. You can specify specifc ports or port ranges separated by the : character. Only the hosts specified by the libvirtd_qemu__remote_display_allow variable will have access through these ports.

libvirtd_qemu__remote_display_ports: '{{ libvirtd_qemu__remote_display_port_min|string + ":"
                                         + libvirtd_qemu__remote_display_port_max|string }}'
libvirtd_qemu__remote_display_port_min

The lower bound of the port range used by the VNC/SPICE services to allow access to the remote VM console. The lower bound port configuration shouldn't be changed, otherwise it might result in negative port numbers used by the services.

libvirtd_qemu__remote_display_port_min: 5900
libvirtd_qemu__remote_display_port_max

The upper bound of the port range used by the VNC/SPICE services to allow access to the remote VM console.

libvirtd_qemu__remote_display_port_max: 65535
libvirtd_qemu__spice_listen

Specify the IP address on which QEMU processes should listen for SPICE connections.

libvirtd_qemu__spice_listen: '{{ "0.0.0.0"
                                 if libvirtd_qemu__remote_display_allow|d()
                                 else "127.0.0.1" }}'
libvirtd_qemu__vnc_listen

Specify the IP address on which QEMU processes should listen for VNC connections.

libvirtd_qemu__vnc_listen: '{{ "0.0.0.0"
                               if libvirtd_qemu__remote_display_allow|d()
                               else "127.0.0.1" }}'

QEMU master configuration

These lists define configuration options present in the /etc/libvirt/qemu.conf configuration file. See libvirtd_qemu__configuration for more details.

libvirtd_qemu__original_configuration

List of original QEMU configuration options defined by the installed software package.

libvirtd_qemu__original_configuration:

  - name: 'default_tls_x509_cert_dir'  # [[[
    comment: |
      Use of TLS requires that x509 certificates be issued. The default is
      to keep them in /etc/pki/qemu. This directory must contain

      ca-cert.pem - the CA master certificate
      server-cert.pem - the server certificate signed with ca-cert.pem
      server-key.pem  - the server private key

      and optionally may contain

      dh-params.pem - the DH params configuration file
    value: '/etc/pki/qemu'
    section: 'tls'
    state: 'comment'
    weight: 1  # ]]]

  - name: 'default_tls_x509_verify'  # [[[
    comment: |
      The default TLS configuration only uses certificates for the server
      allowing the client to verify the server identity and establish
      an encrypted channel.

      It is possible to use x509 certificates for authentication too, by
      issuing a x509 certificate to every client who needs to connect.

      Enabling this option will reject any client who does not have a
      certificate signed by the CA in /etc/pki/qemu/ca-cert.pem
    value: True
    section: 'tls'
    state: 'comment'
    weight: 2  # ]]]

  - name: 'default_tls_x509_secret_uuid'  # [[[
    comment: |
      Libvirt assumes the server-key.pem file is unencrypted by default.
      To use an encrypted server-key.pem file, the password to decrypt
      the PEM file is required. This can be provided by creating a secret
      object in libvirt and then to uncomment this setting to set the UUID
      of the secret.

      NB This default all-zeros UUID will not work. Replace it with the
      output from the UUID for the TLS secret from a 'virsh secret-list'
      command and then uncomment the entry
    value: '00000000-0000-0000-0000-000000000000'
    section: 'tls'
    state: 'comment'
    weight: 3  # ]]]

  - name: 'vnc_listen'  # [[[
    comment: |
      VNC is configured to listen on 127.0.0.1 by default.
      To make it listen on all public interfaces, uncomment
      this next option.

      NB, strong recommendation to enable TLS + x509 certificate
      verification when allowing public access
    value: '0.0.0.0'
    section: 'vnc'
    state: 'comment'
    weight: 1  # ]]]

  - name: 'vnc_auto_unix_socket'  # [[[
    comment: |
      Enable this option to have VNC served over an automatically created
      unix socket. This prevents unprivileged access from users on the
      host machine, though most VNC clients do not support it.

      This will only be enabled for VNC configurations that have listen
      type=address but without any address specified. This setting takes
      preference over vnc_listen.
    value: True
    section: 'vnc'
    state: 'comment'
    weight: 2  # ]]]

  - name: 'vnc_tls'  # [[[
    comment: |
      Enable use of TLS encryption on the VNC server. This requires
      a VNC client which supports the VeNCrypt protocol extension.
      Examples include vinagre, virt-viewer, virt-manager and vencrypt
      itself. UltraVNC, RealVNC, TightVNC do not support this

      It is necessary to setup CA and issue a server certificate
      before enabling this.
    value: True
    section: 'vnc'
    state: 'comment'
    weight: 3  # ]]]

  - name: 'vnc_tls_x509_cert_dir'  # [[[
    comment: |
      In order to override the default TLS certificate location for
      vnc certificates, supply a valid path to the certificate directory.
      If the provided path does not exist then the default_tls_x509_cert_dir
      path will be used.
    value: '/etc/pki/libvirt-vnc'
    section: 'vnc'
    state: 'comment'
    weight: 4  # ]]]

  - name: 'vnc_tls_x509_verify'  # [[[
    comment: |
      The default TLS configuration only uses certificates for the server
      allowing the client to verify the server identity and establish
      an encrypted channel.

      It is possible to use x509 certificates for authentication too, by
      issuing a x509 certificate to every client who needs to connect.

      Enabling this option will reject any client who does not have a
      certificate signed by the CA in /etc/pki/libvirt-vnc/ca-cert.pem

      If this option is not supplied, it will be set to the value of
      "default_tls_x509_verify".
    value: True
    section: 'vnc'
    state: 'comment'
    weight: 5  # ]]]

  - name: 'vnc_password'  # [[[
    comment: |
      The default VNC password. Only 8 bytes are significant for
      VNC passwords. This parameter is only used if the per-domain
      XML config does not already provide a password. To allow
      access without passwords, leave this commented out. An empty
      string will still enable passwords, but be rejected by QEMU,
      effectively preventing any use of VNC. Obviously change this
      example here before you set this.
    value: 'XYZ12345'
    section: 'vnc'
    state: 'comment'
    weight: 6  # ]]]

  - name: 'vnc_sasl'  # [[[
    comment: |
      Enable use of SASL encryption on the VNC server. This requires
      a VNC client which supports the SASL protocol extension.
      Examples include vinagre, virt-viewer and virt-manager
      itself. UltraVNC, RealVNC, TightVNC do not support this

      It is necessary to configure /etc/sasl2/qemu.conf to choose
      the desired SASL plugin (eg, GSSPI for Kerberos)
    value: True
    section: 'vnc'
    state: 'comment'
    weight: 7  # ]]]

  - name: 'vnc_sasl_dir'  # [[[
    comment: |
      The default SASL configuration file is located in /etc/sasl2/
      When running libvirtd unprivileged, it may be desirable to
      override the configs in this location. Set this parameter to
      point to the directory, and create a qemu.conf in that location
    value: '/some/directory/sasl2'
    section: 'vnc'
    state: 'comment'
    weight: 8  # ]]]

  - name: 'vnc_allow_host_audio'  # [[[
    comment: |
      QEMU implements an extension for providing audio over a VNC connection,
      though if your VNC client does not support it, your only chance for getting
      sound output is through regular audio backends. By default, libvirt will
      disable all QEMU sound backends if using VNC, since they can cause
      permissions issues. Enabling this option will make libvirtd honor the
      QEMU_AUDIO_DRV environment variable when using VNC.
    value: False
    section: 'vnc'
    state: 'comment'
    weight: 9  # ]]]

  - name: 'spice_listen'  # [[[
    comment: |
      SPICE is configured to listen on 127.0.0.1 by default.
      To make it listen on all public interfaces, uncomment
      this next option.

      NB, strong recommendation to enable TLS + x509 certificate
      verification when allowing public access
    value: '0.0.0.0'
    section: 'spice'
    state: 'comment'
    weight: 1  # ]]]

  - name: 'spice_tls'  # [[[
    comment: |
      Enable use of TLS encryption on the SPICE server.

      It is necessary to setup CA and issue a server certificate
      before enabling this.
    value: True
    section: 'spice'
    state: 'comment'
    weight: 2  # ]]]

  - name: 'spice_tls_x509_cert_dir'  # [[[
    comment: |
      In order to override the default TLS certificate location for
      spice certificates, supply a valid path to the certificate directory.
      If the provided path does not exist then the default_tls_x509_cert_dir
      path will be used.
    value: '/etc/pki/libvirt-spice'
    section: 'spice'
    state: 'comment'
    weight: 3  # ]]]

  - name: 'spice_auto_unix_socket'  # [[[
    comment: |
      Enable this option to have SPICE served over an automatically created
      unix socket. This prevents unprivileged access from users on the
      host machine.

      This will only be enabled for SPICE configurations that have listen
      type=address but without any address specified. This setting takes
      preference over spice_listen.
    value: True
    section: 'spice'
    state: 'comment'
    weight: 4  # ]]]

  - name: 'spice_password'  # [[[
    comment: |
      The default SPICE password. This parameter is only used if the
      per-domain XML config does not already provide a password. To
      allow access without passwords, leave this commented out. An
      empty string will still enable passwords, but be rejected by
      QEMU, effectively preventing any use of SPICE. Obviously change
      this example here before you set this.
    value: 'XYZ12345'
    section: 'spice'
    state: 'comment'
    weight: 5  # ]]]

  - name: 'spice_sasl'  # [[[
    comment: |
      Enable use of SASL encryption on the SPICE server. This requires
      a SPICE client which supports the SASL protocol extension.

      It is necessary to configure /etc/sasl2/qemu.conf to choose
      the desired SASL plugin (eg, GSSPI for Kerberos)
    value: True
    section: 'spice'
    state: 'comment'
    weight: 6  # ]]]

  - name: 'spice_sasl_dir'  # [[[
    comment: |
      The default SASL configuration file is located in /etc/sasl2/
      When running libvirtd unprivileged, it may be desirable to
      override the configs in this location. Set this parameter to
      point to the directory, and create a qemu.conf in that location
    value: '/some/directory/sasl2'
    section: 'spice'
    state: 'comment'
    weight: 7  # ]]]

  - name: 'chardev_tls'  # [[[
    comment: |
      Enable use of TLS encryption on the chardev TCP transports.

      It is necessary to setup CA and issue a server certificate
      before enabling this.
    value: True
    section: 'chardev'
    state: 'comment'
    weight: 1  # ]]]

  - name: 'chardev_tls_x509_cert_dir'  # [[[
    comment: |
      In order to override the default TLS certificate location for character
      device TCP certificates, supply a valid path to the certificate directory.
      If the provided path does not exist then the default_tls_x509_cert_dir
      path will be used.
    value: '/etc/pki/libvirt-chardev'
    section: 'chardev'
    state: 'comment'
    weight: 2  # ]]]

  - name: 'chardev_tls_x509_verify'  # [[[
    comment: |
      The default TLS configuration only uses certificates for the server
      allowing the client to verify the server identity and establish
      an encrypted channel.

      It is possible to use x509 certificates for authentication too, by
      issuing a x509 certificate to every client who needs to connect.

      Enabling this option will reject any client who does not have a
      certificate signed by the CA in /etc/pki/libvirt-chardev/ca-cert.pem
    value: True
    section: 'chardev'
    state: 'comment'
    weight: 3  # ]]]

  - name: 'chardev_tls_x509_secret_uuid'  # [[[
    comment: |
      Uncomment and use the following option to override the default secret
      UUID provided in the default_tls_x509_secret_uuid parameter.

      NB This default all-zeros UUID will not work. Replace it with the
      output from the UUID for the TLS secret from a 'virsh secret-list'
      command and then uncomment the entry
    value: '00000000-0000-0000-0000-000000000000'
    section: 'chardev'
    state: 'comment'
    weight: 4  # ]]]

  - name: 'nographics_allow_host_audio'  # [[[
    comment: |
      By default, if no graphical front end is configured, libvirt will disable
      QEMU audio output since directly talking to alsa/pulseaudio may not work
      with various security settings. If you know what you are doing, enable
      the setting below and libvirt will passthrough the QEMU_AUDIO_DRV
      environment variable when using nographics.
    value: True
    section: 'display'
    state: 'comment'
    weight: 1  # ]]]

  - name: 'remote_display_port_min'  # [[[
    comment: |
      Override the port for creating both VNC and SPICE sessions (min).
      This defaults to 5900 and increases for consecutive sessions
      or when ports are occupied, until it hits the maximum.

      Minimum must be greater than or equal to 5900 as lower number would
      result into negative vnc display number.

      Maximum must be less than 65536, because higher numbers do not make
      sense as a port number.
    value: 5900
    section: 'display'
    state: 'comment'
    weight: 2  # ]]]

  - name: 'remote_display_port_max'  # [[[
    value: 65535
    section: 'display'
    state: 'comment'
    weight: 3  # ]]]

  - name: 'remote_websocket_port_min'  # [[[
    comment: |
      VNC WebSocket port policies, same rules apply as with remote display
      ports. VNC WebSockets use similar display <-> port mappings, with
      the exception being that ports start from 5700 instead of 5900.
    value: 5700
    section: 'display'
    state: 'comment'
    weight: 4  # ]]]

  - name: 'remote_websocket_port_max'  # [[[
    value: 65535
    section: 'display'
    state: 'comment'
    weight: 5  # ]]]

  - name: 'security_driver'  # [[[
    comment: |
      The default security driver is SELinux. If SELinux is disabled
      on the host, then the security driver will automatically disable
      itself. If you wish to disable QEMU SELinux security driver while
      leaving SELinux enabled for the host in general, then set this
      to 'none' instead. It is also possible to use more than one security
      driver at the same time, for this use a list of names separated by
      comma and delimited by square brackets. For example:

            security_driver = [ "selinux", "apparmor" ]

      Notes: The DAC security driver is always enabled; as a result, the
      value of security_driver cannot contain "dac".  The value "none" is
      a special value; security_driver can be set to that value in
      isolation, but it cannot appear in a list of drivers.
    value: 'selinux'
    section: 'security'
    state: 'comment'
    weight: 1  # ]]]

  - name: 'security_default_confined'  # [[[
    comment: |
      If set to non-zero, then the default security labeling
      will make guests confined. If set to zero, then guests
      will be unconfined by default. Defaults to 1.
    value: True
    section: 'security'
    state: 'comment'
    weight: 2  # ]]]

  - name: 'security_require_confined'  # [[[
    comment: |
      If set to non-zero, then attempts to create unconfined
      guests will be blocked. Defaults to 0.
    value: True
    section: 'security'
    state: 'comment'
    weight: 3  # ]]]

  - name: 'user'  # [[[
    comment: |
      The user for QEMU processes run by the system instance. It can be
      specified as a user name or as a user id. The qemu driver will try to
      parse this value first as a name and then, if the name does not exist,
      as a user id.

      Since a sequence of digits is a valid user name, a leading plus sign
      can be used to ensure that a user id will not be interpreted as a user
      name.

      Some examples of valid values are:

            user = "qemu"   # A user named "qemu"
            user = "+0"     # Super user (uid=0)
            user = "100"    # A user named "100" or a user with uid=100
    value: 'root'
    section: 'user-group'
    state: 'comment'
    weight: 1  # ]]]

  - name: 'group'  # [[[
    comment: |
      The group for QEMU processes run by the system instance. It can be
      specified in a similar way to user.
    value: 'root'
    section: 'user-group'
    state: 'comment'
    weight: 2  # ]]]

  - name: 'dynamic_ownership'  # [[[
    comment: |
      Whether libvirt should dynamically change file ownership
      to match the configured user/group above. Defaults to 1.
      Set to 0 to disable file ownership changes.
    value: True
    section: 'user-group'
    state: 'comment'
    weight: 3  # ]]]

  - name: 'cgroup_controllers'  # [[[
    comment: |
      What cgroup controllers to make use of with QEMU guests

      - 'cpu' - use for schedular tunables
      - 'devices' - use for device whitelisting
      - 'memory' - use for memory tunables
      - 'blkio' - use for block devices I/O tunables
      - 'cpuset' - use for CPUs and memory nodes
      - 'cpuacct' - use for CPUs statistics.

      NB, even if configured here, they will not be used unless
      the administrator has mounted cgroups, e. g.:

      mkdir /dev/cgroup
      mount -t cgroup -o devices,cpu,memory,blkio,cpuset none /dev/cgroup

      They can be mounted anywhere, and different controllers
      can be mounted in different locations. libvirt will detect
      where they are located.
    value: [ 'cpu', 'devices', 'memory', 'blkio', 'cpuset', 'cpuacct' ]
    section: 'cgroup'
    state: 'comment'
    weight: 1  # ]]]

  - name: 'cgroup_device_acl'  # [[[
    comment: |
      This is the basic set of devices allowed / required by
      all virtual machines.

      As well as this, any configured block backed disks,
      all sound device, and all PTY devices are allowed.

      This will only need setting if newer QEMU suddenly
      wants some device we do not already know about.

      RDMA migration requires the following extra files to be added to the list:
        "/dev/infiniband/rdma_cm",
        "/dev/infiniband/issm0",
        "/dev/infiniband/issm1",
        "/dev/infiniband/umad0",
        "/dev/infiniband/umad1",
        "/dev/infiniband/uverbs0"
    value: [ '/dev/null', '/dev/full', '/dev/zero',
             '/dev/random', '/dev/urandom',
             '/dev/ptmx', '/dev/kvm', '/dev/kqemu',
             '/dev/rtc', '/dev/hpet', '/dev/vfio/vfio' ]
    section: 'cgroup'
    state: 'comment'
    weight: 2  # ]]]

  - name: 'save-image_format'  # [[[
    comment: |
      The default format for Qemu/KVM guest save images is raw; that is, the
      memory from the domain is dumped out directly to a file.  If you have
      guests with a large amount of memory, however, this can take up quite
      a bit of space.  If you would like to compress the images while they
      are being saved to disk, you can also set "lzop", "gzip", "bzip2", or "xz"
      for save_image_format.  Note that this means you slow down the process of
      saving a domain in order to save disk space; the list above is in descending
      order by performance and ascending order by compression ratio.

      save_image_format is used when you use 'virsh save' or 'virsh managedsave'
      at scheduled saving, and it is an error if the specified save_image_format
      is not valid, or the requested compression program cannot be found.

      dump_image_format is used when you use 'virsh dump' at emergency
      crashdump, and if the specified dump_image_format is not valid, or
      the requested compression program cannot be found, this falls
      back to "raw" compression.

      snapshot_image_format specifies the compression algorithm of the memory save
      image when an external snapshot of a domain is taken. This does not apply
      on disk image format. It is an error if the specified format is not valid,
      or the requested compression program cannot be found.
    value: 'raw'
    section: 'dump'
    state: 'comment'
    weight: 1  # ]]]

  - name: 'dump_image_format'  # [[[
    value: 'raw'
    section: 'dump'
    state: 'comment'
    weight: 2  # ]]]

  - name: 'snapshot_image_format'  # [[[
    value: 'raw'
    section: 'dump'
    state: 'comment'
    weight: 3  # ]]]

  - name: 'auto_dump_path'  # [[[
    comment: |
      When a domain is configured to be auto-dumped when libvirtd receives a
      watchdog event from qemu guest, libvirtd will save dump files in directory
      specified by auto_dump_path. Default value is /var/lib/libvirt/qemu/dump
    value: '/var/lib/libvirt/qemu/dump'
    section: 'dump'
    state: 'comment'
    weight: 4  # ]]]

  - name: 'auto_dump_bypass_cache'  # [[[
    comment: |
      When a domain is configured to be auto-dumped, enabling this flag
      has the same effect as using the VIR_DUMP_BYPASS_CACHE flag with the
      virDomainCoreDump API.  That is, the system will avoid using the
      file system cache while writing the dump file, but may cause
      slower operation.
    value: False
    section: 'dump'
    state: 'comment'
    weight: 5  # ]]]

  - name: 'auto_start_bypass_cache'  # [[[
    comment: |
      When a domain is configured to be auto-started, enabling this flag
      has the same effect as using the VIR_DOMAIN_START_BYPASS_CACHE flag
      with the virDomainCreateWithFlags API.  That is, the system will
      avoid using the file system cache when restoring any managed state
      file, but may cause slower operation.
    value: False
    section: 'dump'
    state: 'comment'
    weight: 6  # ]]]

  - name: 'hugetlbfs_mount'  # [[[
    comment: |
      If provided by the host and a hugetlbfs mount point is configured,
      a guest may request huge page backing. When this mount point is
      unspecified here, determination of a host mount point in /proc/mounts
      will be attempted. Specifying an explicit mount overrides detection
      of the same in /proc/mounts. Setting the mount point to "" will
      disable guest hugepage backing. If desired, multiple mount points can
      be specified at once, separated by comma and enclosed in square
      brackets, for example:

          hugetlbfs_mount = ["/dev/hugepages2M", "/dev/hugepages1G"]

      The size of huge page served by specific mount point is determined by
      libvirt at the daemon startup.

      NB, within these mount points, guests will create memory backing
      files in a location of $MOUNTPOINT/libvirt/qemu
    value: '/dev/hugepages'
    section: 'proc'
    state: 'comment'
    weight: 1  # ]]]

  - name: 'bridge_helper'  # [[[
    comment: |
      Path to the setuid helper for creating tap devices.  This executable
      is used to create <source type='bridge'> interfaces when libvirtd is
      running unprivileged.  libvirt invokes the helper directly, instead
      of using "-netdev bridge", for security reasons.
    value: '/usr/libexec/qemu-bridge-helper'
    section: 'proc'
    state: 'comment'
    weight: 2  # ]]]

  - name: 'clear_emulator_capabilities'  # [[[
    comment: |
      If clear_emulator_capabilities is enabled, libvirt will drop all
      privileged capabilities of the QEmu/KVM emulator. This is enabled by
      default.

      Warning: Disabling this option means that a compromised guest can
      exploit the privileges and possibly do damage to the host.
    value: True
    section: 'proc'
    state: 'comment'
    weight: 3  # ]]]

  - name: 'set_process_name'  # [[[
    comment: |
      If enabled, libvirt will have QEMU set its process name to
      "qemu:VM_NAME", where VM_NAME is the name of the VM. The QEMU
      process will appear as "qemu:VM_NAME" in process listings and
      other system monitoring tools. By default, QEMU does not set
      its process title, so the complete QEMU command (emulator and
      its arguments) appear in process listings.
    value: True
    section: 'proc'
    state: 'comment'
    weight: 4  # ]]]

  - name: 'max_processes'  # [[[
    comment: |
      If max_processes is set to a positive integer, libvirt will use
      it to set the maximum number of processes that can be run by qemu
      user. This can be used to override default value set by host OS.
      The same applies to max_files which sets the limit on the maximum
      number of opened files.
    value: 0
    section: 'proc'
    state: 'comment'
    weight: 5  # ]]]

  - name: 'max_files'  # [[[
    value: 0
    section: 'proc'
    state: 'comment'
    weight: 6  # ]]]

  - name: 'max_core'  # [[[
    comment: |
      If max_core is set to a non-zero integer, then QEMU will be
      permitted to create core dumps when it crashes, provided its
      RAM size is smaller than the limit set.

      Be warned that the core dump will include a full copy of the
      guest RAM, if the 'dump_guest_core' setting has been enabled,
      or if the guest XML contains

        <memory dumpcore="on">...guest ram...</memory>

      If guest RAM is to be included, ensure the max_core limit
      is set to at least the size of the largest expected guest
      plus another 1GB for any QEMU host side memory mappings.

      As a special case it can be set to the string "unlimited" to
      to allow arbitrarily sized core dumps.

      By default the core dump size is set to 0 disabling all dumps

      Size is a positive integer specifying bytes or the
      string "unlimited"
    value: 'unlimited'
    section: 'proc'
    state: 'comment'
    weight: 7  # ]]]

  - name: 'dump_guest_core'  # [[[
    comment: |
      Determine if guest RAM is included in QEMU core dumps. By
      default guest RAM will be excluded if a new enough QEMU is
      present. Setting this to '1' will force guest RAM to always
      be included in QEMU core dumps.

      This setting will be ignored if the guest XML has set the
      dumpcore attribute on the <memory> element.
    value: True
    section: 'proc'
    state: 'comment'
    weight: 8  # ]]]

  - name: 'mac_filter'  # [[[
    comment: |
      mac_filter enables MAC addressed based filtering on bridge ports.
      This currently requires ebtables to be installed.
    value: True
    section: 'proc'
    state: 'comment'
    weight: 9  # ]]]

  - name: 'relaxed_acs_check'  # [[[
    comment: |
      By default, PCI devices below non-ACS switch are not allowed to be assigned
      to guests. By setting relaxed_acs_check to 1 such devices will be allowed to
      be assigned to guests.
    value: True
    section: 'proc'
    state: 'comment'
    weight: 10  # ]]]

  - name: 'allow_disk_format_probing'  # [[[
    comment: |
      If allow_disk_format_probing is enabled, libvirt will probe disk
      images to attempt to identify their format, when not otherwise
      specified in the XML. This is disabled by default.

      WARNING: Enabling probing is a security hole in almost all
      deployments. It is strongly recommended that users update their
      guest XML <disk> elements to include  <driver type='XXXX'/>
      elements instead of enabling this option.
    value: True
    section: 'proc'
    state: 'comment'
    weight: 11  # ]]]

  - name: 'lock_manager'  # [[[
    comment: |
      In order to prevent accidentally starting two domains that
      share one writable disk, libvirt offers two approaches for
      locking files. The first one is sanlock, the other one,
      virtlockd, is then our own implementation. Accepted values
      are "sanlock" and "lockd".
    value: 'lockd'
    section: 'proc'
    state: 'comment'
    weight: 12  # ]]]

  - name: 'max_queued'  # [[[
    comment: |
      Set limit of maximum APIs queued on one domain. All other APIs
      over this threshold will fail on acquiring job lock. Specially,
      setting to zero turns this feature off.
      Note, that job lock is per domain.
    value: 0
    section: 'proc'
    state: 'comment'
    weight: 13  # ]]]

  - name: 'keepalive_interval'  # [[[
    comment: |
      This allows qemu driver to detect broken connections to remote
      libvirtd during peer-to-peer migration.  A keepalive message is
      sent to the daemon after keepalive_interval seconds of inactivity
      to check if the daemon is still responding; keepalive_count is a
      maximum number of keepalive messages that are allowed to be sent
      to the daemon without getting any response before the connection
      is considered broken.  In other words, the connection is
      automatically closed approximately after
      keepalive_interval * (keepalive_count + 1) seconds since the last
      message received from the daemon.  If keepalive_interval is set to
      -1, qemu driver will not send keepalive requests during
      peer-to-peer migration; however, the remote libvirtd can still
      send them and source libvirtd will send responses.  When
      keepalive_count is set to 0, connections will be automatically
      closed after keepalive_interval seconds of inactivity without
      sending any keepalive messages.
    value: 5
    section: 'keepalive'
    state: 'comment'
    weight: 1  # ]]]

  - name: 'keepalive_count'  # [[[
    value: 5
    section: 'keepalive'
    state: 'comment'
    weight: 2  # ]]]

  - name: 'seccomp_sandbox'  # [[[
    comment: |
      Use seccomp syscall whitelisting in QEMU.
      1 = on, 0 = off, -1 = use QEMU default
      Defaults to -1.
    value: 1
    section: 'seccomp'
    state: 'comment'
    weight: 1  # ]]]

  - name: 'migration_address'  # [[[
    comment: |
      Override the listen address for all incoming migrations. Defaults to
      0.0.0.0, or :: if both host and qemu are capable of IPv6.
    value: '0.0.0.0'
    section: 'migration'
    state: 'comment'
    weight: 1  # ]]]

  - name: 'migration_host'  # [[[
    comment: |
      The default hostname or IP address which will be used by a migration
      source for transferring migration data to this host.  The migration
      source has to be able to resolve this hostname and connect to it so
      setting "localhost" will not work.  By default, the host configured
      hostname is used.
    value: 'host.example.com'
    section: 'migration'
    state: 'comment'
    weight: 2  # ]]]

  - name: 'migration_port_min'  # [[[
    comment: |
      Override the port range used for incoming migrations.

      Minimum must be greater than 0, however when QEMU is not running as root,
      setting the minimum to be lower than 1024 will not work.

      Maximum must not be greater than 65535.
    value: 49152
    section: 'migration'
    state: 'comment'
    weight: 3  # ]]]

  - name: 'migration_port_max'  # [[[
    value: 49215
    section: 'migration'
    state: 'comment'
    weight: 4  # ]]]

  - name: 'log_timestamp'  # [[[
    comment: |
      Timestamp QEMU log messages (if QEMU supports it)

      Defaults to 1.
    value: False
    section: 'log'
    state: 'comment'
    weight: 1  # ]]]

  - name: 'nvram'  # [[[
    comment: |
      Location of master nvram file

      When a domain is configured to use UEFI instead of standard
      BIOS it may use a separate storage for UEFI variables. If
      that is the case libvirt creates the variable store per domain
      using this master file as image. Each UEFI firmware can,
      however, have different variables store. Therefore the nvram is
      a list of strings when a single item is in form of:
        ${PATH_TO_UEFI_FW}:${PATH_TO_UEFI_VARS}.
      Later, when libvirt creates per domain variable store, this list is
      searched for the master image. The UEFI firmware can be called
      differently for different guest architectures. For instance, it is OVMF
      for x86_64 and i686, but it is AAVMF for aarch64. The libvirt default
      follows this scheme.
    value: [ '/usr/share/OVMF/OVMF_CODE.fd:/usr/share/OVMF/OVMF_VARS.fd',
             '/usr/share/OVMF/OVMF_CODE.secboot.fd:/usr/share/OVMF/OVMF_VARS.fd',
             '/usr/share/AAVMF/AAVMF_CODE.fd:/usr/share/AAVMF/AAVMF_VARS.fd' ]
    section: 'nvram'
    state: 'comment'
    weight: 1  # ]]]

  - name: 'stdio_handler'  # [[[
    comment: |
      The backend to use for handling stdout/stderr output from
      QEMU processes.

      'file': QEMU writes directly to a plain file. This is the
              historical default, but allows QEMU to inflict a
              denial of service attack on the host by exhausting
              filesystem space

      'logd': QEMU writes to a pipe provided by virtlogd daemon.
              This is the current default, providing protection
              against denial of service by performing log file
              rollover when a size limit is hit.
    value: 'logd'
    section: 'stdio'
    state: 'comment'
    weight: 1  # ]]]

  - name: 'gluster_debug_level'  # [[[
    comment: |
      QEMU gluster libgfapi log level, debug levels are 0-9, with 9 being the
      most verbose, and 0 representing no debugging output.

      The current logging levels defined in the gluster GFAPI are:

        0 - None
        1 - Emergency
        2 - Alert
        3 - Critical
        4 - Error
        5 - Warning
        6 - Notice
        7 - Info
        8 - Debug
        9 - Trace

      Defaults to 4
    value: 9
    section: 'gluster'
    state: 'comment'
    weight: 1  # ]]]

  - name: 'namespaces'  # [[[
    comment: |
      To enhance security, QEMU driver is capable of creating private namespaces
      for each domain started. Well, so far only "mount" namespace is supported. If
      enabled it means qemu process is unable to see all the devices on the system,
      only those configured for the domain in question. Libvirt then manages
      devices entries throughout the domain lifetime. This namespace is turned on
      by default.
    value: [ 'mount' ]
    section: 'namespaces'
    state: 'comment'
    weight: 1  # ]]]
libvirtd_qemu__default_configuration

List of QEMU configuration options which are changed from their original values by the role.

libvirtd_qemu__default_configuration:

  - name: 'spice_listen'
    value: '{{ libvirtd_qemu__spice_listen }}'
    state: '{{ "present"
               if (libvirtd_qemu__remote_display_allow|d())
               else "ignore" }}'

  - name: 'vnc_listen'
    value: '{{ libvirtd_qemu__vnc_listen }}'
    state: '{{ "present"
               if (libvirtd_qemu__remote_display_allow|d())
               else "ignore" }}'

  - name: 'remote_display_port_min'
    value: '{{ libvirtd_qemu__remote_display_port_min }}'
    state: '{{ "present"
               if (libvirtd_qemu__deployment_mode == "opennebula")
               else "ignore" }}'

  - name: 'remote_display_port_max'
    value: '{{ libvirtd_qemu__remote_display_port_max }}'
    state: '{{ "present"
               if (libvirtd_qemu__deployment_mode == "opennebula")
               else "ignore" }}'

  - name: 'user'
    value: '{{ libvirtd_qemu__user }}'
    state: '{{ "present"
               if (libvirtd_qemu__deployment_mode == "opennebula")
               else "ignore" }}'

  - name: 'group'
    value: '{{ libvirtd_qemu__group }}'
    state: '{{ "present"
               if (libvirtd_qemu__deployment_mode == "opennebula")
               else "ignore" }}'

  - name: 'dynamic_ownership'
    value: False
    state: '{{ "present"
               if (libvirtd_qemu__deployment_mode == "opennebula")
               else "ignore" }}'
libvirtd_qemu__configuration

List of QEMU configuration options which should be set on all hosts in the Ansible inventory.

libvirtd_qemu__configuration: []
libvirtd_qemu__group_configuration

List of QEMU configuration options which should be set on hosts in specific Ansible inventory group.

libvirtd_qemu__group_configuration: []
libvirtd_qemu__host_configuration

List of QEMU configuration options which should be set on specific hosts in the Ansible inventory.

libvirtd_qemu__host_configuration: []
libvirtd_qemu__combined_configuration

Variable which combines all of the configuration lists and passes them to the configuration file template for processing.

libvirtd_qemu__combined_configuration: '{{ libvirtd_qemu__original_configuration
                                           + libvirtd_qemu__default_configuration
                                           + libvirtd_qemu__configuration
                                           + libvirtd_qemu__group_configuration
                                           + libvirtd_qemu__host_configuration }}'
libvirtd_qemu__configuration_sections

List which defines what sections are present in the /etc/libvirt/qemu.conf configuration file. See libvirtd_qemu__configuration_sections for more details.

libvirtd_qemu__configuration_sections:

  - name: 'tls'
    title: 'TLS configuration'
    state: 'hidden'

  - name: 'vnc'
    title: 'VNC display configuration'
    state: 'hidden'

  - name: 'spice'
    title: 'SPICE display configuration'
    state: 'hidden'

  - name: 'chardev'
    title: 'Character device configuration'
    state: 'hidden'

  - name: 'display'
    title: 'Display configuration'
    state: 'hidden'

  - name: 'security'
    title: 'Security configuration'
    state: 'hidden'

  - name: 'user-group'
    title: 'User and group configuration'
    state: 'hidden'

  - name: 'cgroup'
    title: 'Cgroup configuration'
    state: 'hidden'

  - name: 'dump'
    title: 'Data dump configuration'
    state: 'hidden'

  - name: 'proc'
    title: 'Process configuration'
    state: 'hidden'

  - name: 'keepalive'
    title: 'Keepalive configuration'
    state: 'hidden'

  - name: 'seccomp'
    title: 'SecComp configuration'
    state: 'hidden'

  - name: 'migration'
    title: 'Migration configuration'
    state: 'hidden'

  - name: 'log'
    title: 'Logging configuration'
    state: 'hidden'

  - name: 'nvram'
    title: 'NVRAM configuration'
    state: 'hidden'

  - name: 'stdio'
    title: 'IO configuration'
    state: 'hidden'

  - name: 'gluster'
    title: 'GlusterFS configuration'
    state: 'hidden'

  - name: 'namespaces'
    title: 'Namespaces configuration'
    state: 'hidden'

  - name: 'unknown'
    title: 'Other configuration'
    state: 'hidden'
libvirtd_qemu__configuration_comments

Enable or disable inclusion of the parameter comments in the generated configuration file.

libvirtd_qemu__configuration_comments: True

Configuration for other Ansible roles

libvirtd_qemu__ferm__dependent_rules

Configuration for the debops.ferm Ansible role.

libvirtd_qemu__ferm__dependent_rules:

  - name: 'libvirtd_qemu__remote_display'
    type: 'accept'
    dport: '{{ libvirtd_qemu__remote_display_ports }}'
    saddr: '{{ libvirtd_qemu__remote_display_allow }}'
    accept_any: False
    rule_state: '{{ "present"
                    if (libvirtd_qemu__deployment_mode == "opennebula")
                    else "absent" }}'