danlin/infra-nix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add k8s-server configuration and deployment scripts

Browse Source
This commit is contained in:
Daniel Lindenfelser
2025-12-15 17:12:10 +01:00
parent cdf71a5ded
commit 0425868cdc
8 changed files with 291 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+46 -1
View File
@@ -1,8 +1,9 @@
.PHONY: help deploy deploy-gateway deploy-fileserver install-gateway install-fileserver fetch-hwconfig-gateway fetch-hwconfig-fileserver all
.PHONY: help deploy deploy-gateway deploy-fileserver deploy-k8s-server install-gateway install-fileserver install-k8s-server fetch-hwconfig-gateway fetch-hwconfig-fileserver fetch-hwconfig-k8s-server all
# Hosts
GATEWAY_HOST := danlin@10.202.82.3
FILESERVER_HOST := danlin@10.202.82.6
K8S_HOST := danlin@10.202.82.7
# Default target
all: deploy
@@ -14,15 +15,29 @@ help:
@echo " make deploy Deploy to both gateway and fileserver"
@echo " make deploy-gateway Deploy to gateway only"
@echo " make deploy-fileserver Deploy to fileserver only"
@echo " make deploy-k8s-server Deploy to k8s-server only"
@echo " make install-gateway Run installation script for gateway"
@echo " make install-fileserver Run installation script for fileserver"
@echo " make install-k8s-server Run installation script for k8s-server"
@echo " make fetch-hwconfig-gateway Fetch hardware config from gateway"
@echo " make fetch-hwconfig-fileserver Fetch hardware config from fileserver"
@echo " make fetch-hwconfig-k8s-server Fetch hardware config from k8s-server"
@echo ""
# Deployment targets
deploy: deploy-gateway deploy-fileserver
deploy-k8s-server:
@echo "======================================"
@echo "Deploying k8s-server..."
@echo "======================================"
@echo "Syncing files to k8s-server..."
rsync -av --delete --exclude '.git' ./ $(K8S_HOST):/tmp/infra-nix/
@echo "Building and switching on k8s-server..."
ssh -tt $(K8S_HOST) "cd /tmp/infra-nix && sudo nixos-rebuild switch --flake '.#k8s-server'"
@echo "✓ k8s-server deployed successfully"
@echo ""
deploy-gateway:
@echo "======================================"
@echo "Deploying gateway..."
@@ -90,6 +105,28 @@ install-fileserver:
echo "✓ Update hosts/fileserver/configuration.nix with the correct IP if needed"
@echo ""
install-k8s-server:
@echo "======================================"
@echo "Installing k8s-server..."
@echo "======================================"
@read -p "Enter k8s-server IP address: " IP; \
if [ -z "$$IP" ]; then \
echo "Error: IP address required"; \
exit 1; \
fi; \
echo "Copying install script to $$IP..."; \
scp install/install-k8s-server.sh root@$$IP:/tmp/; \
echo "Connecting to $$IP..."; \
ssh root@$$IP "bash /tmp/install-k8s-server.sh"; \
echo ""; \
echo "Fetching hardware config from $$IP..."; \
scp root@$$IP:/mnt/etc/nixos/hardware-configuration.nix hosts/k8s-server/hardware-configuration.nix; \
echo "✓ Hardware config saved to hosts/k8s-server/hardware-configuration.nix"; \
scp root@$$IP:/mnt/etc/nixos/configuration.nix hosts/k8s-server/configuration.installer.nix; \
echo "✓ Installer config saved to hosts/k8s-server/configuration.installer.nix"; \
echo "✓ Update hosts/k8s-server/configuration.nix with the correct IP if needed"
@echo ""
# Fetch hardware configuration targets
fetch-hwconfig-gateway:
@echo "======================================"
@@ -106,3 +143,11 @@ fetch-hwconfig-fileserver:
scp $(FILESERVER_HOST):/etc/nixos/hardware-configuration.nix hosts/fileserver/
@echo "✓ Hardware config saved to hosts/fileserver/hardware-configuration.nix"
@echo ""
fetch-hwconfig-k8s-server:
@echo "======================================"
@echo "Fetching hardware config from k8s-server..."
@echo "======================================"
scp $(K8S_HOST):/etc/nixos/hardware-configuration.nix hosts/k8s-server/
@echo "✓ Hardware config saved to hosts/k8s-server/hardware-configuration.nix"
@echo ""
flake.nix
+7
View File
@@ -24,6 +24,13 @@
./hosts/gateway/configuration.nix
];
};
k8s-server = lib.nixosSystem {
inherit system;
modules = [
./hosts/k8s-server/configuration.nix
];
};
};
};
}
hosts/k8s-server/configuration.installer.nix
+49
View File
@@ -0,0 +1,49 @@
{ config, pkgs, ... }:
{
imports = [ ./hardware-configuration.nix ];
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
security.sudo.wheelNeedsPassword = false;
networking.hostName = "k8s-server";
networking.useDHCP = false;
networking.interfaces.ens18.ipv4.addresses = [
{
address = "10.202.82.7";
prefixLength = 24;
}
];
networking.defaultGateway = "10.202.82.1";
networking.nameservers = [ "10.202.82.3" "10.202.82.4" ];
time.timeZone = "Europe/Berlin";
services.openssh.enable = true;
networking.firewall = {
enable = true;
allowedTCPPorts = [ 22 6443 ];
allowedUDPPorts = [ 8472 ];
};
users.users.danlin = {
isNormalUser = true;
extraGroups = [ "wheel" ];
initialPassword = "changeme";
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAzAW0DTpdQJaQOWDC3YJCmPc/veBQ0R3e1q9nOlWgxC danlin@MacBook-Pro-von-Daniel.fritz.box"
];
};
users.users.root.initialPassword = "root";
environment.systemPackages = with pkgs; [
vim
htop
];
system.stateVersion = "25.05";
}
hosts/k8s-server/configuration.nix
+23
View File
@@ -0,0 +1,23 @@
{ config, pkgs, ... }:
{
imports = [
./hardware-configuration.nix
../../modules/common.nix
../../modules/kubernetes.nix
];
networking.hostName = "k8s-server";
networking.useDHCP = false;
networking.interfaces.ens18.ipv4.addresses = [
{
address = "10.202.82.7";
prefixLength = 24;
}
];
networking.defaultGateway = "10.202.82.1";
networking.nameservers = [ "10.202.82.3" "10.202.82.4" ];
system.stateVersion = "25.05";
}
hosts/k8s-server/hardware-configuration.nix
+37
View File
@@ -0,0 +1,37 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/839f8ac5-3391-4bc2-bf64-9df42ae6613b";
fsType = "ext4";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/D25C-46DC";
fsType = "vfat";
options = [ "fmask=0022" "dmask=0022" ];
};
swapDevices = [ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.ens18.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
}
install/install-k8s-server.sh
+92
View File
@@ -0,0 +1,92 @@
#!/usr/bin/env bash
set -euo pipefail
### CONFIG ###
OS_DISK=/dev/sda
HOSTNAME=k8s-server
STATE_VERSION="25.05"
TIMEZONE="Europe/Berlin"
USERNAME="danlin"
PASSWORD="changeme"
ROOT_PASS="root"
echo ">>> WARNUNG: ALLE DATEN auf ${OS_DISK} werden GELÖSCHT!"
echo ">>> Warte 5 Sekunden... (STRG+C zum Abbrechen)"
sleep 5
echo ">>> Partitioniere OS-Disk (${OS_DISK}) für EFI + ROOT..."
parted "${OS_DISK}" --script mklabel gpt
parted "${OS_DISK}" --script mkpart ESP fat32 1MiB 513MiB
parted "${OS_DISK}" --script set 1 esp on
parted "${OS_DISK}" --script mkpart primary ext4 513MiB 100%
echo ">>> Formatiere OS-Partitionen..."
mkfs.fat -F32 "${OS_DISK}1"
mkfs.ext4 -F "${OS_DISK}2"
echo ">>> Mounten..."
mount "${OS_DISK}2" /mnt
mkdir -p /mnt/boot
mount "${OS_DISK}1" /mnt/boot
echo ">>> Generiere NixOS-Config..."
nixos-generate-config --root /mnt
CONFIG=/mnt/etc/nixos/configuration.nix
cat > "${CONFIG}" <<EOF
{ config, pkgs, ... }:
{
imports = [ ./hardware-configuration.nix ];
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
security.sudo.wheelNeedsPassword = false;
networking.hostName = "${HOSTNAME}";
networking.useDHCP = false;
networking.interfaces.ens18.ipv4.addresses = [
{
address = "10.202.82.7";
prefixLength = 24;
}
];
networking.defaultGateway = "10.202.82.1";
networking.nameservers = [ "10.202.82.3" "10.202.82.4" ];
time.timeZone = "${TIMEZONE}";
services.openssh.enable = true;
networking.firewall = {
enable = true;
allowedTCPPorts = [ 22 6443 ];
allowedUDPPorts = [ 8472 ];
};
users.users.${USERNAME} = {
isNormalUser = true;
extraGroups = [ "wheel" ];
initialPassword = "${PASSWORD}";
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAzAW0DTpdQJaQOWDC3YJCmPc/veBQ0R3e1q9nOlWgxC danlin@MacBook-Pro-von-Daniel.fritz.box"
];
};
users.users.root.initialPassword = "${ROOT_PASS}";
environment.systemPackages = with pkgs; [
vim
htop
];
system.stateVersion = "${STATE_VERSION}";
}
EOF
echo ">>> Starte nixos-install..."
nixos-install
echo ">>> Fertig. Jetzt reboot ausführen."
modules/gateway.nix
+7
View File
@@ -55,6 +55,7 @@
80 # HTTP (Caddy)
443 # HTTPS (Caddy)
2222 # External SSH to Gitea
6443 # Kubernetes API to k8s-server
];
networking.firewall.allowedUDPPorts = [
@@ -70,6 +71,7 @@
# Hairpin NAT for LAN clients hitting gateway:2222 so replies go back via gateway
extraCommands = ''
iptables -t nat -A POSTROUTING -p tcp -d 10.202.82.6 --dport 2222 -j MASQUERADE
iptables -t nat -A POSTROUTING -p tcp -d 10.202.82.7 --dport 6443 -j MASQUERADE
'';
forwardPorts = [
{
@@ -77,6 +79,11 @@
sourcePort = 2222;
destination = "10.202.82.6:2222";
}
{
proto = "tcp";
sourcePort = 6443;
destination = "10.202.82.7:6443";
}
];
};
}
modules/kubernetes.nix
+30
View File
@@ -0,0 +1,30 @@
{ config, pkgs, ... }:
{
########################################
# k3s Single-Node (Traefik disabled)
########################################
services.k3s = {
enable = true;
role = "server";
# Initialize single-server cluster and disable bundled Traefik ingress.
extraFlags = toString [
"--cluster-init"
"--disable=traefik"
"--flannel-backend=vxlan"
];
};
########################################
# Firewall for k3s
########################################
networking.firewall.enable = true;
networking.firewall.allowedTCPPorts = [
6443 # Kubernetes API
10250 # Kubelet metrics
];
networking.firewall.allowedUDPPorts = [
8472 # flannel VXLAN
];
}