Merge branch 'claude/stoic-edison-841399'
* Remove k8s-server host * Clean up duplicate sections in README * Track latest gitea release * Add konnektor + api/auth/mailpit reverse proxies * Point konnektor.home at konnektor-web Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -1,9 +1,8 @@
|
||||
.PHONY: help deploy deploy-gateway deploy-fileserver deploy-k8s-server install-gateway install-fileserver install-k8s-server fetch-hwconfig-gateway fetch-hwconfig-fileserver fetch-hwconfig-k8s-server upgrade-containers all
|
||||
.PHONY: help deploy deploy-gateway deploy-fileserver install-gateway install-fileserver fetch-hwconfig-gateway fetch-hwconfig-fileserver upgrade-containers all
|
||||
|
||||
# Hosts
|
||||
GATEWAY_HOST := danlin@10.202.82.3
|
||||
FILESERVER_HOST := danlin@10.202.82.6
|
||||
K8S_HOST := danlin@10.202.82.7
|
||||
|
||||
# Default target
|
||||
all: deploy
|
||||
@@ -15,30 +14,16 @@ help:
|
||||
@echo " make deploy Deploy to gateway and fileserver"
|
||||
@echo " make deploy-gateway Deploy to gateway only"
|
||||
@echo " make deploy-fileserver Deploy to fileserver only"
|
||||
@echo " make deploy-k8s-server Deploy to k8s-server only"
|
||||
@echo " make upgrade-containers Pull latest images and restart containers on fileserver"
|
||||
@echo " make install-gateway Run installation script for gateway"
|
||||
@echo " make install-fileserver Run installation script for fileserver"
|
||||
@echo " make install-k8s-server Run installation script for k8s-server"
|
||||
@echo " make fetch-hwconfig-gateway Fetch hardware config from gateway"
|
||||
@echo " make fetch-hwconfig-fileserver Fetch hardware config from fileserver"
|
||||
@echo " make fetch-hwconfig-k8s-server Fetch hardware config from k8s-server"
|
||||
@echo ""
|
||||
|
||||
# Deployment targets
|
||||
deploy: deploy-gateway deploy-fileserver
|
||||
|
||||
deploy-k8s-server:
|
||||
@echo "======================================"
|
||||
@echo "Deploying k8s-server..."
|
||||
@echo "======================================"
|
||||
@echo "Syncing files to k8s-server..."
|
||||
rsync -av --delete --exclude '.git' ./ $(K8S_HOST):/tmp/infra-nix/
|
||||
@echo "Building and switching on k8s-server..."
|
||||
ssh -tt $(K8S_HOST) "cd /tmp/infra-nix && sudo nixos-rebuild switch --flake '.#k8s-server'"
|
||||
@echo "✓ k8s-server deployed successfully"
|
||||
@echo ""
|
||||
|
||||
deploy-gateway:
|
||||
@echo "======================================"
|
||||
@echo "Deploying gateway..."
|
||||
@@ -118,28 +103,6 @@ install-fileserver:
|
||||
echo "✓ Update hosts/fileserver/configuration.nix with the correct IP if needed"
|
||||
@echo ""
|
||||
|
||||
install-k8s-server:
|
||||
@echo "======================================"
|
||||
@echo "Installing k8s-server..."
|
||||
@echo "======================================"
|
||||
@read -p "Enter k8s-server IP address: " IP; \
|
||||
if [ -z "$$IP" ]; then \
|
||||
echo "Error: IP address required"; \
|
||||
exit 1; \
|
||||
fi; \
|
||||
echo "Copying install script to $$IP..."; \
|
||||
scp install/install-k8s-server.sh root@$$IP:/tmp/; \
|
||||
echo "Connecting to $$IP..."; \
|
||||
ssh root@$$IP "bash /tmp/install-k8s-server.sh"; \
|
||||
echo ""; \
|
||||
echo "Fetching hardware config from $$IP..."; \
|
||||
scp root@$$IP:/mnt/etc/nixos/hardware-configuration.nix hosts/k8s-server/hardware-configuration.nix; \
|
||||
echo "✓ Hardware config saved to hosts/k8s-server/hardware-configuration.nix"; \
|
||||
scp root@$$IP:/mnt/etc/nixos/configuration.nix hosts/k8s-server/configuration.installer.nix; \
|
||||
echo "✓ Installer config saved to hosts/k8s-server/configuration.installer.nix"; \
|
||||
echo "✓ Update hosts/k8s-server/configuration.nix with the correct IP if needed"
|
||||
@echo ""
|
||||
|
||||
# Fetch hardware configuration targets
|
||||
fetch-hwconfig-gateway:
|
||||
@echo "======================================"
|
||||
@@ -156,11 +119,3 @@ fetch-hwconfig-fileserver:
|
||||
scp $(FILESERVER_HOST):/etc/nixos/hardware-configuration.nix hosts/fileserver/
|
||||
@echo "✓ Hardware config saved to hosts/fileserver/hardware-configuration.nix"
|
||||
@echo ""
|
||||
|
||||
fetch-hwconfig-k8s-server:
|
||||
@echo "======================================"
|
||||
@echo "Fetching hardware config from k8s-server..."
|
||||
@echo "======================================"
|
||||
scp $(K8S_HOST):/etc/nixos/hardware-configuration.nix hosts/k8s-server/
|
||||
@echo "✓ Hardware config saved to hosts/k8s-server/hardware-configuration.nix"
|
||||
@echo ""
|
||||
|
||||
@@ -1,4 +1,3 @@
|
||||
````markdown
|
||||
# infra-nix: NixOS Infrastructure
|
||||
|
||||
Dieses Repository enthält die deklarative NixOS-Infrastruktur für:
|
||||
@@ -114,194 +113,3 @@ Access examples:
|
||||
- rclone auth on headless: use `rclone authorize 'drive'` on a desktop and paste token
|
||||
- Permissions: ensure `/data/daten` and `/data/daten/share` exist and are writable (`systemd-tmpfiles` creates them)
|
||||
- Firewall: SMB ports 139/445 are open by module config
|
||||
|
||||
---
|
||||
|
||||
## K8s-Server: Docker Registry
|
||||
|
||||
The k8s-server runs a private Docker Registry v2 with self-signed TLS certificate. Authentication is handled by Caddy for external access.
|
||||
|
||||
**Access:**
|
||||
- External URL: `https://registry.home.lindenfelser.de` (authenticated via Caddy)
|
||||
- Internal URL: `https://10.202.82.7:5000` (direct, no auth - K8s pods)
|
||||
- Default credentials: `admin` / `changeme` (Caddy basic auth)
|
||||
- Storage: `/var/lib/docker-registry` (root partition)
|
||||
|
||||
### 1) Login from external machine
|
||||
|
||||
```bash
|
||||
# Login to registry
|
||||
docker login registry.home.lindenfelser.de
|
||||
# Username: admin
|
||||
# Password: changeme
|
||||
```
|
||||
|
||||
### 2) Push an image
|
||||
|
||||
```bash
|
||||
# Tag your image
|
||||
docker tag myapp:latest registry.home.lindenfelser.de/myapp:latest
|
||||
|
||||
# Push to registry
|
||||
docker push registry.home.lindenfelser.de/myapp:latest
|
||||
```
|
||||
|
||||
### 3) Pull from Kubernetes pods
|
||||
|
||||
The k8s cluster is configured to authenticate automatically. Create a deployment:
|
||||
|
||||
```yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: myapp
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: myapp
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: myapp
|
||||
spec:
|
||||
containers:
|
||||
- name: myapp
|
||||
image: registry.home.lindenfelser.de/myapp:latest
|
||||
```
|
||||
|
||||
### 4) Change registry password
|
||||
|
||||
Authentication is handled by Caddy. Generate new password hash and update:
|
||||
|
||||
```bash
|
||||
# Generate new password hash locally
|
||||
caddy hash-password --plaintext 'yournewpassword'
|
||||
```
|
||||
|
||||
Then update the hash in [modules/gateway.nix](modules/gateway.nix) in the `basicauth` section and redeploy:
|
||||
|
||||
```bash
|
||||
make deploy-gateway
|
||||
```
|
||||
|
||||
### 5) Monitor storage usage
|
||||
|
||||
Check daily storage logs:
|
||||
|
||||
```bash
|
||||
# View growth tracking
|
||||
sudo journalctl -u docker-registry-growth-tracker
|
||||
|
||||
# View last 30 days of size tracking
|
||||
sudo tail -n 30 /var/log/docker-registry-growth.log
|
||||
|
||||
# Check current usage
|
||||
sudo du -sh /var/lib/docker-registry
|
||||
df -h /
|
||||
```
|
||||
|
||||
### 6) Manual garbage collection
|
||||
|
||||
Garbage collection runs automatically every Sunday at 03:00. To run manually:
|
||||
|
||||
```bash
|
||||
sudo systemctl start docker-registry-garbage-collect
|
||||
sudo journalctl -u docker-registry-garbage-collect -e
|
||||
```
|
||||
|
||||
### 7) List images in registry
|
||||
|
||||
```bash
|
||||
# List all repositories
|
||||
curl -u admin:changeme https://registry.home.lindenfelser.de/v2/_catalog
|
||||
|
||||
# List tags for a specific image
|
||||
curl -u admin:changeme https://registry.home.lindenfelser.de/v2/myapp/tags/list
|
||||
```
|
||||
|
||||
### Troubleshooting
|
||||
- **TLS certificate errors**: Registry uses self-signed certificate. External Docker clients need to add to insecure registries or install the cert
|
||||
- **Authentication fails**: Verify Caddy basicauth configuration in [modules/gateway.nix](modules/gateway.nix). K8s pods access registry directly without auth.
|
||||
- **Storage full**: Check root partition usage with `df -h /` and run garbage collection
|
||||
- **K8s pods can't pull**: Verify `registries.yaml` points to internal registry (10.202.82.7:5000) and restart k3s: `sudo systemctl restart k3s`
|
||||
|
||||
````
|
||||
|
||||
---
|
||||
|
||||
## rclone (Google Drive)
|
||||
|
||||
The system has `rclone` installed and a systemd job to sync `/data` to a remote named `gdrive`:
|
||||
|
||||
- Service: `rclone-backup.service` (oneshot)
|
||||
- Timer: `rclone-backup.timer` (runs daily 03:00)
|
||||
- Log: `/var/log/rclone-backup.log`
|
||||
|
||||
### 1) Create the remote `gdrive`
|
||||
Run on the fileserver:
|
||||
|
||||
```bash
|
||||
sudo -i
|
||||
rclone config
|
||||
```
|
||||
|
||||
Then:
|
||||
- n) New remote
|
||||
- name: `gdrive`
|
||||
- storage: `drive` (Google Drive)
|
||||
- Use auto config? For headless server choose "No"
|
||||
- Follow the printed instructions using another machine, or run on a desktop and copy the token
|
||||
- Keep defaults unless you need a service account
|
||||
- y) Yes to save
|
||||
|
||||
Verify:
|
||||
```bash
|
||||
rclone lsd gdrive:
|
||||
rclone mkdir gdrive:backup-daten
|
||||
```
|
||||
|
||||
### 2) Test backup manually
|
||||
```bash
|
||||
sudo systemctl start rclone-backup.service
|
||||
sudo journalctl -u rclone-backup -e
|
||||
sudo tail -n 100 /var/log/rclone-backup.log
|
||||
```
|
||||
|
||||
### 3) Check/enable timer
|
||||
```bash
|
||||
systemctl list-timers '*rclone*'
|
||||
sudo systemctl enable --now rclone-backup.timer
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## SMB password for `danlin`
|
||||
|
||||
The share configuration:
|
||||
- Protected share: `daten` → requires user `danlin`
|
||||
- Guest share: `daten-share` → guest access allowed
|
||||
|
||||
Set the Samba password for `danlin` (independent from system login password):
|
||||
|
||||
```bash
|
||||
sudo smbpasswd -a danlin
|
||||
```
|
||||
|
||||
Useful commands:
|
||||
```bash
|
||||
sudo pdbedit -L # list Samba users
|
||||
sudo systemctl status samba
|
||||
sudo journalctl -u samba -e
|
||||
```
|
||||
|
||||
Access examples:
|
||||
- Windows: `\\fileserver\daten` or `\\fileserver\daten-share`
|
||||
- macOS Finder: Go → Connect to Server → `smb://fileserver/daten` or `smb://fileserver/daten-share`
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
- rclone auth on headless: use `rclone authorize 'drive'` on a desktop and paste token
|
||||
- Permissions: ensure `/data/daten` and `/data/daten/share` exist and are writable (`systemd-tmpfiles` creates them)
|
||||
- Firewall: SMB ports 139/445 are open by module config
|
||||
|
||||
@@ -24,13 +24,6 @@
|
||||
./hosts/gateway/configuration.nix
|
||||
];
|
||||
};
|
||||
|
||||
k8s-server = lib.nixosSystem {
|
||||
inherit system;
|
||||
modules = [
|
||||
./hosts/k8s-server/configuration.nix
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,49 +0,0 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [ ./hardware-configuration.nix ];
|
||||
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
|
||||
networking.hostName = "k8s-server";
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.ens18.ipv4.addresses = [
|
||||
{
|
||||
address = "10.202.82.7";
|
||||
prefixLength = 24;
|
||||
}
|
||||
];
|
||||
networking.defaultGateway = "10.202.82.1";
|
||||
networking.nameservers = [ "10.202.82.3" "10.202.82.4" ];
|
||||
|
||||
time.timeZone = "Europe/Berlin";
|
||||
|
||||
services.openssh.enable = true;
|
||||
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 22 6443 ];
|
||||
allowedUDPPorts = [ 8472 ];
|
||||
};
|
||||
|
||||
users.users.danlin = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ];
|
||||
initialPassword = "changeme";
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAzAW0DTpdQJaQOWDC3YJCmPc/veBQ0R3e1q9nOlWgxC danlin@MacBook-Pro-von-Daniel.fritz.box"
|
||||
];
|
||||
};
|
||||
|
||||
users.users.root.initialPassword = "root";
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
vim
|
||||
htop
|
||||
];
|
||||
|
||||
system.stateVersion = "25.05";
|
||||
}
|
||||
@@ -1,24 +0,0 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
../../modules/common.nix
|
||||
../../modules/kubernetes.nix
|
||||
../../modules/docker-registry.nix
|
||||
];
|
||||
|
||||
networking.hostName = "k8s-server";
|
||||
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.ens18.ipv4.addresses = [
|
||||
{
|
||||
address = "10.202.82.7";
|
||||
prefixLength = 24;
|
||||
}
|
||||
];
|
||||
networking.defaultGateway = "10.202.82.1";
|
||||
networking.nameservers = [ "10.202.82.3" "10.202.82.4" ];
|
||||
|
||||
system.stateVersion = "25.05";
|
||||
}
|
||||
@@ -1,37 +0,0 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/839f8ac5-3391-4bc2-bf64-9df42ae6613b";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/D25C-46DC";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.ens18.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
}
|
||||
@@ -1,92 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
### CONFIG ###
|
||||
OS_DISK=/dev/sda
|
||||
HOSTNAME=k8s-server
|
||||
STATE_VERSION="25.05"
|
||||
TIMEZONE="Europe/Berlin"
|
||||
USERNAME="danlin"
|
||||
PASSWORD="changeme"
|
||||
ROOT_PASS="root"
|
||||
|
||||
echo ">>> WARNUNG: ALLE DATEN auf ${OS_DISK} werden GELÖSCHT!"
|
||||
echo ">>> Warte 5 Sekunden... (STRG+C zum Abbrechen)"
|
||||
sleep 5
|
||||
|
||||
echo ">>> Partitioniere OS-Disk (${OS_DISK}) für EFI + ROOT..."
|
||||
parted "${OS_DISK}" --script mklabel gpt
|
||||
parted "${OS_DISK}" --script mkpart ESP fat32 1MiB 513MiB
|
||||
parted "${OS_DISK}" --script set 1 esp on
|
||||
parted "${OS_DISK}" --script mkpart primary ext4 513MiB 100%
|
||||
|
||||
echo ">>> Formatiere OS-Partitionen..."
|
||||
mkfs.fat -F32 "${OS_DISK}1"
|
||||
mkfs.ext4 -F "${OS_DISK}2"
|
||||
|
||||
echo ">>> Mounten..."
|
||||
mount "${OS_DISK}2" /mnt
|
||||
mkdir -p /mnt/boot
|
||||
mount "${OS_DISK}1" /mnt/boot
|
||||
|
||||
echo ">>> Generiere NixOS-Config..."
|
||||
nixos-generate-config --root /mnt
|
||||
|
||||
CONFIG=/mnt/etc/nixos/configuration.nix
|
||||
|
||||
cat > "${CONFIG}" <<EOF
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [ ./hardware-configuration.nix ];
|
||||
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
|
||||
networking.hostName = "${HOSTNAME}";
|
||||
networking.useDHCP = false;
|
||||
networking.interfaces.ens18.ipv4.addresses = [
|
||||
{
|
||||
address = "10.202.82.7";
|
||||
prefixLength = 24;
|
||||
}
|
||||
];
|
||||
networking.defaultGateway = "10.202.82.1";
|
||||
networking.nameservers = [ "10.202.82.3" "10.202.82.4" ];
|
||||
|
||||
time.timeZone = "${TIMEZONE}";
|
||||
|
||||
services.openssh.enable = true;
|
||||
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 22 6443 ];
|
||||
allowedUDPPorts = [ 8472 ];
|
||||
};
|
||||
|
||||
users.users.${USERNAME} = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ];
|
||||
initialPassword = "${PASSWORD}";
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAzAW0DTpdQJaQOWDC3YJCmPc/veBQ0R3e1q9nOlWgxC danlin@MacBook-Pro-von-Daniel.fritz.box"
|
||||
];
|
||||
};
|
||||
|
||||
users.users.root.initialPassword = "${ROOT_PASS}";
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
vim
|
||||
htop
|
||||
];
|
||||
|
||||
system.stateVersion = "${STATE_VERSION}";
|
||||
}
|
||||
EOF
|
||||
|
||||
echo ">>> Starte nixos-install..."
|
||||
nixos-install
|
||||
|
||||
echo ">>> Fertig. Jetzt reboot ausführen."
|
||||
@@ -1,164 +0,0 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
########################################
|
||||
# Docker Registry v2
|
||||
########################################
|
||||
services.dockerRegistry = {
|
||||
enable = true;
|
||||
port = 5000;
|
||||
listenAddress = "0.0.0.0";
|
||||
|
||||
# Enable image deletion and garbage collection
|
||||
enableDelete = true;
|
||||
enableGarbageCollect = true;
|
||||
garbageCollectDates = "Sun 03:00";
|
||||
|
||||
# Storage location (root partition)
|
||||
storagePath = "/var/lib/docker-registry";
|
||||
|
||||
# TLS configuration (for internal access)
|
||||
extraConfig = {
|
||||
http = {
|
||||
tls = {
|
||||
certificate = "/var/lib/docker-registry/certs/registry.crt";
|
||||
key = "/var/lib/docker-registry/certs/registry.key";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
########################################
|
||||
# Firewall
|
||||
########################################
|
||||
networking.firewall.allowedTCPPorts = [ 5000 ];
|
||||
|
||||
########################################
|
||||
# Setup: directories, certificates, htpasswd
|
||||
########################################
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /var/lib/docker-registry 0755 root root -"
|
||||
"d /var/lib/docker-registry/certs 0755 root root -"
|
||||
];
|
||||
|
||||
# Generate self-signed certificate
|
||||
systemd.services.docker-registry-setup = {
|
||||
description = "Docker Registry initial setup";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
before = [ "docker-registry.service" ];
|
||||
path = with pkgs; [ openssl apacheHttpd ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
|
||||
script = ''
|
||||
# Create self-signed certificate if it doesn't exist
|
||||
if [ ! -f /var/lib/docker-registry/certs/registry.crt ]; then
|
||||
echo "Generating self-signed certificate for Docker Registry..."
|
||||
${pkgs.openssl}/bin/openssl req -x509 -newkey rsa:4096 -nodes \
|
||||
-keyout /var/lib/docker-registry/certs/registry.key \
|
||||
-out /var/lib/docker-registry/certs/registry.crt \
|
||||
-days 3650 \
|
||||
-subj "/CN=registry.home.lindenfelser.de" \
|
||||
-addext "subjectAltName=DNS:registry.home.lindenfelser.de,DNS:k8s-server,IP:10.202.82.7"
|
||||
chmod 644 /var/lib/docker-registry/certs/registry.key
|
||||
chmod 644 /var/lib/docker-registry/certs/registry.crt
|
||||
echo "Certificate generated successfully"
|
||||
fi
|
||||
|
||||
# Ensure correct ownership
|
||||
chown -R docker-registry:docker-registry /var/lib/docker-registry
|
||||
'';
|
||||
};
|
||||
|
||||
########################################
|
||||
# Storage Monitoring (80% threshold)
|
||||
########################################
|
||||
systemd.services.docker-registry-storage-check = {
|
||||
description = "Check Docker Registry storage usage";
|
||||
path = with pkgs; [ coreutils util-linux ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = "root";
|
||||
};
|
||||
|
||||
script = ''
|
||||
REGISTRY_PATH="/var/lib/docker-registry"
|
||||
THRESHOLD=80
|
||||
|
||||
if [ ! -d "$REGISTRY_PATH" ]; then
|
||||
echo "Registry path does not exist yet"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Get disk usage percentage of the filesystem containing the registry
|
||||
USAGE=$(df -h "$REGISTRY_PATH" | awk 'NR==2 {print $5}' | sed 's/%//')
|
||||
REGISTRY_SIZE=$(du -sh "$REGISTRY_PATH" | cut -f1)
|
||||
|
||||
echo "Docker Registry storage: $REGISTRY_SIZE (filesystem usage: $USAGE%)"
|
||||
|
||||
if [ "$USAGE" -gt "$THRESHOLD" ]; then
|
||||
echo "WARNING: Filesystem usage ($USAGE%) exceeds threshold ($THRESHOLD%)"
|
||||
echo "Consider cleaning up old images or expanding storage"
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.timers.docker-registry-storage-check = {
|
||||
description = "Timer for Docker Registry storage check";
|
||||
wantedBy = [ "timers.target" ];
|
||||
|
||||
timerConfig = {
|
||||
OnCalendar = "daily";
|
||||
Persistent = true;
|
||||
};
|
||||
};
|
||||
|
||||
########################################
|
||||
# Daily Storage Growth Tracking
|
||||
########################################
|
||||
systemd.services.docker-registry-growth-tracker = {
|
||||
description = "Track Docker Registry storage growth";
|
||||
path = with pkgs; [ coreutils ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = "root";
|
||||
};
|
||||
|
||||
script = ''
|
||||
REGISTRY_PATH="/var/lib/docker-registry"
|
||||
LOG_FILE="/var/log/docker-registry-growth.log"
|
||||
|
||||
if [ ! -d "$REGISTRY_PATH" ]; then
|
||||
echo "Registry path does not exist yet"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
|
||||
SIZE_BYTES=$(du -sb "$REGISTRY_PATH" | cut -f1)
|
||||
SIZE_HUMAN=$(du -sh "$REGISTRY_PATH" | cut -f1)
|
||||
|
||||
echo "$TIMESTAMP | Size: $SIZE_HUMAN ($SIZE_BYTES bytes)" >> "$LOG_FILE"
|
||||
|
||||
# Keep only last 90 days of logs
|
||||
if [ -f "$LOG_FILE" ]; then
|
||||
tail -n 90 "$LOG_FILE" > "$LOG_FILE.tmp"
|
||||
mv "$LOG_FILE.tmp" "$LOG_FILE"
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.timers.docker-registry-growth-tracker = {
|
||||
description = "Timer for Docker Registry growth tracking";
|
||||
wantedBy = [ "timers.target" ];
|
||||
|
||||
timerConfig = {
|
||||
OnCalendar = "daily";
|
||||
Persistent = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -180,7 +180,7 @@
|
||||
};
|
||||
|
||||
virtualisation.oci-containers.containers.gitea = {
|
||||
image = "gitea/gitea:1.25";
|
||||
image = "gitea/gitea:latest";
|
||||
autoStart = true;
|
||||
ports = [ "3000:3000" "2222:2222" ];
|
||||
volumes = [
|
||||
|
||||
+29
-15
@@ -42,17 +42,38 @@
|
||||
reverse_proxy 10.202.82.6:3000
|
||||
'';
|
||||
};
|
||||
"registry.home.lindenfelser.de" = {
|
||||
# konnektor-web — Frontend
|
||||
"konnektor.home.lindenfelser.de" = {
|
||||
extraConfig = ''
|
||||
@registry host registry.home.lindenfelser.de
|
||||
basicauth @registry {
|
||||
admin $2a$14$Ga5BCiHvtlfRjdnlI9bhseFnNZ8dwXsLz4t1FdSemA1mAUV/vA1oi
|
||||
reverse_proxy 10.202.82.49:8082
|
||||
'';
|
||||
};
|
||||
# konnektor-api Frontend REST
|
||||
"api.konnektor.home.lindenfelser.de" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy 10.202.82.49:8080
|
||||
'';
|
||||
};
|
||||
# Zitadel OIDC
|
||||
# Wichtig: `header_up Host {host}` — Zitadel routet anhand des Host-
|
||||
# Headers; ohne das sieht es den Upstream-Container-Hostname und failt.
|
||||
"auth.konnektor.home.lindenfelser.de" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy 10.202.82.49:8081 {
|
||||
header_up Host {host}
|
||||
}
|
||||
reverse_proxy @registry https://10.202.82.7:5000 {
|
||||
transport http {
|
||||
tls
|
||||
tls_insecure_skip_verify
|
||||
'';
|
||||
};
|
||||
# Mailpit Web UI — NUR aus dem LAN 10.202.82.0/24 erreichbar.
|
||||
# Alle anderen IPs bekommen 403, ohne dass Mailpit jemals angerufen wird.
|
||||
"mailpit.konnektor.home.lindenfelser.de" = {
|
||||
extraConfig = ''
|
||||
@lan client_ip 10.202.82.0/24
|
||||
handle @lan {
|
||||
reverse_proxy 10.202.82.49:8025
|
||||
}
|
||||
handle {
|
||||
respond "forbidden — mailpit ist nur aus dem LAN 10.202.82.0/24 erreichbar" 403
|
||||
}
|
||||
'';
|
||||
};
|
||||
@@ -69,7 +90,6 @@
|
||||
80 # HTTP (Caddy)
|
||||
443 # HTTPS (Caddy)
|
||||
2222 # External SSH to Gitea
|
||||
6443 # Kubernetes API to k8s-server
|
||||
];
|
||||
|
||||
networking.firewall.allowedUDPPorts = [
|
||||
@@ -85,7 +105,6 @@
|
||||
# Hairpin NAT for LAN clients hitting gateway:2222 so replies go back via gateway
|
||||
extraCommands = ''
|
||||
iptables -t nat -A POSTROUTING -p tcp -d 10.202.82.6 --dport 2222 -j MASQUERADE
|
||||
iptables -t nat -A POSTROUTING -p tcp -d 10.202.82.7 --dport 6443 -j MASQUERADE
|
||||
'';
|
||||
forwardPorts = [
|
||||
{
|
||||
@@ -93,11 +112,6 @@
|
||||
sourcePort = 2222;
|
||||
destination = "10.202.82.6:2222";
|
||||
}
|
||||
{
|
||||
proto = "tcp";
|
||||
sourcePort = 6443;
|
||||
destination = "10.202.82.7:6443";
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -1,49 +0,0 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
########################################
|
||||
# k3s Single-Node (Traefik disabled)
|
||||
########################################
|
||||
services.k3s = {
|
||||
enable = true;
|
||||
role = "server";
|
||||
# Initialize single-server cluster and disable bundled Traefik ingress.
|
||||
extraFlags = toString [
|
||||
"--cluster-init"
|
||||
"--disable=traefik"
|
||||
"--flannel-backend=vxlan"
|
||||
"--tls-san=k8s.home.lindenfelser.de"
|
||||
];
|
||||
};
|
||||
|
||||
########################################
|
||||
# Firewall for k3s
|
||||
########################################
|
||||
networking.firewall.enable = true;
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
6443 # Kubernetes API
|
||||
10250 # Kubelet metrics
|
||||
5000 # Docker Registry
|
||||
];
|
||||
|
||||
networking.firewall.allowedUDPPorts = [
|
||||
8472 # flannel VXLAN
|
||||
];
|
||||
|
||||
########################################
|
||||
# Containerd registry configuration
|
||||
########################################
|
||||
environment.etc."rancher/k3s/registries.yaml" = {
|
||||
text = ''
|
||||
mirrors:
|
||||
registry.home.lindenfelser.de:
|
||||
endpoint:
|
||||
- "https://10.202.82.7:5000"
|
||||
configs:
|
||||
"10.202.82.7:5000":
|
||||
tls:
|
||||
insecure_skip_verify: true
|
||||
'';
|
||||
mode = "0644";
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user