diff --git a/Makefile b/Makefile index 40e2f0c..4009d75 100644 --- a/Makefile +++ b/Makefile @@ -1,9 +1,8 @@ -.PHONY: help deploy deploy-gateway deploy-fileserver deploy-k8s-server install-gateway install-fileserver install-k8s-server fetch-hwconfig-gateway fetch-hwconfig-fileserver fetch-hwconfig-k8s-server upgrade-containers all +.PHONY: help deploy deploy-gateway deploy-fileserver install-gateway install-fileserver fetch-hwconfig-gateway fetch-hwconfig-fileserver upgrade-containers all # Hosts GATEWAY_HOST := danlin@10.202.82.3 FILESERVER_HOST := danlin@10.202.82.6 -K8S_HOST := danlin@10.202.82.7 # Default target all: deploy @@ -15,30 +14,16 @@ help: @echo " make deploy Deploy to gateway and fileserver" @echo " make deploy-gateway Deploy to gateway only" @echo " make deploy-fileserver Deploy to fileserver only" - @echo " make deploy-k8s-server Deploy to k8s-server only" @echo " make upgrade-containers Pull latest images and restart containers on fileserver" @echo " make install-gateway Run installation script for gateway" @echo " make install-fileserver Run installation script for fileserver" - @echo " make install-k8s-server Run installation script for k8s-server" @echo " make fetch-hwconfig-gateway Fetch hardware config from gateway" @echo " make fetch-hwconfig-fileserver Fetch hardware config from fileserver" - @echo " make fetch-hwconfig-k8s-server Fetch hardware config from k8s-server" @echo "" # Deployment targets deploy: deploy-gateway deploy-fileserver -deploy-k8s-server: - @echo "======================================" - @echo "Deploying k8s-server..." - @echo "======================================" - @echo "Syncing files to k8s-server..." - rsync -av --delete --exclude '.git' ./ $(K8S_HOST):/tmp/infra-nix/ - @echo "Building and switching on k8s-server..." - ssh -tt $(K8S_HOST) "cd /tmp/infra-nix && sudo nixos-rebuild switch --flake '.#k8s-server'" - @echo "✓ k8s-server deployed successfully" - @echo "" - deploy-gateway: @echo "======================================" @echo "Deploying gateway..." @@ -118,28 +103,6 @@ install-fileserver: echo "✓ Update hosts/fileserver/configuration.nix with the correct IP if needed" @echo "" -install-k8s-server: - @echo "======================================" - @echo "Installing k8s-server..." - @echo "======================================" - @read -p "Enter k8s-server IP address: " IP; \ - if [ -z "$$IP" ]; then \ - echo "Error: IP address required"; \ - exit 1; \ - fi; \ - echo "Copying install script to $$IP..."; \ - scp install/install-k8s-server.sh root@$$IP:/tmp/; \ - echo "Connecting to $$IP..."; \ - ssh root@$$IP "bash /tmp/install-k8s-server.sh"; \ - echo ""; \ - echo "Fetching hardware config from $$IP..."; \ - scp root@$$IP:/mnt/etc/nixos/hardware-configuration.nix hosts/k8s-server/hardware-configuration.nix; \ - echo "✓ Hardware config saved to hosts/k8s-server/hardware-configuration.nix"; \ - scp root@$$IP:/mnt/etc/nixos/configuration.nix hosts/k8s-server/configuration.installer.nix; \ - echo "✓ Installer config saved to hosts/k8s-server/configuration.installer.nix"; \ - echo "✓ Update hosts/k8s-server/configuration.nix with the correct IP if needed" - @echo "" - # Fetch hardware configuration targets fetch-hwconfig-gateway: @echo "======================================" @@ -156,11 +119,3 @@ fetch-hwconfig-fileserver: scp $(FILESERVER_HOST):/etc/nixos/hardware-configuration.nix hosts/fileserver/ @echo "✓ Hardware config saved to hosts/fileserver/hardware-configuration.nix" @echo "" - -fetch-hwconfig-k8s-server: - @echo "======================================" - @echo "Fetching hardware config from k8s-server..." - @echo "======================================" - scp $(K8S_HOST):/etc/nixos/hardware-configuration.nix hosts/k8s-server/ - @echo "✓ Hardware config saved to hosts/k8s-server/hardware-configuration.nix" - @echo "" diff --git a/README.md b/README.md index 12e5893..2c9d315 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,3 @@ -````markdown # infra-nix: NixOS Infrastructure Dieses Repository enthält die deklarative NixOS-Infrastruktur für: @@ -117,119 +116,6 @@ Access examples: --- -## K8s-Server: Docker Registry - -The k8s-server runs a private Docker Registry v2 with self-signed TLS certificate. Authentication is handled by Caddy for external access. - -**Access:** -- External URL: `https://registry.home.lindenfelser.de` (authenticated via Caddy) -- Internal URL: `https://10.202.82.7:5000` (direct, no auth - K8s pods) -- Default credentials: `admin` / `changeme` (Caddy basic auth) -- Storage: `/var/lib/docker-registry` (root partition) - -### 1) Login from external machine - -```bash -# Login to registry -docker login registry.home.lindenfelser.de -# Username: admin -# Password: changeme -``` - -### 2) Push an image - -```bash -# Tag your image -docker tag myapp:latest registry.home.lindenfelser.de/myapp:latest - -# Push to registry -docker push registry.home.lindenfelser.de/myapp:latest -``` - -### 3) Pull from Kubernetes pods - -The k8s cluster is configured to authenticate automatically. Create a deployment: - -```yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - name: myapp -spec: - replicas: 1 - selector: - matchLabels: - app: myapp - template: - metadata: - labels: - app: myapp - spec: - containers: - - name: myapp - image: registry.home.lindenfelser.de/myapp:latest -``` - -### 4) Change registry password - -Authentication is handled by Caddy. Generate new password hash and update: - -```bash -# Generate new password hash locally -caddy hash-password --plaintext 'yournewpassword' -``` - -Then update the hash in [modules/gateway.nix](modules/gateway.nix) in the `basicauth` section and redeploy: - -```bash -make deploy-gateway -``` - -### 5) Monitor storage usage - -Check daily storage logs: - -```bash -# View growth tracking -sudo journalctl -u docker-registry-growth-tracker - -# View last 30 days of size tracking -sudo tail -n 30 /var/log/docker-registry-growth.log - -# Check current usage -sudo du -sh /var/lib/docker-registry -df -h / -``` - -### 6) Manual garbage collection - -Garbage collection runs automatically every Sunday at 03:00. To run manually: - -```bash -sudo systemctl start docker-registry-garbage-collect -sudo journalctl -u docker-registry-garbage-collect -e -``` - -### 7) List images in registry - -```bash -# List all repositories -curl -u admin:changeme https://registry.home.lindenfelser.de/v2/_catalog - -# List tags for a specific image -curl -u admin:changeme https://registry.home.lindenfelser.de/v2/myapp/tags/list -``` - -### Troubleshooting -- **TLS certificate errors**: Registry uses self-signed certificate. External Docker clients need to add to insecure registries or install the cert -- **Authentication fails**: Verify Caddy basicauth configuration in [modules/gateway.nix](modules/gateway.nix). K8s pods access registry directly without auth. -- **Storage full**: Check root partition usage with `df -h /` and run garbage collection -- **K8s pods can't pull**: Verify `registries.yaml` points to internal registry (10.202.82.7:5000) and restart k3s: `sudo systemctl restart k3s` - -```` - ---- - ## rclone (Google Drive) The system has `rclone` installed and a systemd job to sync `/data` to a remote named `gdrive`: diff --git a/flake.nix b/flake.nix index f2732bd..55660ad 100644 --- a/flake.nix +++ b/flake.nix @@ -24,13 +24,6 @@ ./hosts/gateway/configuration.nix ]; }; - - k8s-server = lib.nixosSystem { - inherit system; - modules = [ - ./hosts/k8s-server/configuration.nix - ]; - }; }; }; } \ No newline at end of file diff --git a/hosts/k8s-server/configuration.installer.nix b/hosts/k8s-server/configuration.installer.nix deleted file mode 100644 index 0159ae1..0000000 --- a/hosts/k8s-server/configuration.installer.nix +++ /dev/null @@ -1,49 +0,0 @@ -{ config, pkgs, ... }: - -{ - imports = [ ./hardware-configuration.nix ]; - - boot.loader.systemd-boot.enable = true; - boot.loader.efi.canTouchEfiVariables = true; - - security.sudo.wheelNeedsPassword = false; - - networking.hostName = "k8s-server"; - networking.useDHCP = false; - networking.interfaces.ens18.ipv4.addresses = [ - { - address = "10.202.82.7"; - prefixLength = 24; - } - ]; - networking.defaultGateway = "10.202.82.1"; - networking.nameservers = [ "10.202.82.3" "10.202.82.4" ]; - - time.timeZone = "Europe/Berlin"; - - services.openssh.enable = true; - - networking.firewall = { - enable = true; - allowedTCPPorts = [ 22 6443 ]; - allowedUDPPorts = [ 8472 ]; - }; - - users.users.danlin = { - isNormalUser = true; - extraGroups = [ "wheel" ]; - initialPassword = "changeme"; - openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAzAW0DTpdQJaQOWDC3YJCmPc/veBQ0R3e1q9nOlWgxC danlin@MacBook-Pro-von-Daniel.fritz.box" - ]; - }; - - users.users.root.initialPassword = "root"; - - environment.systemPackages = with pkgs; [ - vim - htop - ]; - - system.stateVersion = "25.05"; -} diff --git a/hosts/k8s-server/configuration.nix b/hosts/k8s-server/configuration.nix deleted file mode 100644 index dd98034..0000000 --- a/hosts/k8s-server/configuration.nix +++ /dev/null @@ -1,24 +0,0 @@ -{ config, pkgs, ... }: - -{ - imports = [ - ./hardware-configuration.nix - ../../modules/common.nix - ../../modules/kubernetes.nix - ../../modules/docker-registry.nix - ]; - - networking.hostName = "k8s-server"; - - networking.useDHCP = false; - networking.interfaces.ens18.ipv4.addresses = [ - { - address = "10.202.82.7"; - prefixLength = 24; - } - ]; - networking.defaultGateway = "10.202.82.1"; - networking.nameservers = [ "10.202.82.3" "10.202.82.4" ]; - - system.stateVersion = "25.05"; -} diff --git a/hosts/k8s-server/hardware-configuration.nix b/hosts/k8s-server/hardware-configuration.nix deleted file mode 100644 index 25fe881..0000000 --- a/hosts/k8s-server/hardware-configuration.nix +++ /dev/null @@ -1,37 +0,0 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes -# to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: - -{ - imports = - [ (modulesPath + "/profiles/qemu-guest.nix") - ]; - - boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ]; - boot.initrd.kernelModules = [ ]; - boot.kernelModules = [ "kvm-intel" ]; - boot.extraModulePackages = [ ]; - - fileSystems."/" = - { device = "/dev/disk/by-uuid/839f8ac5-3391-4bc2-bf64-9df42ae6613b"; - fsType = "ext4"; - }; - - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/D25C-46DC"; - fsType = "vfat"; - options = [ "fmask=0022" "dmask=0022" ]; - }; - - swapDevices = [ ]; - - # Enables DHCP on each ethernet and wireless interface. In case of scripted networking - # (the default) this is the recommended approach. When using systemd-networkd it's - # still possible to use this option, but it's recommended to use it in conjunction - # with explicit per-interface declarations with `networking.interfaces..useDHCP`. - networking.useDHCP = lib.mkDefault true; - # networking.interfaces.ens18.useDHCP = lib.mkDefault true; - - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; -} diff --git a/install/install-k8s-server.sh b/install/install-k8s-server.sh deleted file mode 100644 index 77b59c9..0000000 --- a/install/install-k8s-server.sh +++ /dev/null @@ -1,92 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -### CONFIG ### -OS_DISK=/dev/sda -HOSTNAME=k8s-server -STATE_VERSION="25.05" -TIMEZONE="Europe/Berlin" -USERNAME="danlin" -PASSWORD="changeme" -ROOT_PASS="root" - -echo ">>> WARNUNG: ALLE DATEN auf ${OS_DISK} werden GELÖSCHT!" -echo ">>> Warte 5 Sekunden... (STRG+C zum Abbrechen)" -sleep 5 - -echo ">>> Partitioniere OS-Disk (${OS_DISK}) für EFI + ROOT..." -parted "${OS_DISK}" --script mklabel gpt -parted "${OS_DISK}" --script mkpart ESP fat32 1MiB 513MiB -parted "${OS_DISK}" --script set 1 esp on -parted "${OS_DISK}" --script mkpart primary ext4 513MiB 100% - -echo ">>> Formatiere OS-Partitionen..." -mkfs.fat -F32 "${OS_DISK}1" -mkfs.ext4 -F "${OS_DISK}2" - -echo ">>> Mounten..." -mount "${OS_DISK}2" /mnt -mkdir -p /mnt/boot -mount "${OS_DISK}1" /mnt/boot - -echo ">>> Generiere NixOS-Config..." -nixos-generate-config --root /mnt - -CONFIG=/mnt/etc/nixos/configuration.nix - -cat > "${CONFIG}" <>> Starte nixos-install..." -nixos-install - -echo ">>> Fertig. Jetzt reboot ausführen." diff --git a/modules/docker-registry.nix b/modules/docker-registry.nix deleted file mode 100644 index 78de624..0000000 --- a/modules/docker-registry.nix +++ /dev/null @@ -1,164 +0,0 @@ -{ config, pkgs, ... }: - -{ - ######################################## - # Docker Registry v2 - ######################################## - services.dockerRegistry = { - enable = true; - port = 5000; - listenAddress = "0.0.0.0"; - - # Enable image deletion and garbage collection - enableDelete = true; - enableGarbageCollect = true; - garbageCollectDates = "Sun 03:00"; - - # Storage location (root partition) - storagePath = "/var/lib/docker-registry"; - - # TLS configuration (for internal access) - extraConfig = { - http = { - tls = { - certificate = "/var/lib/docker-registry/certs/registry.crt"; - key = "/var/lib/docker-registry/certs/registry.key"; - }; - }; - }; - }; - - ######################################## - # Firewall - ######################################## - networking.firewall.allowedTCPPorts = [ 5000 ]; - - ######################################## - # Setup: directories, certificates, htpasswd - ######################################## - systemd.tmpfiles.rules = [ - "d /var/lib/docker-registry 0755 root root -" - "d /var/lib/docker-registry/certs 0755 root root -" - ]; - - # Generate self-signed certificate - systemd.services.docker-registry-setup = { - description = "Docker Registry initial setup"; - wantedBy = [ "multi-user.target" ]; - before = [ "docker-registry.service" ]; - path = with pkgs; [ openssl apacheHttpd ]; - - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - }; - - script = '' - # Create self-signed certificate if it doesn't exist - if [ ! -f /var/lib/docker-registry/certs/registry.crt ]; then - echo "Generating self-signed certificate for Docker Registry..." - ${pkgs.openssl}/bin/openssl req -x509 -newkey rsa:4096 -nodes \ - -keyout /var/lib/docker-registry/certs/registry.key \ - -out /var/lib/docker-registry/certs/registry.crt \ - -days 3650 \ - -subj "/CN=registry.home.lindenfelser.de" \ - -addext "subjectAltName=DNS:registry.home.lindenfelser.de,DNS:k8s-server,IP:10.202.82.7" - chmod 644 /var/lib/docker-registry/certs/registry.key - chmod 644 /var/lib/docker-registry/certs/registry.crt - echo "Certificate generated successfully" - fi - - # Ensure correct ownership - chown -R docker-registry:docker-registry /var/lib/docker-registry - ''; - }; - - ######################################## - # Storage Monitoring (80% threshold) - ######################################## - systemd.services.docker-registry-storage-check = { - description = "Check Docker Registry storage usage"; - path = with pkgs; [ coreutils util-linux ]; - - serviceConfig = { - Type = "oneshot"; - User = "root"; - }; - - script = '' - REGISTRY_PATH="/var/lib/docker-registry" - THRESHOLD=80 - - if [ ! -d "$REGISTRY_PATH" ]; then - echo "Registry path does not exist yet" - exit 0 - fi - - # Get disk usage percentage of the filesystem containing the registry - USAGE=$(df -h "$REGISTRY_PATH" | awk 'NR==2 {print $5}' | sed 's/%//') - REGISTRY_SIZE=$(du -sh "$REGISTRY_PATH" | cut -f1) - - echo "Docker Registry storage: $REGISTRY_SIZE (filesystem usage: $USAGE%)" - - if [ "$USAGE" -gt "$THRESHOLD" ]; then - echo "WARNING: Filesystem usage ($USAGE%) exceeds threshold ($THRESHOLD%)" - echo "Consider cleaning up old images or expanding storage" - fi - ''; - }; - - systemd.timers.docker-registry-storage-check = { - description = "Timer for Docker Registry storage check"; - wantedBy = [ "timers.target" ]; - - timerConfig = { - OnCalendar = "daily"; - Persistent = true; - }; - }; - - ######################################## - # Daily Storage Growth Tracking - ######################################## - systemd.services.docker-registry-growth-tracker = { - description = "Track Docker Registry storage growth"; - path = with pkgs; [ coreutils ]; - - serviceConfig = { - Type = "oneshot"; - User = "root"; - }; - - script = '' - REGISTRY_PATH="/var/lib/docker-registry" - LOG_FILE="/var/log/docker-registry-growth.log" - - if [ ! -d "$REGISTRY_PATH" ]; then - echo "Registry path does not exist yet" - exit 0 - fi - - TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S') - SIZE_BYTES=$(du -sb "$REGISTRY_PATH" | cut -f1) - SIZE_HUMAN=$(du -sh "$REGISTRY_PATH" | cut -f1) - - echo "$TIMESTAMP | Size: $SIZE_HUMAN ($SIZE_BYTES bytes)" >> "$LOG_FILE" - - # Keep only last 90 days of logs - if [ -f "$LOG_FILE" ]; then - tail -n 90 "$LOG_FILE" > "$LOG_FILE.tmp" - mv "$LOG_FILE.tmp" "$LOG_FILE" - fi - ''; - }; - - systemd.timers.docker-registry-growth-tracker = { - description = "Timer for Docker Registry growth tracking"; - wantedBy = [ "timers.target" ]; - - timerConfig = { - OnCalendar = "daily"; - Persistent = true; - }; - }; -} diff --git a/modules/gateway.nix b/modules/gateway.nix index 802f25a..3816068 100644 --- a/modules/gateway.nix +++ b/modules/gateway.nix @@ -42,20 +42,6 @@ reverse_proxy 10.202.82.6:3000 ''; }; - "registry.home.lindenfelser.de" = { - extraConfig = '' - @registry host registry.home.lindenfelser.de - basicauth @registry { - admin $2a$14$Ga5BCiHvtlfRjdnlI9bhseFnNZ8dwXsLz4t1FdSemA1mAUV/vA1oi - } - reverse_proxy @registry https://10.202.82.7:5000 { - transport http { - tls - tls_insecure_skip_verify - } - } - ''; - }; }; }; @@ -69,7 +55,6 @@ 80 # HTTP (Caddy) 443 # HTTPS (Caddy) 2222 # External SSH to Gitea - 6443 # Kubernetes API to k8s-server ]; networking.firewall.allowedUDPPorts = [ @@ -85,7 +70,6 @@ # Hairpin NAT for LAN clients hitting gateway:2222 so replies go back via gateway extraCommands = '' iptables -t nat -A POSTROUTING -p tcp -d 10.202.82.6 --dport 2222 -j MASQUERADE - iptables -t nat -A POSTROUTING -p tcp -d 10.202.82.7 --dport 6443 -j MASQUERADE ''; forwardPorts = [ { @@ -93,11 +77,6 @@ sourcePort = 2222; destination = "10.202.82.6:2222"; } - { - proto = "tcp"; - sourcePort = 6443; - destination = "10.202.82.7:6443"; - } ]; }; } \ No newline at end of file diff --git a/modules/kubernetes.nix b/modules/kubernetes.nix deleted file mode 100644 index c52c0d7..0000000 --- a/modules/kubernetes.nix +++ /dev/null @@ -1,49 +0,0 @@ -{ config, pkgs, ... }: - -{ - ######################################## - # k3s Single-Node (Traefik disabled) - ######################################## - services.k3s = { - enable = true; - role = "server"; - # Initialize single-server cluster and disable bundled Traefik ingress. - extraFlags = toString [ - "--cluster-init" - "--disable=traefik" - "--flannel-backend=vxlan" - "--tls-san=k8s.home.lindenfelser.de" - ]; - }; - - ######################################## - # Firewall for k3s - ######################################## - networking.firewall.enable = true; - networking.firewall.allowedTCPPorts = [ - 6443 # Kubernetes API - 10250 # Kubelet metrics - 5000 # Docker Registry - ]; - - networking.firewall.allowedUDPPorts = [ - 8472 # flannel VXLAN - ]; - - ######################################## - # Containerd registry configuration - ######################################## - environment.etc."rancher/k3s/registries.yaml" = { - text = '' - mirrors: - registry.home.lindenfelser.de: - endpoint: - - "https://10.202.82.7:5000" - configs: - "10.202.82.7:5000": - tls: - insecure_skip_verify: true - ''; - mode = "0644"; - }; -}