danlin/infra-nix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove k8s-server host

Browse Source 
Drop k8s-server from flake, Makefile targets, modules
(kubernetes.nix, docker-registry.nix), install script and
hardware config. Remove related registry vhost, port 6443
and NAT rules from gateway.nix. Drop K8s-Server section
and dangling markdown wrapper from README.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Daniel Lindenfelser
2026-05-23 21:29:46 +02:00
parent 42bb1c8092
commit d9a1dde5a5
10 changed files with 1 additions and 603 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
-114
View File
@@ -1,4 +1,3 @@
````markdown
# infra-nix: NixOS Infrastructure
Dieses Repository enthält die deklarative NixOS-Infrastruktur für:
@@ -117,119 +116,6 @@ Access examples:
---
## K8s-Server: Docker Registry
The k8s-server runs a private Docker Registry v2 with self-signed TLS certificate. Authentication is handled by Caddy for external access.
**Access:**
- External URL: `https://registry.home.lindenfelser.de` (authenticated via Caddy)
- Internal URL: `https://10.202.82.7:5000` (direct, no auth - K8s pods)
- Default credentials: `admin` / `changeme` (Caddy basic auth)
- Storage: `/var/lib/docker-registry` (root partition)
### 1) Login from external machine
```bash
# Login to registry
docker login registry.home.lindenfelser.de
# Username: admin
# Password: changeme
```
### 2) Push an image
```bash
# Tag your image
docker tag myapp:latest registry.home.lindenfelser.de/myapp:latest
# Push to registry
docker push registry.home.lindenfelser.de/myapp:latest
```
### 3) Pull from Kubernetes pods
The k8s cluster is configured to authenticate automatically. Create a deployment:
```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: myapp
spec:
replicas: 1
selector:
matchLabels:
app: myapp
template:
metadata:
labels:
app: myapp
spec:
containers:
- name: myapp
image: registry.home.lindenfelser.de/myapp:latest
```
### 4) Change registry password
Authentication is handled by Caddy. Generate new password hash and update:
```bash
# Generate new password hash locally
caddy hash-password --plaintext 'yournewpassword'
```
Then update the hash in [modules/gateway.nix](modules/gateway.nix) in the `basicauth` section and redeploy:
```bash
make deploy-gateway
```
### 5) Monitor storage usage
Check daily storage logs:
```bash
# View growth tracking
sudo journalctl -u docker-registry-growth-tracker
# View last 30 days of size tracking
sudo tail -n 30 /var/log/docker-registry-growth.log
# Check current usage
sudo du -sh /var/lib/docker-registry
df -h /
```
### 6) Manual garbage collection
Garbage collection runs automatically every Sunday at 03:00. To run manually:
```bash
sudo systemctl start docker-registry-garbage-collect
sudo journalctl -u docker-registry-garbage-collect -e
```
### 7) List images in registry
```bash
# List all repositories
curl -u admin:changeme https://registry.home.lindenfelser.de/v2/_catalog
# List tags for a specific image
curl -u admin:changeme https://registry.home.lindenfelser.de/v2/myapp/tags/list
```
### Troubleshooting
- **TLS certificate errors**: Registry uses self-signed certificate. External Docker clients need to add to insecure registries or install the cert
- **Authentication fails**: Verify Caddy basicauth configuration in [modules/gateway.nix](modules/gateway.nix). K8s pods access registry directly without auth.
- **Storage full**: Check root partition usage with `df -h /` and run garbage collection
- **K8s pods can't pull**: Verify `registries.yaml` points to internal registry (10.202.82.7:5000) and restart k3s: `sudo systemctl restart k3s`
````
---
## rclone (Google Drive)
The system has `rclone` installed and a systemd job to sync `/data` to a remote named `gdrive`: