danlin/infra-nix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove k8s-server host

Browse Source 
Drop k8s-server from flake, Makefile targets, modules
(kubernetes.nix, docker-registry.nix), install script and
hardware config. Remove related registry vhost, port 6443
and NAT rules from gateway.nix. Drop K8s-Server section
and dangling markdown wrapper from README.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Daniel Lindenfelser
2026-05-23 21:29:46 +02:00
parent 42bb1c8092
commit d9a1dde5a5
10 changed files with 1 additions and 603 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+1 -46
View File
@@ -1,9 +1,8 @@
.PHONY: help deploy deploy-gateway deploy-fileserver deploy-k8s-server install-gateway install-fileserver install-k8s-server fetch-hwconfig-gateway fetch-hwconfig-fileserver fetch-hwconfig-k8s-server upgrade-containers all
.PHONY: help deploy deploy-gateway deploy-fileserver install-gateway install-fileserver fetch-hwconfig-gateway fetch-hwconfig-fileserver upgrade-containers all
# Hosts
GATEWAY_HOST := danlin@10.202.82.3
FILESERVER_HOST := danlin@10.202.82.6
K8S_HOST := danlin@10.202.82.7
# Default target
all: deploy
@@ -15,30 +14,16 @@ help:
@echo " make deploy Deploy to gateway and fileserver"
@echo " make deploy-gateway Deploy to gateway only"
@echo " make deploy-fileserver Deploy to fileserver only"
@echo " make deploy-k8s-server Deploy to k8s-server only"
@echo " make upgrade-containers Pull latest images and restart containers on fileserver"
@echo " make install-gateway Run installation script for gateway"
@echo " make install-fileserver Run installation script for fileserver"
@echo " make install-k8s-server Run installation script for k8s-server"
@echo " make fetch-hwconfig-gateway Fetch hardware config from gateway"
@echo " make fetch-hwconfig-fileserver Fetch hardware config from fileserver"
@echo " make fetch-hwconfig-k8s-server Fetch hardware config from k8s-server"
@echo ""
# Deployment targets
deploy: deploy-gateway deploy-fileserver
deploy-k8s-server:
@echo "======================================"
@echo "Deploying k8s-server..."
@echo "======================================"
@echo "Syncing files to k8s-server..."
rsync -av --delete --exclude '.git' ./ $(K8S_HOST):/tmp/infra-nix/
@echo "Building and switching on k8s-server..."
ssh -tt $(K8S_HOST) "cd /tmp/infra-nix && sudo nixos-rebuild switch --flake '.#k8s-server'"
@echo "✓ k8s-server deployed successfully"
@echo ""
deploy-gateway:
@echo "======================================"
@echo "Deploying gateway..."
@@ -118,28 +103,6 @@ install-fileserver:
echo "✓ Update hosts/fileserver/configuration.nix with the correct IP if needed"
@echo ""
install-k8s-server:
@echo "======================================"
@echo "Installing k8s-server..."
@echo "======================================"
@read -p "Enter k8s-server IP address: " IP; \
if [ -z "$$IP" ]; then \
echo "Error: IP address required"; \
exit 1; \
fi; \
echo "Copying install script to $$IP..."; \
scp install/install-k8s-server.sh root@$$IP:/tmp/; \
echo "Connecting to $$IP..."; \
ssh root@$$IP "bash /tmp/install-k8s-server.sh"; \
echo ""; \
echo "Fetching hardware config from $$IP..."; \
scp root@$$IP:/mnt/etc/nixos/hardware-configuration.nix hosts/k8s-server/hardware-configuration.nix; \
echo "✓ Hardware config saved to hosts/k8s-server/hardware-configuration.nix"; \
scp root@$$IP:/mnt/etc/nixos/configuration.nix hosts/k8s-server/configuration.installer.nix; \
echo "✓ Installer config saved to hosts/k8s-server/configuration.installer.nix"; \
echo "✓ Update hosts/k8s-server/configuration.nix with the correct IP if needed"
@echo ""
# Fetch hardware configuration targets
fetch-hwconfig-gateway:
@echo "======================================"
@@ -156,11 +119,3 @@ fetch-hwconfig-fileserver:
scp $(FILESERVER_HOST):/etc/nixos/hardware-configuration.nix hosts/fileserver/
@echo "✓ Hardware config saved to hosts/fileserver/hardware-configuration.nix"
@echo ""
fetch-hwconfig-k8s-server:
@echo "======================================"
@echo "Fetching hardware config from k8s-server..."
@echo "======================================"
scp $(K8S_HOST):/etc/nixos/hardware-configuration.nix hosts/k8s-server/
@echo "✓ Hardware config saved to hosts/k8s-server/hardware-configuration.nix"
@echo ""
README.md
-114
View File
@@ -1,4 +1,3 @@
````markdown
# infra-nix: NixOS Infrastructure
Dieses Repository enthält die deklarative NixOS-Infrastruktur für:
@@ -117,119 +116,6 @@ Access examples:
---
## K8s-Server: Docker Registry
The k8s-server runs a private Docker Registry v2 with self-signed TLS certificate. Authentication is handled by Caddy for external access.
**Access:**
- External URL: `https://registry.home.lindenfelser.de` (authenticated via Caddy)
- Internal URL: `https://10.202.82.7:5000` (direct, no auth - K8s pods)
- Default credentials: `admin` / `changeme` (Caddy basic auth)
- Storage: `/var/lib/docker-registry` (root partition)
### 1) Login from external machine
```bash
# Login to registry
docker login registry.home.lindenfelser.de
# Username: admin
# Password: changeme
```
### 2) Push an image
```bash
# Tag your image
docker tag myapp:latest registry.home.lindenfelser.de/myapp:latest
# Push to registry
docker push registry.home.lindenfelser.de/myapp:latest
```
### 3) Pull from Kubernetes pods
The k8s cluster is configured to authenticate automatically. Create a deployment:
```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: myapp
spec:
replicas: 1
selector:
matchLabels:
app: myapp
template:
metadata:
labels:
app: myapp
spec:
containers:
- name: myapp
image: registry.home.lindenfelser.de/myapp:latest
```
### 4) Change registry password
Authentication is handled by Caddy. Generate new password hash and update:
```bash
# Generate new password hash locally
caddy hash-password --plaintext 'yournewpassword'
```
Then update the hash in [modules/gateway.nix](modules/gateway.nix) in the `basicauth` section and redeploy:
```bash
make deploy-gateway
```
### 5) Monitor storage usage
Check daily storage logs:
```bash
# View growth tracking
sudo journalctl -u docker-registry-growth-tracker
# View last 30 days of size tracking
sudo tail -n 30 /var/log/docker-registry-growth.log
# Check current usage
sudo du -sh /var/lib/docker-registry
df -h /
```
### 6) Manual garbage collection
Garbage collection runs automatically every Sunday at 03:00. To run manually:
```bash
sudo systemctl start docker-registry-garbage-collect
sudo journalctl -u docker-registry-garbage-collect -e
```
### 7) List images in registry
```bash
# List all repositories
curl -u admin:changeme https://registry.home.lindenfelser.de/v2/_catalog
# List tags for a specific image
curl -u admin:changeme https://registry.home.lindenfelser.de/v2/myapp/tags/list
```
### Troubleshooting
- **TLS certificate errors**: Registry uses self-signed certificate. External Docker clients need to add to insecure registries or install the cert
- **Authentication fails**: Verify Caddy basicauth configuration in [modules/gateway.nix](modules/gateway.nix). K8s pods access registry directly without auth.
- **Storage full**: Check root partition usage with `df -h /` and run garbage collection
- **K8s pods can't pull**: Verify `registries.yaml` points to internal registry (10.202.82.7:5000) and restart k3s: `sudo systemctl restart k3s`
````
---
## rclone (Google Drive)
The system has `rclone` installed and a systemd job to sync `/data` to a remote named `gdrive`:
flake.nix
-7
View File
@@ -24,13 +24,6 @@
./hosts/gateway/configuration.nix
];
};
k8s-server = lib.nixosSystem {
inherit system;
modules = [
./hosts/k8s-server/configuration.nix
];
};
};
};
}
hosts/k8s-server/configuration.installer.nix
-49
View File
@@ -1,49 +0,0 @@
{ config, pkgs, ... }:
{
imports = [ ./hardware-configuration.nix ];
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
security.sudo.wheelNeedsPassword = false;
networking.hostName = "k8s-server";
networking.useDHCP = false;
networking.interfaces.ens18.ipv4.addresses = [
{
address = "10.202.82.7";
prefixLength = 24;
}
];
networking.defaultGateway = "10.202.82.1";
networking.nameservers = [ "10.202.82.3" "10.202.82.4" ];
time.timeZone = "Europe/Berlin";
services.openssh.enable = true;
networking.firewall = {
enable = true;
allowedTCPPorts = [ 22 6443 ];
allowedUDPPorts = [ 8472 ];
};
users.users.danlin = {
isNormalUser = true;
extraGroups = [ "wheel" ];
initialPassword = "changeme";
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAzAW0DTpdQJaQOWDC3YJCmPc/veBQ0R3e1q9nOlWgxC danlin@MacBook-Pro-von-Daniel.fritz.box"
];
};
users.users.root.initialPassword = "root";
environment.systemPackages = with pkgs; [
vim
htop
];
system.stateVersion = "25.05";
}
hosts/k8s-server/configuration.nix
-24
View File
@@ -1,24 +0,0 @@
{ config, pkgs, ... }:
{
imports = [
./hardware-configuration.nix
../../modules/common.nix
../../modules/kubernetes.nix
../../modules/docker-registry.nix
];
networking.hostName = "k8s-server";
networking.useDHCP = false;
networking.interfaces.ens18.ipv4.addresses = [
{
address = "10.202.82.7";
prefixLength = 24;
}
];
networking.defaultGateway = "10.202.82.1";
networking.nameservers = [ "10.202.82.3" "10.202.82.4" ];
system.stateVersion = "25.05";
}
hosts/k8s-server/hardware-configuration.nix
-37
View File
@@ -1,37 +0,0 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/839f8ac5-3391-4bc2-bf64-9df42ae6613b";
fsType = "ext4";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/D25C-46DC";
fsType = "vfat";
options = [ "fmask=0022" "dmask=0022" ];
};
swapDevices = [ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.ens18.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
}
install/install-k8s-server.sh
-92
View File
@@ -1,92 +0,0 @@
#!/usr/bin/env bash
set -euo pipefail
### CONFIG ###
OS_DISK=/dev/sda
HOSTNAME=k8s-server
STATE_VERSION="25.05"
TIMEZONE="Europe/Berlin"
USERNAME="danlin"
PASSWORD="changeme"
ROOT_PASS="root"
echo ">>> WARNUNG: ALLE DATEN auf ${OS_DISK} werden GELÖSCHT!"
echo ">>> Warte 5 Sekunden... (STRG+C zum Abbrechen)"
sleep 5
echo ">>> Partitioniere OS-Disk (${OS_DISK}) für EFI + ROOT..."
parted "${OS_DISK}" --script mklabel gpt
parted "${OS_DISK}" --script mkpart ESP fat32 1MiB 513MiB
parted "${OS_DISK}" --script set 1 esp on
parted "${OS_DISK}" --script mkpart primary ext4 513MiB 100%
echo ">>> Formatiere OS-Partitionen..."
mkfs.fat -F32 "${OS_DISK}1"
mkfs.ext4 -F "${OS_DISK}2"
echo ">>> Mounten..."
mount "${OS_DISK}2" /mnt
mkdir -p /mnt/boot
mount "${OS_DISK}1" /mnt/boot
echo ">>> Generiere NixOS-Config..."
nixos-generate-config --root /mnt
CONFIG=/mnt/etc/nixos/configuration.nix
cat > "${CONFIG}" <<EOF
{ config, pkgs, ... }:
{
imports = [ ./hardware-configuration.nix ];
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
security.sudo.wheelNeedsPassword = false;
networking.hostName = "${HOSTNAME}";
networking.useDHCP = false;
networking.interfaces.ens18.ipv4.addresses = [
{
address = "10.202.82.7";
prefixLength = 24;
}
];
networking.defaultGateway = "10.202.82.1";
networking.nameservers = [ "10.202.82.3" "10.202.82.4" ];
time.timeZone = "${TIMEZONE}";
services.openssh.enable = true;
networking.firewall = {
enable = true;
allowedTCPPorts = [ 22 6443 ];
allowedUDPPorts = [ 8472 ];
};
users.users.${USERNAME} = {
isNormalUser = true;
extraGroups = [ "wheel" ];
initialPassword = "${PASSWORD}";
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAzAW0DTpdQJaQOWDC3YJCmPc/veBQ0R3e1q9nOlWgxC danlin@MacBook-Pro-von-Daniel.fritz.box"
];
};
users.users.root.initialPassword = "${ROOT_PASS}";
environment.systemPackages = with pkgs; [
vim
htop
];
system.stateVersion = "${STATE_VERSION}";
}
EOF
echo ">>> Starte nixos-install..."
nixos-install
echo ">>> Fertig. Jetzt reboot ausführen."
modules/docker-registry.nix
-164
View File
@@ -1,164 +0,0 @@
{ config, pkgs, ... }:
{
########################################
# Docker Registry v2
########################################
services.dockerRegistry = {
enable = true;
port = 5000;
listenAddress = "0.0.0.0";
# Enable image deletion and garbage collection
enableDelete = true;
enableGarbageCollect = true;
garbageCollectDates = "Sun 03:00";
# Storage location (root partition)
storagePath = "/var/lib/docker-registry";
# TLS configuration (for internal access)
extraConfig = {
http = {
tls = {
certificate = "/var/lib/docker-registry/certs/registry.crt";
key = "/var/lib/docker-registry/certs/registry.key";
};
};
};
};
########################################
# Firewall
########################################
networking.firewall.allowedTCPPorts = [ 5000 ];
########################################
# Setup: directories, certificates, htpasswd
########################################
systemd.tmpfiles.rules = [
"d /var/lib/docker-registry 0755 root root -"
"d /var/lib/docker-registry/certs 0755 root root -"
];
# Generate self-signed certificate
systemd.services.docker-registry-setup = {
description = "Docker Registry initial setup";
wantedBy = [ "multi-user.target" ];
before = [ "docker-registry.service" ];
path = with pkgs; [ openssl apacheHttpd ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = ''
# Create self-signed certificate if it doesn't exist
if [ ! -f /var/lib/docker-registry/certs/registry.crt ]; then
echo "Generating self-signed certificate for Docker Registry..."
${pkgs.openssl}/bin/openssl req -x509 -newkey rsa:4096 -nodes \
-keyout /var/lib/docker-registry/certs/registry.key \
-out /var/lib/docker-registry/certs/registry.crt \
-days 3650 \
-subj "/CN=registry.home.lindenfelser.de" \
-addext "subjectAltName=DNS:registry.home.lindenfelser.de,DNS:k8s-server,IP:10.202.82.7"
chmod 644 /var/lib/docker-registry/certs/registry.key
chmod 644 /var/lib/docker-registry/certs/registry.crt
echo "Certificate generated successfully"
fi
# Ensure correct ownership
chown -R docker-registry:docker-registry /var/lib/docker-registry
'';
};
########################################
# Storage Monitoring (80% threshold)
########################################
systemd.services.docker-registry-storage-check = {
description = "Check Docker Registry storage usage";
path = with pkgs; [ coreutils util-linux ];
serviceConfig = {
Type = "oneshot";
User = "root";
};
script = ''
REGISTRY_PATH="/var/lib/docker-registry"
THRESHOLD=80
if [ ! -d "$REGISTRY_PATH" ]; then
echo "Registry path does not exist yet"
exit 0
fi
# Get disk usage percentage of the filesystem containing the registry
USAGE=$(df -h "$REGISTRY_PATH" | awk 'NR==2 {print $5}' | sed 's/%//')
REGISTRY_SIZE=$(du -sh "$REGISTRY_PATH" | cut -f1)
echo "Docker Registry storage: $REGISTRY_SIZE (filesystem usage: $USAGE%)"
if [ "$USAGE" -gt "$THRESHOLD" ]; then
echo "WARNING: Filesystem usage ($USAGE%) exceeds threshold ($THRESHOLD%)"
echo "Consider cleaning up old images or expanding storage"
fi
'';
};
systemd.timers.docker-registry-storage-check = {
description = "Timer for Docker Registry storage check";
wantedBy = [ "timers.target" ];
timerConfig = {
OnCalendar = "daily";
Persistent = true;
};
};
########################################
# Daily Storage Growth Tracking
########################################
systemd.services.docker-registry-growth-tracker = {
description = "Track Docker Registry storage growth";
path = with pkgs; [ coreutils ];
serviceConfig = {
Type = "oneshot";
User = "root";
};
script = ''
REGISTRY_PATH="/var/lib/docker-registry"
LOG_FILE="/var/log/docker-registry-growth.log"
if [ ! -d "$REGISTRY_PATH" ]; then
echo "Registry path does not exist yet"
exit 0
fi
TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
SIZE_BYTES=$(du -sb "$REGISTRY_PATH" | cut -f1)
SIZE_HUMAN=$(du -sh "$REGISTRY_PATH" | cut -f1)
echo "$TIMESTAMP | Size: $SIZE_HUMAN ($SIZE_BYTES bytes)" >> "$LOG_FILE"
# Keep only last 90 days of logs
if [ -f "$LOG_FILE" ]; then
tail -n 90 "$LOG_FILE" > "$LOG_FILE.tmp"
mv "$LOG_FILE.tmp" "$LOG_FILE"
fi
'';
};
systemd.timers.docker-registry-growth-tracker = {
description = "Timer for Docker Registry growth tracking";
wantedBy = [ "timers.target" ];
timerConfig = {
OnCalendar = "daily";
Persistent = true;
};
};
}
modules/gateway.nix
-21
View File
@@ -42,20 +42,6 @@
reverse_proxy 10.202.82.6:3000
'';
};
"registry.home.lindenfelser.de" = {
extraConfig = ''
@registry host registry.home.lindenfelser.de
basicauth @registry {
admin $2a$14$Ga5BCiHvtlfRjdnlI9bhseFnNZ8dwXsLz4t1FdSemA1mAUV/vA1oi
}
reverse_proxy @registry https://10.202.82.7:5000 {
transport http {
tls
tls_insecure_skip_verify
}
}
'';
};
};
};
@@ -69,7 +55,6 @@
80 # HTTP (Caddy)
443 # HTTPS (Caddy)
2222 # External SSH to Gitea
6443 # Kubernetes API to k8s-server
];
networking.firewall.allowedUDPPorts = [
@@ -85,7 +70,6 @@
# Hairpin NAT for LAN clients hitting gateway:2222 so replies go back via gateway
extraCommands = ''
iptables -t nat -A POSTROUTING -p tcp -d 10.202.82.6 --dport 2222 -j MASQUERADE
iptables -t nat -A POSTROUTING -p tcp -d 10.202.82.7 --dport 6443 -j MASQUERADE
'';
forwardPorts = [
{
@@ -93,11 +77,6 @@
sourcePort = 2222;
destination = "10.202.82.6:2222";
}
{
proto = "tcp";
sourcePort = 6443;
destination = "10.202.82.7:6443";
}
];
};
}
modules/kubernetes.nix
-49
View File
@@ -1,49 +0,0 @@
{ config, pkgs, ... }:
{
########################################
# k3s Single-Node (Traefik disabled)
########################################
services.k3s = {
enable = true;
role = "server";
# Initialize single-server cluster and disable bundled Traefik ingress.
extraFlags = toString [
"--cluster-init"
"--disable=traefik"
"--flannel-backend=vxlan"
"--tls-san=k8s.home.lindenfelser.de"
];
};
########################################
# Firewall for k3s
########################################
networking.firewall.enable = true;
networking.firewall.allowedTCPPorts = [
6443 # Kubernetes API
10250 # Kubelet metrics
5000 # Docker Registry
];
networking.firewall.allowedUDPPorts = [
8472 # flannel VXLAN
];
########################################
# Containerd registry configuration
########################################
environment.etc."rancher/k3s/registries.yaml" = {
text = ''
mirrors:
registry.home.lindenfelser.de:
endpoint:
- "https://10.202.82.7:5000"
configs:
"10.202.82.7:5000":
tls:
insecure_skip_verify: true
'';
mode = "0644";
};
}