home/nixos-servers
home/nixos-servers
Archived
2
0
Fork 0
Code Issues 8 Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch 'master' of ssh://git.kun.is:56287/home/nixos-servers

Browse source
This commit is contained in:
Niels Kunis 2024-03-26 20:31:35 +01:00
commit 6aec465750
10 changed files with 452 additions and 76 deletions
Download patch file Download diff file Expand all files Collapse all files

62
nix/flake/kubenix.nix
View file

@ -1,62 +0,0 @@
{ self, flake-utils, kubenix, ... }: flake-utils.lib.eachDefaultSystem
(system: {
kubenix = kubenix.packages.${system}.default.override {
specialArgs.flake = self;
module = { kubenix, ... }: {
imports = [ kubenix.modules.k8s ];
kubernetes.kubeconfig = "~/.kube/config";
kubenix.project = "home";
kubernetes.resources = {
deployments.cyberchef.spec = {
replicas = 3;
selector.matchLabels.app = "cyberchef";
template = {
metadata.labels.app = "cyberchef";
spec = {
containers.cyberchef = {
image = "mpepping/cyberchef";
ports = [{
containerPort = 8000;
protocol = "TCP";
}];
};
};
};
};
services.cyberchef.spec = {
selector.app = "cyberchef";
ports = [{
protocol = "TCP";
port = 80;
targetPort = 8000;
}];
};
ingresses.cyberchef.spec = {
ingressClassName = "traefik";
rules = [{
host = "cyberchef.kun.is";
http.paths = [{
path = "/";
pathType = "Prefix";
backend.service = {
name = "cyberchef";
port.number = 80;
};
}];
}];
};
};
};
};
})

114
nix/flake/kubenix/default.nix Normal file
View file

@ -0,0 +1,114 @@
{ self, flake-utils, kubenix, nixhelm, ... }: flake-utils.lib.eachDefaultSystem
(system: {
kubenix = kubenix.packages.${system}.default.override {
specialArgs.flake = self;
module = { kubenix, ... }: {
imports = [
kubenix.modules.k8s
kubenix.modules.helm
# ./freshrss.nix
];
kubernetes.kubeconfig = "~/.kube/config";
kubenix.project = "home";
kubernetes = {
# namespace = "kubenix";
customTypes = {
# HACK: These are dummy custom types.
# This is needed, because the CRDs imported as a chart are not available as Nix modules.
# There is no nix-based validation on resources defined using these types!
# See: https://github.com/hall/kubenix/issues/34
ipAddressPool = {
attrName = "ipAddressPools";
group = "metallb.io";
version = "v1beta1";
kind = "IPAddressPool";
};
l2Advertisement = {
attrName = "l2Advertisements";
group = "metallb.io";
version = "v1beta1";
kind = "L2Advertisement";
};
};
resources = {
# namespaces = {
# kubenix = { };
# metallb-system.metadata.labels = {
# "pod-security.kubernetes.io/enforce" = "privileged";
# "pod-security.kubernetes.io/audit" = "privileged";
# "pod-security.kubernetes.io/warn" = "privileged";
# };
# };
deployments.cyberchef.spec = {
replicas = 3;
selector.matchLabels.app = "cyberchef";
template = {
metadata.labels.app = "cyberchef";
spec = {
containers.cyberchef = {
image = "mpepping/cyberchef";
ports = [{
containerPort = 8000;
protocol = "TCP";
}];
};
};
};
};
services.cyberchef.spec = {
selector.app = "cyberchef";
ports = [{
protocol = "TCP";
port = 80;
targetPort = 8000;
}];
};
ingresses.cyberchef.spec = {
ingressClassName = "traefik";
rules = [{
host = "cyberchef.kun.is";
http.paths = [{
path = "/";
pathType = "Prefix";
backend.service = {
name = "cyberchef";
port.number = 80;
};
}];
}];
};
ipAddressPools.main = {
# metadata.namespace = "metallb-system";
spec.addresses = [ "192.168.40.100-192.168.40.254" ];
};
# l2Advertisements.main.metadata.namespace = "metallb-system";
l2Advertisements.main.metadata = { };
};
helm.releases.metallb = {
chart = nixhelm.chartsDerivations.${system}.metallb.metallb;
# namespace = "metallb-system";
includeCRDs = true;
};
};
};
};
})

97
nix/flake/kubenix/freshrss.nix Normal file
View file

@ -0,0 +1,97 @@
{
kubernetes.resources = {
configMaps.freshrss.data = {
TZ = "Europe/Amsterdam";
CRON_MIN = "2,32";
ADMIN_EMAIL = "pim@kunis.nl";
PUBLISHED_PORT = "443";
};
secrets.freshrss.stringData.adminPassword = "ref+file:///home/pim/.config/home/vals.yaml";
persistentVolumeClaims.freshrss.spec = {
accessModes = [ "ReadWriteOnce" ];
storageClassName = "local-path";
resources.requests.storage = "1Mi";
};
deployments.freshrss = {
metadata.labels.app = "freshrss";
spec = {
selector.matchLabels.app = "freshrss";
template = {
metadata.labels.app = "freshrss";
spec = {
containers.freshrss = {
image = "freshrss/freshrss:edge";
ports = [{
containerPort = 80;
protocol = "TCP";
}];
envFrom = [{ configMapRef.name = "freshrss"; }];
env = [
{
name = "ADMIN_PASSWORD";
valueFrom.secretKeyRef = {
name = "freshrss";
key = "adminPassword";
};
}
{
name = "ADMIN_API_PASSWORD";
valueFrom.secretKeyRef = {
name = "freshrss";
key = "adminPassword";
};
}
];
volumeMounts = [{
name = "data";
mountPath = "/var/www/FreshRSS/data";
}];
};
volumes = [{
name = "data";
persistentVolumeClaim.claimName = "freshrss";
}];
};
};
};
};
services.freshrss.spec = {
selector.app = "freshrss";
ports = [{
protocol = "TCP";
port = 80;
targetPort = 80;
}];
};
ingresses.freshrss.spec = {
ingressClassName = "traefik";
rules = [{
host = "freshrss.k3s.kun.is";
http.paths = [{
path = "/";
pathType = "Prefix";
backend.service = {
name = "freshrss";
port.number = 80;
};
}];
}];
};
};
}

4
nix/modules/k3s/default.nix
View file

@ -20,7 +20,7 @@ in {
services.k3s = {
enable = true;
role = "server";
extraFlags = "--tls-san ${config.networking.fqdn} --data-dir ${config.lab.storage.dataMountPoint}/k3s --disable servicelb";
extraFlags = "--tls-san ${config.networking.fqdn} --disable servicelb";
};
system.activationScripts.k3s-bootstrap.text =
@ -30,7 +30,7 @@ in {
}).config.kubernetes.result;
in
''
ln -sf ${k3sBootstrapFile} ${config.lab.storage.dataMountPoint}/k3s/server/manifests/k3s-bootstrap.json
ln -sf ${k3sBootstrapFile} /var/lib/rancher/k3s/server/manifests/k3s-bootstrap.json
'';
};
}