move pihole to kubernetes

fix freshrss admin password secret
This commit is contained in:
Pim Kunis 2024-03-28 23:05:05 +01:00
parent 8d04504c40
commit a7a3b1b722
5 changed files with 160 additions and 2 deletions

View file

@ -6,7 +6,6 @@
- {role: forgejo, tags: forgejo} - {role: forgejo, tags: forgejo}
- {role: hedgedoc, tags: hedgedoc} - {role: hedgedoc, tags: hedgedoc}
- {role: swarm_dashboard, tags: swarm_dashboard} - {role: swarm_dashboard, tags: swarm_dashboard}
- {role: pihole, tags: pihole}
- {role: nextcloud, tags: nextcloud} - {role: nextcloud, tags: nextcloud}
- {role: kitchenowl, tags: kitchenowl} - {role: kitchenowl, tags: kitchenowl}
- {role: paperless-ngx, tags: paperless-ngx} - {role: paperless-ngx, tags: paperless-ngx}

View file

@ -84,6 +84,12 @@ services:
- traefik.http.routers.syncthing.rule=Host(`sync.kun.is`) - traefik.http.routers.syncthing.rule=Host(`sync.kun.is`)
- traefik.http.routers.syncthing.tls=true - traefik.http.routers.syncthing.tls=true
- traefik.http.routers.syncthing.tls.certresolver=letsencrypt - traefik.http.routers.syncthing.tls.certresolver=letsencrypt
- traefik.http.routers.pihole.entrypoints=localsecure
- traefik.http.routers.pihole.service=k3s@file
- traefik.http.routers.pihole.rule=Host(`pihole.kun.is`)
- traefik.http.routers.pihole.tls=true
- traefik.http.routers.pihole.tls.certresolver=letsencrypt
volumes: volumes:
- type: bind - type: bind
source: /var/run/docker.sock source: /var/run/docker.sock

View file

@ -14,6 +14,7 @@
./radicale.nix ./radicale.nix
./syncthing.nix ./syncthing.nix
./nextcloud.nix ./nextcloud.nix
./pihole.nix
]; ];
kubernetes.kubeconfig = "~/.kube/config"; kubernetes.kubeconfig = "~/.kube/config";
kubenix.project = "home"; kubenix.project = "home";

View file

@ -8,7 +8,7 @@
}; };
# TODO: encrypt this with sops and commit to git repo. # TODO: encrypt this with sops and commit to git repo.
secrets.freshrss.stringData.adminPassword = "ref+file:///home/pim/.config/home/vals.yaml"; secrets.freshrss.stringData.adminPassword = "ref+file:///home/pim/.config/home/vals.yaml#/freshrss/password";
deployments.freshrss = { deployments.freshrss = {
metadata.labels.app = "freshrss"; metadata.labels.app = "freshrss";

View file

@ -0,0 +1,152 @@
{
kubernetes.resources = {
configMaps.pihole.data = {
TZ = "Europe/Amsterdam";
PIHOLE_DNS_ = "192.168.40.1";
};
secrets.pihole.stringData.webPassword = "ref+file:///home/pim/.config/home/vals.yaml#/pihole/password";
deployments.pihole = {
metadata.labels.app = "pihole";
spec = {
selector.matchLabels.app = "pihole";
template = {
metadata.labels.app = "pihole";
spec = {
containers.pihole = {
image = "pihole/pihole:latest";
envFrom = [{ configMapRef.name = "pihole"; }];
ports = [
{
containerPort = 80;
protocol = "TCP";
}
{
containerPort = 53;
protocol = "UDP";
}
];
env = [{
# TODO: simplify this by using env.WEBPASSWORD?
name = "WEBPASSWORD";
valueFrom.secretKeyRef = {
name = "pihole";
key = "webPassword";
};
}];
volumeMounts = [
{
name = "data";
mountPath = "/etc/pihole";
}
{
name = "dnsmasq";
mountPath = "/etc/dnsmasq.d";
}
];
};
volumes = [
{
name = "data";
persistentVolumeClaim.claimName = "pihole-data";
}
{
name = "dnsmasq";
persistentVolumeClaim.claimName = "pihole-dnsmasq";
}
];
};
};
};
};
persistentVolumes = {
pihole-data.spec = {
capacity.storage = "1Mi";
accessModes = [ "ReadWriteMany" ];
nfs = {
server = "lewis.hyp";
path = "/mnt/data/nfs/pihole/data";
};
};
pihole-dnsmasq.spec = {
capacity.storage = "1Mi";
accessModes = [ "ReadWriteMany" ];
nfs = {
server = "lewis.hyp";
path = "/mnt/data/nfs/pihole/dnsmasq";
};
};
};
persistentVolumeClaims = {
pihole-data.spec = {
accessModes = [ "ReadWriteMany" ];
storageClassName = "";
resources.requests.storage = "1Mi";
volumeName = "pihole-data";
};
pihole-dnsmasq.spec = {
accessModes = [ "ReadWriteMany" ];
storageClassName = "";
resources.requests.storage = "1Mi";
volumeName = "pihole-dnsmasq";
};
};
services = {
pihole-web.spec = {
selector.app = "pihole";
ports = [{
protocol = "TCP";
port = 80;
targetPort = 80;
}];
};
pihole-dns.spec = {
type = "LoadBalancer";
loadBalancerIP = "192.168.30.131";
selector.app = "pihole";
ports = [{
protocol = "UDP";
port = 53;
targetPort = 53;
}];
};
};
ingresses.pihole-web.spec = {
ingressClassName = "traefik";
rules = [{
host = "pihole.kun.is";
http.paths = [{
path = "/";
pathType = "Prefix";
backend.service = {
name = "pihole-web";
port.number = 80;
};
}];
}];
};
};
}