j00lz/nixos-configs
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Add k8s configs to the repo

Browse source 
Also add the remaining needed websites to the repo
This commit is contained in:
Julius 2021-11-14 16:33:00 +01:00
parent 903f9917b3
commit 0dc227fc5f
Signed by: j00lz
GPG key ID: AF241B0AA237BBA2
14 changed files with 592 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
.gitattributes vendored
View file

@ -1 +1,2 @@
secrets.nix filter=git-crypt diff=git-crypt
secrets.nix filter=git-crypt diff=git-crypt
secrets.yml filter=git-crypt diff=git-crypt

23
hosts/k3s/configuration.nix
View file

@ -39,18 +39,15 @@
systemd.services.k3s.path = [ pkgs.gnugrep pkgs.utillinux ];
# Enable k3s as a master node
# services.k3s = {
# enable = true;
# role = "server";
services.k3s = {
enable = true;
role = "server";
extraFlags = builtins.toString [
"--data-dir=/var/lib/k3s" # Set data dir to var lib
"--cluster-init" # Enable embedded etcd
"--cluster-cidr=10.69.0.0/16" # the default of 10.42.0.0/16 clashes with my own network
];
};
# extraFlags = builtins.toString [
# "--data-dir=/var/lib/k3s" # Set data dir to var lib
# "--cluster-init" # Enable embedded etcd
# "--disable=servicelb" # disable servicelb
# "--no-deploy=traefik" # we want to configure traefik ourselves (or use nginx instead)
# "--cluster-cidr=10.69.0.0/16" # the default of 10.42.0.0/16 clashes with my own network
# ];
# };
virtualisation.docker.enable = true;
users.users.jdejeu.extraGroups = [ "docker" ];
}

7
hosts/nginx/configuration.nix
View file

@ -8,7 +8,7 @@ let
proxyWebsockets = true;
};
};
k8s_proxy = proxy "https://k8s-1.voidlocal:443/";
k8s_proxy = proxy "http://10.42.20.5:80/";
in {
imports = [
# Import common config
@ -44,7 +44,10 @@ in {
virtualHosts."git.voidcorp.nl" = proxy "http://gitea.voidlocal:3000/";
virtualHosts."galerievanslagmaat.nl" = proxy "http://10.42.0.124:5667/";
virtualHosts."galerievanslagmaat.nl" = k8s_proxy;
virtualHosts."staging.galerievanslagmaat.nl" = k8s_proxy;
virtualHosts."groenehartansichtkaarten.nl" = k8s_proxy;
virtualHosts."drone.voidcorp.nl" = k8s_proxy;
virtualHosts."vaultwarden.voidcorp.nl" = proxy "http://10.42.20.4:8000/";

9
hosts/registry/configuration.nix
View file

@ -32,6 +32,15 @@ in {
realm = "Voidcorp Registry";
path = "/etc/htpasswd";
};
notifications.endpoints = [{
name = "keel";
url = "http://10.42.20.5:9300/v1/webhooks/registry";
timeout = "500ms";
treshold = 5;
backoff = "1s";
}];
};
};
}

55
k8s/ansichtkaarten/master.yml Normal file
View file

@ -0,0 +1,55 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: ansichtkaarten-deployment
labels:
app: ansichtkaarten-deployment
keel.sh/policy: force
keel.sh/match-tag: "true"
spec:
replicas: 1
selector:
matchLabels:
app: ansichtkaarten-deployment
template:
metadata:
labels:
app: ansichtkaarten-deployment
spec:
containers:
- name: ansichtkaarten-deployment
image: registry.voidcorp.nl/library/ansichtkaarten:master
ports:
- containerPort: 80
imagePullSecrets:
- name: regcred
---
apiVersion: v1
kind: Service
metadata:
name: ansichtkaarten-deployment-service
spec:
selector:
app: ansichtkaarten-deployment
ports:
- protocol: TCP
port: 80
targetPort: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ansichtkaarten-deployment-ingress
spec:
rules:
- host: "groenehartansichtkaarten.nl"
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: ansichtkaarten-deployment-service
port:
number: 80

93
k8s/drone/drone.yml Normal file
View file

@ -0,0 +1,93 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: drone-deployment
namespace: drone
labels:
app: drone-deployment
# keel.sh/policy: force
spec:
replicas: 1
selector:
matchLabels:
app: drone-deployment
template:
metadata:
labels:
app: drone-deployment
spec:
containers:
- name: drone-deployment
image: drone/drone:2
ports:
- containerPort: 80
env:
- name: DRONE_GITEA_CLIENT_ID
valueFrom:
secretKeyRef:
name: drone-secrets
key: DRONE_GITEA_CLIENT_ID
- name: DRONE_GITEA_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: drone-secrets
key: DRONE_GITEA_CLIENT_SECRET
- name: DRONE_GITEA_SERVER
valueFrom:
secretKeyRef:
name: drone-secrets
key: DRONE_GITEA_SERVER
- name: DRONE_GIT_ALWAYS_AUTH
valueFrom:
secretKeyRef:
name: drone-secrets
key: DRONE_GIT_ALWAYS_AUTH
- name: DRONE_RPC_SECRET
valueFrom:
secretKeyRef:
name: drone-secrets
key: DRONE_RPC_SECRET
- name: DRONE_SERVER_HOST
valueFrom:
secretKeyRef:
name: drone-secrets
key: DRONE_SERVER_HOST
- name: DRONE_SERVER_PROTO
valueFrom:
secretKeyRef:
name: drone-secrets
key: DRONE_SERVER_PROTO
imagePullSecrets:
- name: regcred
---
apiVersion: v1
kind: Service
metadata:
namespace: drone
name: drone-deployment-service
spec:
selector:
app: drone-deployment
ports:
- protocol: TCP
port: 80
targetPort: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
namespace: drone
name: drone-deployment-ingress
spec:
rules:
- host: "drone.voidcorp.nl"
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: drone-deployment-service
port:
number: 80

6
k8s/drone/namespace.yml Normal file
View file

@ -0,0 +1,6 @@
kind: Namespace
apiVersion: v1
metadata:
name: drone
labels:
name: drone

40
k8s/drone/runner-rbac.yml Normal file
View file

@ -0,0 +1,40 @@
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
namespace: drone
name: drone
rules:
- apiGroups:
- ""
resources:
- secrets
verbs:
- create
- delete
- apiGroups:
- ""
resources:
- pods
- pods/log
verbs:
- get
- create
- delete
- list
- watch
- update
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: drone
namespace: drone
subjects:
- kind: ServiceAccount
name: default
namespace: drone
roleRef:
kind: Role
name: drone
apiGroup: rbac.authorization.k8s.io

40
k8s/drone/runner.yml Normal file
View file

@ -0,0 +1,40 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: drone
namespace: drone
labels:
app.kubernetes.io/name: drone
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: drone
template:
metadata:
labels:
app.kubernetes.io/name: drone
spec:
containers:
- name: runner
image: drone/drone-runner-kube:latest
ports:
- containerPort: 3000
env:
- name: DRONE_RPC_SECRET
valueFrom:
secretKeyRef:
name: drone-secrets
key: DRONE_RPC_SECRET
- name: DRONE_RPC_HOST
valueFrom:
secretKeyRef:
name: drone-secrets
key: DRONE_SERVER_HOST
- name: DRONE_RPC_PROTO
valueFrom:
secretKeyRef:
name: drone-secrets
key: DRONE_SERVER_PROTO
- name: DRONE_NAMESPACE_DEFAULT
value: drone

BIN
k8s/drone/secrets.yml Normal file
View file

Binary file not shown.

56
k8s/galerie/main.yml Normal file
View file

@ -0,0 +1,56 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: galerie-deployment
labels:
app: galerie-deployment
keel.sh/policy: force
keel.sh/match-tag: "true"
spec:
replicas: 1
selector:
matchLabels:
app: galerie-deployment
template:
metadata:
labels:
app: galerie-deployment
spec:
containers:
- name: galerie-deployment
imagePullPolicy: Always
image: registry.voidcorp.nl/library/galerie:main
ports:
- containerPort: 80
imagePullSecrets:
- name: regcred
---
apiVersion: v1
kind: Service
metadata:
name: galerie-deployment-service
spec:
selector:
app: galerie-deployment
ports:
- protocol: TCP
port: 80
targetPort: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: galerie-deployment-ingress
spec:
rules:
- host: "galerievanslagmaat.nl"
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: galerie-deployment-service
port:
number: 80

BIN
k8s/galerie/secrets.yml Normal file
View file

Binary file not shown.

56
k8s/galerie/staging.yml Normal file
View file

@ -0,0 +1,56 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: galerie-staging-deployment
labels:
app: galerie-staging-deployment
keel.sh/policy: force
keel.sh/match-tag: "true"
spec:
replicas: 1
selector:
matchLabels:
app: galerie-staging-deployment
template:
metadata:
labels:
app: galerie-staging-deployment
spec:
containers:
- name: galerie-staging-deployment
imagePullPolicy: Always
image: registry.voidcorp.nl/library/galerie:staging
ports:
- containerPort: 80
imagePullSecrets:
- name: regcred
---
apiVersion: v1
kind: Service
metadata:
name: galerie-staging-deployment-service
spec:
selector:
app: galerie-staging-deployment
ports:
- protocol: TCP
port: 80
targetPort: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: galerie-staging-deployment-ingress
spec:
rules:
- host: "staging.galerievanslagmaat.nl"
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: galerie-staging-deployment-service
port:
number: 80

220
k8s/keel/keel.yml Normal file
View file

@ -0,0 +1,220 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: "keel"
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: keel
namespace: "keel"
labels:
app: keel
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: keel
rules:
- apiGroups:
- ""
resources:
- namespaces
verbs:
- watch
- list
- apiGroups:
- ""
resources:
- secrets
verbs:
- get
- watch
- list
- apiGroups:
- ""
- extensions
- apps
- batch
resources:
- pods
- replicasets
- replicationcontrollers
- statefulsets
- deployments
- daemonsets
- jobs
- cronjobs
verbs:
- get
- delete # required to delete pods during force upgrade of the same tag
- watch
- list
- update
- apiGroups:
- ""
resources:
- configmaps
- pods/portforward
verbs:
- get
- create
- update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: keel
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: keel
subjects:
- kind: ServiceAccount
name: keel
namespace: "keel"
---
apiVersion: v1
kind: Service
metadata:
name: keel
namespace: "keel"
labels:
app: keel
spec:
type: LoadBalancer
ports:
- port: 9300
targetPort: 9300
protocol: TCP
name: keel
selector:
app: keel
sessionAffinity: None
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: keel
namespace: "keel"
labels:
app: keel
spec:
replicas: 1
selector:
matchLabels:
app: keel
template:
metadata:
labels:
app: keel
spec:
serviceAccountName: keel
containers:
- name: keel
# Note that we use appVersion to get images tag.
image: "keelhq/keel:latest"
imagePullPolicy: Always
command: ["/bin/keel"]
env:
- name: NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
# Enable GCR with pub/sub support
- name: PROJECT_ID
value: ""
- name: PUBSUB
value: "" # Set to '1' or 'true' to enable GCR pubsub
# Basic auth (to enable UI/API)
- name: BASIC_AUTH_USER
value: j00lz
- name: BASIC_AUTH_PASSWORD
value: admin
- name: AUTHENTICATED_WEBHOOKS
value: "false"
# Helm configuration
# Enable AWS ECR
- name: AWS_ACCESS_KEY_ID
value: ""
- name: AWS_SECRET_ACCESS_KEY
value: ""
- name: AWS_REGION
value: ""
# Enable webhook endpoint
- name: WEBHOOK_ENDPOINT
value: ""
# Enable mattermost endpoint
- name: MATTERMOST_ENDPOINT
value: ""
# Enable MS Teams webhook endpoint
- name: TEAMS_WEBHOOK_URL
value: ""
- name: SLACK_TOKEN
value: ""
- name: SLACK_CHANNELS
value: "general"
- name: SLACK_APPROVALS_CHANNEL
value: "general"
- name: SLACK_BOT_NAME
value: "keel"
# Enable hipchat approvials and notification
- name: HIPCHAT_TOKEN
value: ""
- name: HIPCHAT_CHANNELS
value: ""
- name: HIPCHAT_APPROVALS_CHANNEL
value: ""
- name: HIPCHAT_APPROVALS_BOT_NAME
value: ""
- name: HIPCHAT_APPROVALS_USER_NAME
value: ""
- name: HIPCHAT_APPROVALS_PASSWORT
value: ""
- name: NOTIFICATION_LEVEL
value: "info"
# Enable insecure registries
- name: INSECURE_REGISTRY
value: "false"
ports:
- containerPort: 9300
livenessProbe:
httpGet:
path: /healthz
port: 9300
initialDelaySeconds: 30
timeoutSeconds: 10
resources:
limits:
cpu: 100m
memory: 128Mi
requests:
cpu: 50m
memory: 64Mi
---
# Source: keel/templates/pod-disruption-budget.yaml
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
name: keel
namespace: "keel"
spec:
maxUnavailable: 1
selector:
matchLabels:
app: keel