Readme

1. Install cert-manager: kubectl apply -k cert-manager/overlays/<overlay>
2. Install Gateway API CRDs: kubectl apply --server-side -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.1/standard-install.yaml
3. Install argocd: kubectl apply --server-side -k argocd/overlays/<overlay>
4. Add all applications: kubectl apply -k apps/overlays/<overlay>

The apps folder contains argocd Applications including an "app-of-apps".

Backup

Use rsync to download all data from the NFS share.

rsync --archive --compress --progress --delete --rsync-path='sudo -u www-data rsync' lennart@bombur:/media/data/personal-cloud/nextcloud ./

OpenCloud is the exception: it no longer sits on this NFS share, it's on its own iSCSI-backed disk image instead. See turing-talos/README.md for how to back that up.

Make btrfs snapshots of the data.

sudo btrfs subvolume snapshot -r . .snapshots/nasse-$(date +%Y-%m-%d)

# Check disk usage
btrfs filesystem df --human-readable .
btrfs filesystem du --human-readable --summarize .

Testing with KinD

sudo kind create cluster --config=kind-config.yaml
sudo kind get kubeconfig > kubeconfig.yaml
export KUBECONFIG=kubeconfig.yaml

kubectl apply -k cert-manager/overlays/kind
kubectl apply --server-side -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.1/standard-install.yaml
kubectl apply --server-side -k argocd/overlays/kind

# Login and check that it is working
password="$(kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d)"
argocd login --port-forward --port-forward-namespace argocd --username=admin --password="${password}"
argocd --port-forward --port-forward-namespace=argocd cluster list

# Apply the app of apps to install everything
kubectl -n argocd apply -f apps/kind/apps-app.yaml

# Note: For ArgoCD v3.3.0+, the self-managed ArgoCD application requires server-side apply
# If applying individual apps, use: kubectl -n argocd apply --server-side -f apps/kind/argocd-app.yaml

# Add ClusterSecretStore
kubectl -n external-secrets create secret generic bitwarden-access-token --from-literal=token=...
kubectl apply -f secret-store/test-secretstore.yaml

Accessing the apps

Add the following to /etc/hosts:

127.0.0.1 argocd.local opencloud.local jellyfin.local keycloak.local

Argocd

Go to argocd.local to see the dashboard. Log in as admin with the password you get from this commands:

kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d

OpenCloud

Login at opencloud.local with admin/admin. Authentication goes through Keycloak, the user is defined in the openCloud realm. See the migration guide for how this is set up and how to roll it out to an existing installation.

Jellyfin

Setup at jellyfin.local.

Pi-hole

Find the IP and password:

pi_hole_ip="$(kubectl -n pi-hole get svc pi-hole -o jsonpath="{.status.loadBalancer.ingress[].ip}")"
pi_hole_password="$(kubectl -n pi-hole get secret pi-hole-env -o jsonpath="{.data.WEBPASSWORD}" | base64 -d)"
echo "Login at http://${pi_hole_ip}/admin with the password ${pi_hole_password}"

Test the nameserver like this:

host example.com "${pi_hole_ip}"

Wireguard

POD_NAME=$(kubectl -n wireguard get pod -l app.kubernetes.io/name=wireguard -o jsonpath="{.items[0].metadata.name}")
kubectl -n wireguard cp "${POD_NAME}":/config/peer1/peer1.conf /tmp/peer1.conf
sudo nmcli con import type wireguard file /tmp/peer1.conf
# Remove DNS configuration from the connection
nmcli con modify peer1 -ipv4.dns "10.13.13.1"
nmcli con modify peer1 -ipv4.dns-search "~"

nmcli c up peer1
# Check the connection by curling coredns
curl 10.96.0.10:9153
# This should give 404
# Now disable the connection and check again
nmcli c down peer1
curl --connect-timeout 2 10.96.0.10:9153
# This should timeout

Cleanup:

sudo nmcli c delete peer1

Chainsaw test

sudo kind create cluster --config=kind-config.yaml
sudo kind get kubeconfig > kubeconfig.yaml
export KUBECONFIG=kubeconfig.yaml
export BITWARDEN_ACCESS_TOKEN=...
chainsaw test