WIP: cert manager

Reviewed-on: #1

01_Basic_Setup/justfile

@@ -6,7 +6,7 @@ export EXTERNAL_K8S_HOST := env("EXTERNAL_K8S_HOST", "")
 export KEYCLOAK_HOST := env("KEYCLOAK_HOST", "")
 export KEYCLOAK_REALM := env("KEYCLOAK_REALM", "buunstack")
 export K8S_OIDC_CLIENT_ID := env('K8S_OIDC_CLIENT_ID', "k8s")
-export K3S_ENABLE_REGISTRY := env("K3S_ENABLE_REGISTRY", "false")
+export K3S_ENABLE_REGISTRY := env("K3S_ENABLE_REGISTRY", "true")
 export SERVER_IP := env("K3S_SERVER_IP","192.168.178.45")
 export AGENT_IP := env("K3S_AGENT_IP","192.168.178.75")
 export USER := env("K3S_USER","basti")
@@ -33,16 +33,17 @@ install:
 
     args=(
         "install"
-        "--context" "${K8S_CONTEXT}"
+        "--context" "${context}"
         "--host" "${K8S_MASTER_NODE_NAME}"
         "--user" "${username}"
+        "--no-extras" # 
     )
 
     if [ -n "${kubeconfig}" ]; then
         mkdir -p "$(dirname "${kubeconfig}")"
         args+=("--local-path" "${kubeconfig}" "--merge")
     fi
-    echo "Running: k3sup ${args[*]}"
+    echo "Running: k3sup ${args[@]}"
     k3sup "${args[@]}"
 
     if [ -n "${context}" ]; then
@@ -133,3 +134,15 @@ add-agent:
     k3sup "${args[@]}"
     echo "Agent node at ${new_agent_ip} added to cluster."
  
+# Configure k3s to use local registry
+configure-registry:
+    #!/bin/bash
+    set -euo pipefail
+    echo "Configuring k3s registries.yaml..."
+
+    ssh "${K8S_MASTER_NODE_NAME}" "sudo mkdir -p /etc/rancher/k3s"
+    gomplate -f ./registry/registries.gomplate.yaml | ssh "${K8S_MASTER_NODE_NAME}" "sudo tee /etc/rancher/k3s/registries.yaml > /dev/null"
+
+    echo "Restarting k3s to apply registry configuration..."
+    ssh "${K8S_MASTER_NODE_NAME}" "sudo systemctl restart k3s"
+    echo "✓ Registry configuration applied"

Metallb_Setup/address-pool.gomplate.yaml

@@ -5,5 +5,4 @@ metadata:
   namespace: metallb-system
 spec:
   addresses:
-#  - 192.168.178.220-192.168.178.225 #pve-82
+  - {{ .Env.METALLB_ADDRESS_RANGE }}
-  - 192.168.178.160-192.168.178.180 #pve-83

Metallb_Setup/justfile

@@ -0,0 +1,66 @@
+set fallback := true
+
+export K8S_CONTEXT := env("K8S_CONTEXT", "")
+export SERVER_IP := env("K3S_SERVER_IP","192.168.178.45")
+export USER := env("K3S_USER","basti")
+
+
+[private]
+default:
+    @just --list --unsorted --list-submodules
+
+
+install:
+    #!/bin/bash
+    set -euo pipefail
+    just env::check
+
+    METALLB_VERSION="v0.15.3"
+
+    username=$(gum input --prompt="SSH username: " --value="${USER}" --width=100)
+    context=""
+    if gum confirm "Update KUBECONFIG?"; then
+        context=$(
+            gum input --prompt="Context name: " --value="${K8S_CONTEXT}" --width=100
+        )
+    fi
+
+    if [ -n "${context}" ]; then
+        kubectl config use-context "${context}"
+    fi
+
+    kubectl apply -f "https://raw.githubusercontent.com/metallb/metallb/${METALLB_VERSION}/config/manifests/metallb-native.yaml"
+    gum spin --spinner dot --title "Waiting for MetalLB to be ready..." -- kubectl wait --namespace metallb-system --for=condition=available deployment --all --timeout=120s
+    echo "MetalLB ${METALLB_VERSION} installed successfully."
+
+    gomplate -f address-pool.gomplate.yaml | kubectl apply -f -
+    echo "Address pool configured."
+
+    kubectl apply -f advertisement.yaml
+    echo "Advertisement created."
+
+uninstall:
+    #!/bin/bash
+    set -euo pipefail
+    just env::check
+
+    kubectl get namespace metallb-system &>/dev/null && kubectl delete ns metallb-system
+
+test-deployment:
+    #!/bin/bash
+    set -euo pipefail
+    just env::check
+
+    kubectl apply -f test-deployment.yaml
+
+    echo "Test deployment created. You can check the service with 'kubectl get svc nginx -o wide -n test'."
+
+    echo "To clean up, run 'just test-deployment-cleanup'."
+
+test-deployment-cleanup:
+    #!/bin/bash
+    set -euo pipefail
+    just env::check
+
+    kubectl delete -f test-deployment.yaml
+    echo "Test deployment and service deleted."

Metallb_Setup/test-deployment.yaml

@@ -0,0 +1,43 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: test
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx
+  namespace: test
+  labels:
+    app: nginx
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: nginx
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      containers:
+        - name: nginx
+          image: nginx:latest
+          ports:
+            - containerPort: 80
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nginx
+  namespace: test
+spec:
+  type: LoadBalancer
+  selector:
+    app: nginx
+  ports:
+    - port: 80
+      targetPort: 80
+      protocol: TCP

Traefik/README.md

@@ -4,7 +4,7 @@
     helm repo add traefik https://helm.traefik.io/traefik
 
 
-helm install traefik traefik/traefik --namespace traefik --create-namespace --values traefik-values.yaml
+    helm install traefik traefik/traefik --namespace traefik --create-namespace --values traefik-values.yaml
 
 
 ## Cert-Manager
@@ -24,13 +24,15 @@ i.e. general issuer for all namespaces in cluster.
 
 
 ## Test Deployment
+```
 k create ns test
 kubectl create deploy nginx --image=nginx -n test
 k create svc -n test clusterip nginx --tcp=80
 k scale --replicas=3 deployment/nginx -n test
-
+```
 
 ## Install Traefik & Cert-Manager
+```
 
 helm install traefik traefik/traefik --namespace traefik --create-namespace --values traefik-values.yaml
 
@@ -40,23 +42,25 @@ helm repo add jetstack https://charts.jetstack.io --force-update
 helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --values cert-manager-values.yaml
 
 
-k apply cert-manager-issuer-secret.yaml
+k apply -f cert-manager-issuer-secret.yaml
 k get secret -n cert-manager
 
 k apply -f cert-manager-cluster-issuer.yaml
+```
 
 
 ## Switch Test Deployment to https
-
+```
 k apply -f test/nginx-certificate.yaml
 k apply -f test/nginx-ingress.yaml
+```
 
 
 
 ## Troubleshooting steps
 
 
-
+```
 k get po -n test -o wide
 k create svc -n test clusterip nginx 
 k create svc -n test clusterip nginx --tcp=80
@@ -70,12 +74,11 @@ k apply -f traefik_lempa/nginx-ingress.yaml
 k get svc -n test
 k get ingress
 k get ingress -n test
+```
 
 
 
-
+```
-
-
 k get svc ingressRoute
 k get svc ingressRoutes
 k get svc ingressroutes.traefik.io
@@ -89,4 +92,5 @@ k get po
 k apply -f traefik_lempa/cert-manager-issuer-secret.yaml
 k get secret
 k get secrets
-k get clusterissuers.cert-manager.io
+k get clusterissuers.cert-manager.io
+```

Traefik/cert-manager-cluster-issuer-gomplate.yaml

@@ -4,7 +4,7 @@ metadata:
   name: cloudflare-cluster-issuer
 spec:
   acme:
-    email: hello@schnorbus.net
+    email: {{ .Env.ACME_EMAIL }}
     server: https://acme-v02.api.letsencrypt.org/directory
     privateKeySecretRef:
       name: cloudflare-acme-key

Traefik/cert-manager-issuer-secret-gomplate.yaml

@@ -5,4 +5,4 @@ metadata:
   namespace: cert-manager
 type: Opaque
 stringData:
-  api-token: DgU4SMUpQVAoS8IisGxnSQCUI7PbclhvegdqF9I1
+  api-token: {{ .Env.CLOUDFLARE_API_TOKEN }}

Traefik/justfile

@@ -0,0 +1,43 @@
+set fallback:=true
+
+export CERT_MANAGER_NAMESPACE := env("CERT_MANAGER_NAMESPACE", "cert-manager")
+export TRAEFIK_NAMESPACE := env("TRAEFIK_NAMESPACE", "traefik")
+
+add-helm-repos:
+    helm repo add traefik https://helm.traefik.io/traefik --force-update
+    helm repo add jetstack https://charts.jetstack.io --force-update
+    helm repo update
+
+install:
+    #!/bin/bash
+    set -euo pipefail
+    just env::check
+
+    just add-helm-repos
+
+    helm upgrade traefik traefik/traefik \
+     --install \
+     --cleanup-on-fail \
+     --namespace ${TRAEFIK_NAMESPACE} \
+     --create-namespace \
+     --values traefik-values.yaml
+
+    helm upgrade cert-manager jetstack/cert-manager \
+     --install \
+     --cleanup-on-fail \
+     --namespace ${CERT_MANAGER_NAMESPACE} \
+     --create-namespace \
+     --values cert-manager-values.yaml
+
+uninstall:
+    #!/bin/bash
+    set -euo pipefail
+    just env::check
+
+    helm uninstall traefik --namespace ${TRAEFIK_NAMESPACE} || true
+    helm uninstall cert-manager --namespace ${CERT_MANAGER_NAMESPACE} || true
+
+setup-cluster-issuer:
+    #!/bin/bash
+    set -euo pipefail
+    just env::check

Traefik/traefik-values-gomplate.yaml

@@ -11,5 +11,5 @@ ingressRoute:
   dashboard:
     enabled: true
     entryPoints: [web, websecure]
-    matchRule: Host(`traefik-dashboard.k8s.schnrbs.work`)
+    matchRule: Host(`traefik-dashboard.{{ .Env.EXTERNAL_DOMAIN }}`)
       

env/env.local.gomplate

@@ -3,3 +3,7 @@ K8S_CONTEXT={{ .Env.K8S_CONTEXT }}
 K8S_MASTER_NODE_NAME={{ .Env.K8S_MASTER_NODE_NAME }}
 SERVER_IP={{ .Env.SERVER_IP }}
 AGENT_IP={{ .Env.AGENT_IP }}
+METALLB_ADDRESS_RANGE={{ .Env.METALLB_ADDRESS_RANGE }}
+CLOUDFLARE_API_TOKEN={{ .Env.CLOUDFLARE_API_TOKEN}}
+ACME_EMAIL={{ .Env.ACME_EMAIL}}
+EXTERNAL_DOMAIN={{ .Env.EXTERNAL_DOMAIN }}

env/justfile

@@ -70,7 +70,7 @@ setup:
             exit 1
         fi
     done
-        while [ -z "${AGENT_IP}" ]; do
+    while [ -z "${AGENT_IP}" ]; do
         if ! AGENT_IP=$(
             gum input --prompt="IP of Agent Node: " \
             --width=100 --placeholder="Agent Node IP"
@@ -79,5 +79,47 @@ setup:
             exit 1
         fi
     done
+
+    while [ -z "${METALLB_ADDRESS_RANGE}" ]; do
+        if ! METALLB_ADDRESS_RANGE=$(
+            gum input --prompt="IP Range for LoadBalancer: " \
+            --width=100 --placeholder="[x.x.x.x-y.y.y.y]"
+        ); then
+            echo "Setup cancelled." >&2
+            exit 1
+        fi
+    done
+
+    while [ -z "${CLOUDFLARE_API_TOKEN}" ]; do
+        if ! CLOUDFLARE_API_TOKEN=$(
+            gum input --prompt="Cloudflare API Token: " \
+            --width=100 --placeholder="API Token" --password
+        ); then
+            echo "Setup cancelled." >&2
+            exit 1
+        fi
+    done
+
+    while [ -z "${ACME_EMAIL}" ]; do
+        if ! ACME_EMAIL=$(
+            gum input --prompt="ACME Email for Cert-Manager: " \
+            --width=100 --placeholder="Email"
+        ); then
+            echo "Setup cancelled." >&2
+            exit 1
+        fi
+    done
+
+    while [ -z "${EXTERNAL_DOMAIN}" ]; do
+        if ! EXTERNAL_DOMAIN=$(
+            gum input --prompt="External Domain: " \
+            --width=100 --placeholder="Domain"
+        ); then
+            echo "Setup cancelled." >&2
+            exit 1
+        fi
+    done
+    
+    echo "Generating .env.local file..."    
     rm -f ../.env.local
     gomplate -f env.local.gomplate -o ../.env.local

gitops/README.md

@@ -14,3 +14,4 @@ flux bootstrap gitea --repository=k3s-homelab --branch=main --personal --owner b
 
 https://bash.ghost.io/secure-kubernetes-secrets-disaster-recovery-with-sops-gitops-fluxcd/
 
+"Make a 4×4 grid starting with the 1880s. In each section, I should appear styled according to that decade (clothing, hairstyle, facial hair, accessories). Use colors, background, & film style accordingly." 

justfile

@@ -7,4 +7,6 @@ default:
     @just --list --unsorted --list-submodules
 
 mod env
-mod BasicSetup '01_Basic_Setup'
+mod BasicSetup '01_Basic_Setup'
+mod MetalLbSetup 'Metallb_Setup'
+mod Traefik