move stuff

ops/generate_auth.sh

@@ -0,0 +1,43 @@
+gen_password() { head -c 16 /dev/urandom | sha256sum | cut -d " " -f 1; }
+
+kube_run() {
+    eval "kubectl run --quiet -i --rm --tty kube-run-${RANDOM} \
+      --image=${1} --restart=Never -- ${@:2}"
+}
+
+htpasswd() {
+    kube_run alpine /bin/sh -c \""apk add --no-cache apache2-utils \
+      &> /dev/null && \
+      htpasswd -Bbn ${1} ${2} | head -n 1 2> /dev/null\""
+}
+
+K3S_HOST=strix.systems
+REGISTRY_ADMIN=ntr
+REGISTRY_PASSWORD=$(gen_password)
+REGISTRY_AUTH=$(htpasswd ${REGISTRY_ADMIN} ${REGISTRY_PASSWORD})
+REGISTRY_HTTP_SECRET=$(gen_password)
+
+echo "-------------------------------"
+echo REGISTRY_ADMIN is ${REGISTRY_ADMIN}
+echo REGISTRY_PASSWORD is ${REGISTRY_PASSWORD}
+echo REGISTRY_AUTH is ${REGISTRY_AUTH}
+echo REGISTRY_HTTP_SECRET is ${REGISTRY_HTTP_SECRET}
+
+kubectl create secret generic registry \
+    -n ops
+   --from-literal=REGISTRY_ADMIN=${REGISTRY_ADMIN} \
+   --from-literal=REGISTRY_PASSWORD=${REGISTRY_PASSWORD} \
+   --from-literal=REGISTRY_HTTP_SECRET=${REGISTRY_HTTP_SECRET} \
+   --from-literal=REGISTRY_AUTH=${REGISTRY_AUTH}
+
+# cat <<EOF | ssh root@strix tee /etc/rancher/k3s/registries.yaml
+# mirrors:
+#   registry.strix.systems:
+#     endpoint:
+#       - "https://registry.strix.systems"
+# configs:
+#   "registry.strix.systems":
+#     auth:
+#       username: ntr
+#       password: pw
+# EOF

ops/grafana.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: grafana-pv
+spec:
+  storageClassName: ""
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  claimRef:
+    namespace: monitor
+    name: grafana-pvc
+  hostPath:
+    path: "/var/lib/rancher/k3s/storage/grafana-pv"
+    type: DirectoryOrCreate
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: grafana-pvc
+  namespace: monitor
+spec:
+  volumeName: grafana-pv
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

ops/monitor.ingress.yaml

@@ -0,0 +1,37 @@
+---
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: monitor
+  namespace: monitor
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+spec:
+  ingressClassName: haproxy
+  tls:
+  - hosts:
+    - monitor.strix.systems
+    - monitor.ntwl.xyz
+    secretName: monitor-strix-systems-tls
+  rules:
+  - host: monitor.strix.systems
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: kube-prometheus-stack-grafana
+            port:
+              number: 80
+  - host: monitor.ntwl.xyz
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: kube-prometheus-stack-grafana
+            port:
+              number: 80

ops/ops.yaml

@@ -0,0 +1,6 @@
+---
+
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ops

ops/registry.ingress.yaml

@@ -0,0 +1,37 @@
+---
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: registry
+  annotations:
+    haproxy.org/proxy-body-size-limit: "2g"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+spec:
+  ingressClassName: haproxy
+  tls:
+  - hosts:
+    - registry.strix.systems
+    - registry.ntwl.xyz
+    secretName: registry-strix-systems-tls
+  rules:
+  - host: registry.strix.systems
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: registry
+            port:
+              number: 5000
+  - host: registry.ntwl.xyz
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: registry
+            port:
+              number: 5000

ops/registry.yaml

@@ -0,0 +1,142 @@
+---
+
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: registry-pv
+spec:
+  storageClassName: local-path
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  claimRef:
+    namespace: default
+    name: registry-pvc
+  hostPath:
+    path: "/var/lib/rancher/k3s/storage/registry-pv"
+    type: DirectoryOrCreate
+
+---
+
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: registry-pvc
+spec:
+  volumeName: registry-pv
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+  storageClassName: local-path
+
+---
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: registry
+spec:
+  ports:
+    - name: web
+      port: 5000
+      protocol: TCP
+  selector:
+    app: registry
+
+---
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: registry
+  labels:
+    app: registry
+spec:
+  selector:
+    matchLabels:
+      app: registry
+  replicas: 1
+  minReadySeconds: 5
+  template:
+    metadata:
+      labels:
+        app: registry
+      annotations:
+    spec:
+      containers:
+        - name: registry
+          image: registry:2
+          ports:
+            - containerPort: 5000
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 5000
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 5000
+          resources:
+          env:
+            - name: REGISTRY_HTTP_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: registry
+                  key: REGISTRY_HTTP_SECRET
+          volumeMounts:
+            - name: registry-pvc
+              mountPath: /var/lib/registry
+            - name: registry-auth
+              mountPath: /auth
+              readOnly: true
+            - name: registry-config
+              mountPath: "/etc/docker/registry"
+      volumes:
+        - name: registry-auth
+          secret:
+            secretName: registry
+            items:
+              - key: REGISTRY_AUTH
+                path: htpasswd
+        - name: registry-config
+          configMap:
+            name: registry
+        - name: registry-pvc
+          persistentVolumeClaim:
+            claimName: registry-pvc
+
+---
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: registry
+  # namespace: registry
+data:
+  config.yml: |
+    version: 0.1
+    log:
+      fields:
+        service: registry
+    http:
+      addr: :5000
+      headers:
+        X-Content-Type-Options: [nosniff]
+    auth:
+      htpasswd:
+        realm: registry
+        path: /auth/htpasswd
+    storage:
+      filesystem:
+        rootdirectory: /var/lib/registry
+      delete:
+        enabled: true
+    health:
+      storagedriver:
+        enabled: true
+        interval: 10s
+        threshold: 3

ops/values.yaml

@@ -0,0 +1,20 @@
+grafana:
+  persistence:
+    type: pvc
+    enabled: true
+    # annotations: {}
+    finalizers:
+      - kubernetes.io/pvc-protection
+    existingClaim: grafana-pvc
+
+alertmanager:
+  enabled: false
+
+loki:
+  auth_enabled: false
+  commonConfig:
+    replication_factor: 1
+  storage:
+    type: 'filesystem'
+singleBinary:
+  replicas: 1