various tweaks and fixes

FedoraServer.md

@@ -13,6 +13,7 @@ quick.
   - [Install K3S](#install-k3s)
     - [Database Backups](#database-backups)
   - [Expanding Root Partition](#expanding-root-partition)
+  - [Arping IP Address](#arping-ip-address)
   - [Optional Steps](#optional-steps)
     - [Certbot for Cockpit](#certbot-for-cockpit)
 
@@ -106,14 +107,16 @@ our own components.
         "traefik" \
         "--disable" \
         "local-storage" \
+         "--disable" \
+        "servicelb" \
         "--disable" \
         "coredns" \
-        "--disable" \
-        "servicelb" \
         "--cluster-dns" \
         "10.43.0.10" \
         "--tls-san" \
         "kube.reeselink.com" \
+        "--tls-san" \
+        "kube.reeseapps.com" \
 
 3. Join each server node
 
@@ -159,6 +162,13 @@ lvextend -l +100%FREE fedora
 xfs_growfs /dev/mapper/fedora-root
 ```
 
+## Arping IP Address
+
+```bash
+echo 1 > /proc/sys/net/ipv4/ip_nonlocal_bind
+arping -I bridge0 -U -s 10.1.2.102 10.1.0.1
+```
+
 ## Optional Steps
 
 ### Certbot for Cockpit

ansible/inventory.yaml

@@ -9,7 +9,7 @@ kubernetes:
 
 colors:
   hosts:
-    # orange:
+    orange:
     yellow:
 
 apt:

coredns-values.yaml

@@ -4,14 +4,16 @@
 
 image:
   repository: coredns/coredns
-  tag: "1.11.1"
+  # Overrides the image tag whose default is the chart appVersion.
+  tag: ""
   pullPolicy: IfNotPresent
   ## Optionally specify an array of imagePullSecrets.
   ## Secrets must be manually created in the namespace.
   ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
   ##
+  pullSecrets: []
   # pullSecrets:
-  #   - myRegistryKeySecretName
+  #   - name: myRegistryKeySecretName
 
 replicaCount: 1
 
@@ -23,29 +25,10 @@ resources:
     cpu: 100m
     memory: 128Mi
 
-## Create HorizontalPodAutoscaler object.
-##
-# autoscaling:
-#   minReplicas: 1
-#   maxReplicas: 10
-#   metrics:
-#   - type: Resource
-#     resource:
-#       name: cpu
-#       targetAverageUtilization: 60
-#   - type: Resource
-#     resource:
-#       name: memory
-#       targetAverageUtilization: 60
-
 rollingUpdate:
   maxUnavailable: 1
   maxSurge: 25%
 
-# Under heavy load it takes more that standard time to remove Pod endpoint from a cluster.
-# This will delay termination of our pod by `preStopSleep`. To make sure kube-proxy has
-# enough time to catch up.
-# preStopSleep: 5
 terminationGracePeriodSeconds: 30
 
 podAnnotations: {}
@@ -67,9 +50,11 @@ prometheus:
 
 service:
   clusterIP: "10.43.0.10"
+# clusterIPs: []
 # loadBalancerIP: ""
 # externalIPs: []
 # externalTrafficPolicy: ""
+# ipFamilyPolicy: ""
   # The name of the Service
   # If not set, a name is generated using the fullname template
   name: ""
@@ -97,6 +82,16 @@ isClusterService: true
 # Optional priority class to be used for the coredns pods. Used for autoscaler if autoscaler.priorityClassName not set.
 priorityClassName: ""
 
+# Configure the pod level securityContext.
+podSecurityContext: {}
+
+# Configure SecurityContext for Pod.
+# Ensure that required linux capability to bind port number below 1024 is assigned (`CAP_NET_BIND_SERVICE`).
+securityContext:
+  capabilities:
+    add:
+      - NET_BIND_SERVICE
+
 # Default zone is what Kubernetes recommends:
 # https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/#coredns-configmap-options
 servers:
@@ -124,12 +119,6 @@ servers:
   # Serves a /metrics endpoint on :9153, required for serviceMonitor
   - name: prometheus
     parameters: 0.0.0.0:9153
-  - name: file
-    parameters: /etc/coredns/democratic-csi-server.reeselink.db democratic-csi-server.reeselink.com
-  - name: file
-    parameters: /etc/coredns/democratic-csi-client.reeselink.db democratic-csi-client.reeselink.com
-  - name: file
-    parameters: /etc/coredns/driveripper.reeselink.db driveripper.reeselink.com
   - name: forward
     parameters: . /etc/resolv.conf
   - name: cache
@@ -192,14 +181,23 @@ readinessProbe:
 affinity: {}
 
 # expects input structure as per specification https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#topologyspreadconstraint-v1-core
-# for example:
+# and supports Helm templating.
+# For example:
 #   topologySpreadConstraints:
-#   - maxSkew: 1
+#     - labelSelector:
-#     topologyKey: zone
+#         matchLabels:
-#     whenUnsatisfiable: DoNotSchedule
+#           app.kubernetes.io/name: '{{ template "coredns.name" . }}'
-#     labelSelector:
+#           app.kubernetes.io/instance: '{{ .Release.Name }}'
-#       matchLabels:
+#       topologyKey: topology.kubernetes.io/zone
-#         foo: bar
+#       maxSkew: 1
+#       whenUnsatisfiable: ScheduleAnyway
+#     - labelSelector:
+#         matchLabels:
+#           app.kubernetes.io/name: '{{ template "coredns.name" . }}'
+#           app.kubernetes.io/instance: '{{ .Release.Name }}'
+#       topologyKey: kubernetes.io/hostname
+#       maxSkew: 1
+#       whenUnsatisfiable: ScheduleAnyway
 topologySpreadConstraints: []
 
 # Node labels for pod assignment
@@ -219,29 +217,20 @@ tolerations: []
 podDisruptionBudget: {}
 
 # configure custom zone files as per https://coredns.io/2017/05/08/custom-dns-entries-for-kubernetes/
-zoneFiles:
+# zoneFiles:
-  - filename: democratic-csi-server.reeselink.db
+# - filename: local.db
-    domain: democratic-csi-server.reeselink.com
+#   domain: driveripper.reeselink.com
-    contents: |
+#   contents: |
-      democratic-csi-server.reeselink.com.   IN   SOA     sns.dns.icann.org. noc.dns.icann.org. 2015082541 7200 3600 1209600 3600
+#     driveripper.reeselink.com.   IN SOA sns.dns.icann.com. noc.dns.icann.com. 2015082541 7200 3600 1209600 3600
-      democratic-csi-server.reeselink.com.   IN   NS      b.iana-servers.net.
+#     driveripper.reeselink.com.   IN NS  b.iana-servers.net.
-      democratic-csi-server.reeselink.com.   IN   NS      a.iana-servers.net.
+#     driveripper.reeselink.com.   IN NS  a.iana-servers.net.
-      democratic-csi-server.reeselink.com.   IN   A       172.20.0.1
+#     driveripper.reeselink.com.   IN A   172.20.0.1
-  - filename: democratic-csi-client.reeselink.db
-    domain: democratic-csi-client.reeselink.com
-    contents: |
-      democratic-csi-client.reeselink.com.   IN   SOA     sns.dns.icann.org. noc.dns.icann.org. 2015082541 7200 3600 1209600 3600
-      democratic-csi-client.reeselink.com.   IN   NS      b.iana-servers.net.
-      democratic-csi-client.reeselink.com.   IN   NS      a.iana-servers.net.
-      democratic-csi-client.reeselink.com.   IN   A       127.0.0.1
-  - filename: driveripper.reeselink.db
-    domain: driveripper.reeselink.com
-    contents: |
-      driveripper.reeselink.com.   IN   SOA     sns.dns.icann.org. noc.dns.icann.org. 2015082541 7200 3600 1209600 3600
-      driveripper.reeselink.com.   IN   NS      b.iana-servers.net.
-      driveripper.reeselink.com.   IN   NS      a.iana-servers.net.
-      driveripper.reeselink.com.   IN   A       172.20.0.1
 
+# optional array of sidecar containers
+extraContainers: []
+# - name: some-container-name
+#   image: some-image:latest
+#   imagePullPolicy: Always
 # optional array of extra volumes to create
 extraVolumes: []
 # - name: some-volume-name
@@ -256,8 +245,10 @@ extraVolumeMounts: []
 extraSecrets: []
 # - name: etcd-client-certs
 #   mountPath: /etc/coredns/tls/etcd
+#   defaultMode: 420
 # - name: some-fancy-secret
 #   mountPath: /etc/wherever
+#   defaultMode: 440
 
 # To support legacy deployments using CoreDNS with the "k8s-app: kube-dns" label selectors.
 # See https://github.com/coredns/helm/blob/master/charts/coredns/README.md#adopting-existing-coredns-resources
@@ -270,7 +261,27 @@ customLabels: {}
 customAnnotations: {}
 
 ## Alternative configuration for HPA deployment if wanted
-#
+## Create HorizontalPodAutoscaler object.
+##
+# hpa:
+#   enabled: false
+#   minReplicas: 1
+#   maxReplicas: 10
+#   metrics:
+#    metrics:
+#    - type: Resource
+#      resource:
+#        name: memory
+#        target:
+#          type: Utilization
+#          averageUtilization: 60
+#    - type: Resource
+#      resource:
+#        name: cpu
+#        target:
+#          type: Utilization
+#          averageUtilization: 60
+
 hpa:
   enabled: false
   minReplicas: 1
@@ -296,6 +307,9 @@ autoscaler:
   # If true does not allow single points of failure to form
   preventSinglePointFailure: true
 
+  # Annotations for the coredns proportional autoscaler pods
+  podAnnotations: {}
+
   ## Optionally specify some extra flags to pass to cluster-proprtional-autoscaler.
   ## Useful for e.g. the nodelabels flag.
   # customFlags:
@@ -309,8 +323,9 @@ autoscaler:
     ## Secrets must be manually created in the namespace.
     ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
     ##
+    pullSecrets: []
     # pullSecrets:
-    #   - myRegistryKeySecretName
+    #   - name: myRegistryKeySecretName
 
   # Optional priority class to be used for the autoscaler pods. priorityClassName used if not set.
   priorityClassName: ""
@@ -349,7 +364,14 @@ autoscaler:
     failureThreshold: 3
     successThreshold: 1
 
+  # optional array of sidecar containers
+  extraContainers: []
+  # - name: some-container-name
+  #   image: some-image:latest
+  #   imagePullPolicy: Always
+
 deployment:
+  skipConfig: false
   enabled: true
   name: ""
   ## Annotations for the coredns deployment

helm/nextcloud/values.yaml

@@ -1,5 +1,5 @@
 nextcloud:
-  image: nextcloud:28.0.1
+  image: nextcloud:27.1.9
   domain: nextcloud.reeseapps.com
   html:
     storageClassName: zfs-iscsi-enc1

nextcloud/README.md

@@ -21,6 +21,12 @@ docker run \
 nextcloud/all-in-one:latest
 ```
 
+## Trusted Proxy
+
+```bash
+docker exec --user www-data -it nextcloud-aio-nextcloud php occ config:system:set trusted_proxies 2 --value="10.1.0.0/16"
+```
+
 ## Uninstall
 
 ```bash

nodes/README.md

@@ -0,0 +1,7 @@
+# Kubernetes Node Ansible
+
+## Update Hosts
+
+```bash
+ansible-playbook -i ansible/inventory.yaml nodes/update_hosts.yaml
+```

nodes/hosts

@@ -0,0 +1,3 @@
+127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
+::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
+172.20.0.1  democratic-csi-server.reeselink.com

nodes/update_hosts.yaml

@@ -0,0 +1,13 @@
+- name: Update /etc/hosts
+  hosts: kubernetes
+  become: true
+  become_user: root
+  become_method: sudo
+  tasks:
+  - name: Copy /etc/hosts
+    ansible.builtin.copy:
+      src: ./hosts
+      dest: /etc/hosts
+      owner: root
+      group: root
+      mode: '0644'

orange_yellow.md

@@ -0,0 +1,22 @@
+# Orange and Yellow Servers
+
+## Services
+
+1. Both servers run all quadlets in `podman/`
+2. Both servers run the same nginx config in `nginx/`
+
+## VMs
+
+1. Orange runs unifi-external
+2. Yellow runs nextcloud-aio
+
+## Pihole
+
+- Orange is ad-blocking
+- Yellow is caching
+
+## Load Balancing
+
+- Orange handles all traffic from outside the network
+- Yellow handles all internal traffic
+- Both are capable of handling all traffic, port forwarding rule determines which is up

podman/README.md

@@ -66,7 +66,10 @@ podman run \
 
 ### Cloudflared
 
-Creates a DOH proxy for pihole. Just set the pihole upstream to `10.1.203.197#5053`.
+https://docs.pi-hole.net/guides/dns/cloudflared/
+
+Creates a DOH proxy for pihole. Just set the pihole upstream to `10.1.203.197#5053` (yellow) or
+`10.1.200.253#5053` (orange).
 
 ```bash
 podman run \

truenas-iscsi-enc0.yaml

@@ -29,9 +29,10 @@ driver:
     httpConnection:
       protocol: https
       host: driveripper.reeselink.com
-      port: 8443
+      port: 443
       apiKey: ""
-      allowInsecure: true
+      allowInsecure: false
+      apiVersion: 2
     zfs:
       datasetProperties:
        "org.freenas:description": "{{ parameters.[csi.storage.k8s.io/pvc/namespace] }}/{{ parameters.[csi.storage.k8s.io/pvc/name] }}"

truenas-iscsi-enc1.yaml

@@ -29,9 +29,9 @@ driver:
     httpConnection:
       protocol: https
       host: driveripper.reeselink.com
-      port: 8443
+      port: 443
       apiKey: ""
-      allowInsecure: true
+      allowInsecure: false
     zfs:
       datasetProperties:
        "org.freenas:description": "{{ parameters.[csi.storage.k8s.io/pvc/namespace] }}/{{ parameters.[csi.storage.k8s.io/pvc/name] }}"

truenas-nfs-enc1.yaml

@@ -25,7 +25,7 @@ driver:
     httpConnection:
       protocol: https
       host: driveripper.reeselink.com
-      port: 8443
+      port: 443
       apiKey: ""
       allowInsecure: true
     zfs: