Updated documentation

2021-06-14 16:42:22 +02:00 · 2021-06-14 16:42:22 +02:00 · 033ddc61ca
commit 033ddc61ca
parent c6a9c7ab35
4 changed files with 32 additions and 509 deletions
--- a/README.md
+++ b/README.md
@ -23,7 +23,7 @@ mount -a

 </details>

-## K3s cluster 
+## K3s cluster
 On first node:
 ```shell
 curl -sfL https://get.k3s.io | sh -s - --disable local-path,traefik
@ -100,7 +100,7 @@ Expose Longhorn's dashboard through  `IngressRoute`:
 ```shell
 kubectl apply -f storage/Longhorn/ingressRoute-Longhorn.yml
 ```
-Add additional `storageClass` with backup schedule:  
+Add additional `storageClass` with backup schedule:
 ***After** specifying a NFS backup target (syntax: `nfs://servername:/path/to/share`) through Longhorn's dashboard*
 ```yaml
 kind: StorageClass
@ -151,23 +151,24 @@ kubectl delete ingressroute traefik-dashboard --namespace kube-system
 ```

 ### 3) Secret management
-*Perform these steps **after** configuring persistent storage **and** ingress*  
+*Perform these steps **after** configuring persistent storage **and** ingress*
 ##### 3.1) Create `persistentVolume` and `ingressRoute`
-*Requires specifying a `uid` & `gid` in the flexvolSMB-`persistentVolume`*  
+*Requires specifying a `uid` & `gid` in the flexvolSMB-`persistentVolume`*
 ```shell
 kubectl create namespace vault
 kubectl apply -f services/Vault/persistentVolume-Vault.yml
 kubectl apply -f services/Vault/ingressRoute-Vault.yml
 ```
 ##### 3.2) Install Helm Chart
-See [HashiCorp Vault](https://www.vaultproject.io/docs/platform/k8s/helm/run):  
+*REMOVED; left for reference*
+See [HashiCorp Vault](https://www.vaultproject.io/docs/platform/k8s/helm/run):
 ```shell
 helm repo add hashicorp https://helm.releases.hashicorp.com
 helm repo update
 helm install vault hashicorp/vault --namespace vault --values=services/Vault/chart-values.yml
 ```
 Configure Vault for use;
- Enable Kubernetes authentication (see https://www.vaultproject.io/api-docs/auth/kubernetes)
+- ~~Enable Kubernetes authentication (see https://www.vaultproject.io/api-docs/auth/kubernetes)~~
 - Store basic access policy template
 - Enable `kv`-engine
 ```
@ -175,11 +176,6 @@ Configure Vault for use;

 # It might be necessary to first login with an existing token:
 # vault login
-vault auth enable kubernetes
-vault write auth/kubernetes/config \
-   token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
-   kubernetes_host=https://${KUBERNETES_PORT_443_TCP_ADDR}:443 \
-   kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt

 cat <<EOF > /home/vault/app-policy.hcl
 path "secret*" {
@ -206,41 +202,17 @@ vault write auth/kubernetes/role/adminer \
  ttl=1h
 vault policy write adminer /home/vault/app-policy.hcl
 ```
-##### 4.2) [Bitwarden_rs](https://github.com/dani-garcia/bitwarden_rs)    <small>(password manager)</small>
+##### 4.2) [Vaultwarden](https://github.com/dani-garcia/vaultwarden)    <small>(password manager)</small>
 *Requires [mount.cifs](https://linux.die.net/man/8/mount.cifs)' option `nobrl`*
 ```shell
+kubectl apply -f services/Bitwarden/secret-Bitwarden.yml
 kubectl apply -f services/Bitwarden/deploy-Bitwarden.yml
 ```
-Vault configuration:
-```
-vault kv put secret/bitwarden \
-  admintoken=<value> \
-  yubicoclientid=<value> \
-  yubicosecretkey=<value>
-vault write auth/kubernetes/role/bitwarden \
-  bound_service_account_names=bitwarden \
-  bound_service_account_namespaces=default \
-  policies=bitwarden \
-  ttl=1h
-vault policy write bitwarden /home/vault/app-policy.hcl
-```
 ##### 4.3) [DroneCI](https://drone.io/)    <small>(contineous delivery)</small>
 ```shell
+kubectl apply -f services/DroneCI/secret-DroneCI.yml
 kubectl apply -f services/DroneCI/deploy-DroneCI.yml
 ```
-Vault configuration:
-```
-vault kv put secret/drone \
-  rpcsecret=<value> \
-  giteaclientid=<value> \
-  giteaclientsecret=<value>
-vault write auth/kubernetes/role/drone \
-  bound_service_account_names=drone \
-  bound_service_account_namespaces=default \
-  policies=drone \
-  ttl=1h
-vault policy write drone /home/vault/app-policy.hcl
-```
 ##### 4.4) [Gitea](https://gitea.io/)    <small>(git repository)</small>
 ```shell
 kubectl apply -f services/Gitea/deploy-Gitea.yml
@ -263,31 +235,28 @@ kubectl rollout restart deployment guacamole
 ```

 ##### 4.7) [Lighttpd](https://www.lighttpd.net/)    <small>(webserver)</small>
-*Serves various semi-containerized websites; respective webcontent is stored on fileshare*  
+*Serves various semi-containerized websites; respective webcontent is stored on fileshare*
 ```shell
 kubectl apply -f services/Lighttpd/configMap-Lighttpd.yml
 kubectl apply -f services/Lighttpd/deploy-Lighttpd.yml
 kubectl apply -f services/Lighttpd/cronJob-Spotweb.yml
 ```
-##### 4.8) [Matrix]()    <small>(federated chat)</small>
-*WIP*
-```shell
-kubectl apply -f services/Matrix/configMap-Matrix.yml
-kubectl apply -f services/Matrix/middleware-Matrix.yml
-kubectl apply -f services/Matrix/deploy-Matrix.yml
-```
-##### 4.9) PVR `namespace`    <small>(automated media management)</small>
+##### 4.8) PVR `namespace`    <small>(automated media management)</small>
 *Containers use shared resources to be able to interact with downloaded files*
 ```shell
 kubectl create secret generic --type=mount/smb smb-secret --from-literal=username=<<omitted>> --from-literal=password=<<omitted>> -n pvr
 kubectl apply -f services/PVR/persistentVolumeClaim-PVR.yml
 kubectl apply -f services/PVR/storageClass-PVR.yml
 ```
-###### 4.9.1) [NZBHydra](https://github.com/theotherp/nzbhydra2)    <small>(index aggregator)</small>
+###### 4.8.1) [NZBHydra](https://github.com/theotherp/nzbhydra2)    <small>(index aggregator)</small>
 ```shell
 kubectl apply -f services/PVR/deploy-NZBHydra.yml
 ```
-###### 4.9.2) [Plex](https://www.plex.tv/)    <small>(media library)</small>
+###### 4.8.2) [Overseerr](https://overseerr.dev/)    <small>(request management)</small>
+```shell
+kubectl apply -f services/PVR/deploy-Overseerr.yml
+```
+###### 4.8.3) [Plex](https://www.plex.tv/)    <small>(media library)</small>
 *Due to usage of symlinks, partially incompatible with SMB-share-backed storage*
 ```shell
 kubectl apply -f services/PVR/deploy-Plex.yml
@ -297,36 +266,36 @@ After deploying, Plex server needs to be *claimed* (=assigned to Plex-account):
 kubectl get endpoints Plex -n PVR
 ```
 Browse to the respective IP address (http://<nodeipaddress>:32400/web) and follow instructions.
-###### 4.9.3) [Radarr](https://radarr.video/)    <small>(movie management)</small>
+###### 4.8.4) [Radarr](https://radarr.video/)    <small>(movie management)</small>
 ```shell
 kubectl apply -f services/PVR/deploy-Radarr.yml
 ```
-###### 4.9.4) [Readarr](https://readarr.com/)    <small>(book management)</small>
+###### 4.8.5) [Readarr](https://readarr.com/)    <small>(book management)</small>
 ```shell
 kubectl apply -f services/PVR/deploy-Readarr.yml
 ```
-###### 4.9.5) [SABnzbd](https://sabnzbd.org/)    <small>(download client)</small>
+###### 4.8.6) [SABnzbd](https://sabnzbd.org/)    <small>(download client)</small>
 ```shell
 kubectl apply -f services/PVR/deploy-SABnzbd.yml
 ```
-###### 4.9.6) [Sonarr](https://sonarr.tv/)    <small>(tv management)</small>
+###### 4.8.7) [Sonarr](https://sonarr.tv/)    <small>(tv management)</small>
 ```shell
 kubectl apply -f services/PVR/deploy-Sonarr.yml
 ```

-##### 4.10) [Shaarli](https://github.com/shaarli/Shaarli)    <small>(bookmarks/notes)</small>
+##### 4.9) [Shaarli](https://github.com/shaarli/Shaarli)    <small>(bookmarks/notes)</small>
 ```shell
 kubectl apply -f services/Shaarli/deploy-Shaarli.yml
 ```
-##### 4.11) [Theia](https://theia-ide.org/)    <small>(web IDE)</small>
+##### 4.10) [Theia](https://theia-ide.org/)    <small>(web IDE)</small>
 ```shell
 kubectl apply -f services/Theia/deploy-Theia.yml
 ```
-##### 4.12) [Traefik-Certs-Dumper](https://github.com/ldez/traefik-certs-dumper)    <small>(certificate tooling)</small>
+##### 4.11) [Traefik-Certs-Dumper](https://github.com/ldez/traefik-certs-dumper)    <small>(certificate tooling)</small>
 ```shell
 kubectl apply -f services/TraefikCertsDumper/deploy-TraefikCertsDumper.yml
 ```
-##### 4.13) [Unifi-Controller]()    <small>(wlan AP management)</small>
+##### 4.12) [Unifi-Controller]()    <small>(wlan AP management)</small>
 ```shell
 kubectl apply -f services/Unifi/deploy-Unifi.yml
 ```
@ -343,26 +312,26 @@ ssh <username>@<ipaddress>
 sed -e 's|stun://<ipaddress>|stun://<ipaddress>:3479|' -i /etc/persistent/cfg/mgmt
 ```
 ### 5) Miscellaneous
-*Various notes/useful links*  
+*Various notes/useful links*

 * Replacement for [not-yet-deprecated](https://github.com/kubernetes/kubectl/issues/151) `kubectl get all -A`:

-      
+
      kubectl get $(kubectl api-resources --verbs=list -o name | paste -sd, -) --ignore-not-found --all-namespaces
 * `DaemonSet` to configure nodes' **sysctl** `fs.inotify.max-user-watches`:

-      
+
      kubectl apply -f system/InotifyMaxWatchers/daemonSet-InotifyMaxWatchers.yml
 * Debug DNS lookups within the cluster:

-      
+
      kubectl run -it --rm dnsutils --restart=Never --image=gcr.io/kubernetes-e2e-test-images/dnsutils -- nslookup [-debug] [fqdn]
  or
-      
+
      kubectl run -it --rm busybox --restart=Never --image=busybox:1.28 -- nslookup api.github.com [-debug] [fqdn]
 * Delete namespaces stuck in `Terminating` state:

-      
+
      kubectl get namespace <name> -o json | jq -j '.spec.finalizers=null' > tmp.json
      kubectl replace --raw "/api/v1/namespaces/<name>/finalize" -f ./tmp.json
      rm ./tmp.json
--- a/services/Matrix.WIP/configMap-Matrix.yml
+++ b/services/Matrix.WIP/configMap-Matrix.yml
@ -1,57 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: configmap-matrix-config
-  namespace: matrix
-data:
-  config.json: |
-    {
-      "default_server_config": {
-          "m.homeserver": {
-              "base_url": "https://synapse.chat.spamasaurus.com",
-              "server_name": "Familie Bessems"
-          },
-          "m.identity_server": {
-              "base_url": "https://vector.im"
-          }
-      },
-      "disable_custom_urls": true,
-      "disable_guests": false,
-      "disable_login_language_selector": false,
-      "disable_3pid_login": false,
-      "brand": "Element",
-      "integrations_ui_url": "https://scalar.vector.im/",
-      "integrations_rest_url": "https://scalar.vector.im/api",
-      "integrations_widgets_urls": [
-          "https://scalar.vector.im/_matrix/integrations/v1",
-          "https://scalar.vector.im/api",
-          "https://scalar-staging.vector.im/_matrix/integrations/v1",
-          "https://scalar-staging.vector.im/api",
-          "https://scalar-staging.riot.im/scalar/api"
-      ],
-      "bug_report_endpoint_url": "https://element.io/bugreports/submit",
-      "defaultCountryCode": "NL",
-      "showLabsSettings": true,
-      "features": {
-          "feature_new_spinner": true
-      },
-      "default_federate": true,
-      "default_theme": "light",
-      "roomDirectory": {
-          "servers": [
-              "matrix.org"
-          ]
-      },
-      "piwik": false,
-      "enable_presence_by_hs_url": {
-          "https://matrix.org": false,
-          "https://matrix-client.matrix.org": false
-      },
-      "settingDefaults": {
-          "breadcrumbs": true,
-          "UIFeature.communities": false
-      },
-      "jitsi": {
-          "preferredDomain": "jitsi.riot.im"
-      }
-    }
--- a/services/Matrix.WIP/deploy-Matrix.yml
+++ b/services/Matrix.WIP/deploy-Matrix.yml
@ -1,370 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: matrix
-  namespace: matrix
-spec:
-  ports:
-    - protocol: TCP
-      name: synapse
-      port: 8008
-    - protocol: TCP
-      name: db
-      port: 5432
-    - protocol: TCP
-      name: element
-      port: 80
-  selector:
-    app: matrix
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: identity
-  namespace: matrix
-spec:
-  ports:
-    - protocol: TCP
-      name: identity
-      port: 8090
-    - protocol: TCP
-      name: db
-      port: 5432
-  selector:
-    app: identity
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: matrix
-  namespace: matrix
-  labels:
-    app: matrix
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: matrix
-  template:
-    metadata:
-      labels:
-        app: matrix
-    spec:
-      containers:
-      - name: synapse
-        image: bv11-cr01.bessems.eu/proxy/matrixdotorg/synapse:latest
-#        args:
-#        - generate
-        env:
-#        - name: SYNAPSE_SERVER_NAME
-#          value: spamasaurus.com
-#        - name: SYNAPSE_REPORT_STATS
-#          value: 'no'
-        - name: SYNAPSE_CONFIG_PATH
-          value: /data/homeserver.yaml
-        ports:
-          - name: synapse
-            containerPort: 8008
-        volumeMounts:
-        - mountPath: /data
-          name: flexvolsmb-matrix-data
-      - name: postgres
-        image: bv11-cr01.bessems.eu/proxy/library/postgres:alpine
-        env:
-        - name: POSTGRES_USER
-          value: synapse
-        - name: POSTGRES_PASSWORD
-          value: synapse
-        - name: POSTGRES_INITDB_ARGS
-          value: --encoding=UTF-8 --lc-collate=C --lc-ctype=C
-        ports:
-          - name: db
-            containerPort: 5432
-        volumeMounts:
-        - mountPath: /var/lib/postgresql/data
-          name: flexvolsmb-matrix-db
-      - name: element
-        image: bv11-cr01.bessems.eu/proxy/vectorim/element-web
-        ports:
-          - name: element
-            containerPort: 80
-        volumeMounts:
-        - name: configmap-matrix-config
-          mountPath: /usr/share/nginx/html/config.json
-          subPath: config.json
-      volumes:
-      - name: flexvolsmb-matrix-data
-        persistentVolumeClaim:
-          claimName: flexvolsmb-matrix-data
-      - name: flexvolsmb-matrix-db
-        persistentVolumeClaim:
-          claimName: flexvolsmb-matrix-db
-      - name: configmap-matrix-config
-        configMap:
-          name: configmap-matrix-config
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: identity
-  namespace: matrix
-  labels:
-    app: identity
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: identity
-  template:
-    metadata:
-      labels:
-        app: identity
-    spec:
-      containers:
-      - name: identity
-        image: bv11-cr01.bessems.eu/library/matrix-identity
-        env:
-        - name: MATRIX_DOMAIN
-          value: chat.spamasaurus.com
-        ports:
-          - name: identity
-            containerPort: 8090
-        volumeMounts:
-        - name: flexvolsmb-identity-etc
-          mountPath: /etc/ma1sd
-        - name: flexvolsmb-identity-var
-          mountPath: /var/ma1sd
-      - name: postgres
-        image: bv11-cr01.bessems.eu/proxy/library/postgres:alpine
-        env:
-        - name: POSTGRES_USER
-          value: identity
-        - name: POSTGRES_PASSWORD
-          value: identity
-        - name: POSTGRES_DATABASE
-          value: identity
-        ports:
-          - name: db
-            containerPort: 5432
-        volumeMounts:
-        - mountPath: /var/lib/postgresql/data
-          name: flexvolsmb-identity-db
-      volumes:
-      - name: flexvolsmb-identity-etc
-        persistentVolumeClaim:
-          claimName: flexvolsmb-identity-etc
-      - name: flexvolsmb-identity-var
-        persistentVolumeClaim:
-          claimName: flexvolsmb-identity-var
-      - name: flexvolsmb-identity-db
-        persistentVolumeClaim:
-          claimName: flexvolsmb-identity-db
---
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
-metadata:
-  name: matrix
-  namespace: matrix
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`synapse.chat.spamasaurus.com`)
-    kind: Rule
-    services:
-    - name: matrix
-      namespace: matrix
-      port: 8008
-    middlewares:
-    - name: security-headers@file
-    - name: compression@file
-    - name: matrix-cors-headers
-  - match: Host(`chat.spamasaurus.com`)
-    kind: Rule
-    services:
-    - name: matrix
-      namespace: matrix
-      port: 80
-    middlewares:
-    - name: security-headers@file
-    - name: compression@file
-    - name: matrix-cors-headers
---
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
-metadata:
-  name: identity
-  namespace: matrix
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`synapse.chat.spamasaurus.com`) && Path(`/_matrix/identity`)
-    kind: Rule
-    services:
-    - name: identity
-      namespace: matrix
-      port: 8090
-    middlewares:
-    - name: security-headers@file
-    - name: compression@file
---
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: flexvolsmb-matrix-data
-spec:
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  storageClassName: flexvolsmb-matrix-data
-  flexVolume:
-    driver: mount/smb
-    secretRef:
-      name: smb-secret
-    options:
-      opts: domain=bessems.eu,file_mode=0777,dir_mode=0777,iocharset=utf8
-      server: 192.168.11.225
-      share: /K3s.Volumes/matrix/synapse.data
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: flexvolsmb-matrix-data
-  namespace: matrix
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: flexvolsmb-matrix-data
-  resources:
-    requests:
-      storage: 1Gi
---
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: flexvolsmb-matrix-db
-spec:
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  storageClassName: flexvolsmb-matrix-db
-  flexVolume:
-    driver: mount/smb
-    secretRef:
-      name: smb-secret
-    options:
-      opts: domain=bessems.eu,file_mode=0600,dir_mode=0700,uid=70,gid=70,iocharset=utf8,nobrl
-      server: 192.168.11.225
-      share: /K3s.Volumes/matrix/synapse.db
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: flexvolsmb-matrix-db
-  namespace: matrix
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: flexvolsmb-matrix-db
-  resources:
-    requests:
-      storage: 1Gi
---
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: flexvolsmb-identity-etc
-spec:
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  storageClassName: flexvolsmb-identity-etc
-  flexVolume:
-    driver: mount/smb
-    secretRef:
-      name: smb-secret
-    options:
-      opts: domain=bessems.eu,file_mode=0777,dir_mode=0777,iocharset=utf8
-      server: 192.168.11.225
-      share: /K3s.Volumes/matrix/identity.etc
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: flexvolsmb-identity-etc
-  namespace: matrix
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: flexvolsmb-identity-etc
-  resources:
-    requests:
-      storage: 1Gi
---
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: flexvolsmb-identity-var
-spec:
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  storageClassName: flexvolsmb-identity-var
-  flexVolume:
-    driver: mount/smb
-    secretRef:
-      name: smb-secret
-    options:
-      opts: domain=bessems.eu,file_mode=0777,dir_mode=0777,iocharset=utf8
-      server: 192.168.11.225
-      share: /K3s.Volumes/matrix/identity.var
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: flexvolsmb-identity-var
-  namespace: matrix
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: flexvolsmb-identity-var
-  resources:
-    requests:
-      storage: 1Gi
---
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: flexvolsmb-identity-db
-spec:
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  storageClassName: flexvolsmb-identity-db
-  flexVolume:
-    driver: mount/smb
-    secretRef:
-      name: smb-secret
-    options:
-      opts: domain=bessems.eu,file_mode=0600,dir_mode=0700,uid=70,gid=70,iocharset=utf8,nobrl
-      server: 192.168.11.225
-      share: /K3s.Volumes/matrix/identity.db
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: flexvolsmb-identity-db
-  namespace: matrix
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: flexvolsmb-identity-db
-  resources:
-    requests:
-      storage: 1Gi
--- a/services/Matrix.WIP/middleware-Matrix.yml
+++ b/services/Matrix.WIP/middleware-Matrix.yml
@ -1,19 +0,0 @@
-apiVersion: traefik.containo.us/v1alpha1
-kind: Middleware
-metadata:
-  name: matrix-cors-headers
-  namespace: matrix
-spec:
-  headers:
-    accessControlAllowHeaders:
-      - "Authorization"
-      - "Content-Type"
-    accessControlAllowMethods:
-      - "GET"
-      - "OPTIONS"
-      - "PUT"
-    accessControlAllowOriginList:
-      - "https://chat.spamasaurus.com"
-      - "https://synapse.chat.spamasaurus.com"
-    accessControlMaxAge: 100
-    addVaryHeader: true