k3s init
This commit is contained in:
@@ -0,0 +1,26 @@
|
||||
{
|
||||
networking.firewall.allowedTCPPorts = [ 6443 80 443 10000 33073 ];
|
||||
networking.firewall.allowedUDPPorts = [ 3478 ];
|
||||
networking.firewall.allowedUDPPortRanges = [
|
||||
{ from = 49152; to = 65535; }
|
||||
];
|
||||
|
||||
services.k3s = {
|
||||
enable = true;
|
||||
role = "server";
|
||||
manifests = {
|
||||
traefik-namespace = { source = ./traefik/namespace.yaml; };
|
||||
traefik-rbac = { source = ./traefik/rbac.yaml; };
|
||||
traefik-pvc = { source = ./traefik/pvc.yaml; };
|
||||
traefik-deployment = { source = ./traefik/deployment.yaml; };
|
||||
traefik-service = { source = ./traefik/service.yaml; };
|
||||
netbird-namespace = { source = ./netbird/namespace.yaml; };
|
||||
netbird-secrets = { source = ./netbird/secrets.yaml; };
|
||||
netbird-coturn = { source = ./netbird/coturn.yaml; };
|
||||
netbird-signal = { source = ./netbird/signal.yaml; };
|
||||
netbird-management = { source = ./netbird/management.yaml; };
|
||||
netbird-relay = { source = ./netbird/relay.yaml; };
|
||||
netbird-ingress = { source = ./netbird/ingress.yaml; };
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,31 @@
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: coturn
|
||||
namespace: netbird
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: coturn
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: coturn
|
||||
spec:
|
||||
hostNetwork: true
|
||||
containers:
|
||||
- name: coturn
|
||||
image: coturn/coturn
|
||||
args:
|
||||
- --log-file=stdout
|
||||
- --external-ip=archfox.org
|
||||
- --listening-port=3478
|
||||
- --min-port=49152
|
||||
- --max-port=65535
|
||||
- --tls-listening-port=5349
|
||||
- --no-tls
|
||||
- --no-dtls
|
||||
- --realm=netbird.archfox.org
|
||||
securityContext:
|
||||
capabilities:
|
||||
add: ["NET_BIND_SERVICE"]
|
||||
@@ -0,0 +1,33 @@
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: netbird-management
|
||||
namespace: netbird
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`netbird.archfox.org`) && PathPrefix(`/management.ManagementService/`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: management
|
||||
port: 80
|
||||
scheme: h2c
|
||||
- match: Host(`netbird.archfox.org`) && PathPrefix(`/api/`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: management
|
||||
port: 80
|
||||
- match: Host(`netbird.archfox.org`) && PathPrefix(`/signalexchange.SignalExchange/`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: signal
|
||||
port: 10000
|
||||
scheme: h2c
|
||||
- match: Host(`netbird.archfox.org`) && PathPrefix(`/relay`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: relay
|
||||
port: 33073
|
||||
tls:
|
||||
certResolver: letsencrypt
|
||||
@@ -0,0 +1,62 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: management
|
||||
namespace: netbird
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: management
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: management
|
||||
spec:
|
||||
containers:
|
||||
- name: management
|
||||
image: netbirdio/management:latest
|
||||
args:
|
||||
- --port=80
|
||||
- --log-file=stdout
|
||||
- --log-level=info
|
||||
- --disable-anonymous-metrics=false
|
||||
- --single-account-mode-domain=netbird.archfox.org
|
||||
- --dns-domain=netbird.archfox.org
|
||||
env:
|
||||
- name: NETBIRD_STORE_ENGINE
|
||||
value: "sqlite"
|
||||
ports:
|
||||
- containerPort: 80
|
||||
volumeMounts:
|
||||
- name: mgmt-data
|
||||
mountPath: /var/lib/netbird
|
||||
volumes:
|
||||
- name: mgmt-data
|
||||
persistentVolumeClaim:
|
||||
claimName: mgmt-data
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: mgmt-data
|
||||
namespace: netbird
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 2Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: management
|
||||
namespace: netbird
|
||||
spec:
|
||||
selector:
|
||||
app: management
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: 80
|
||||
@@ -0,0 +1,4 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: netbird
|
||||
@@ -0,0 +1,45 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: relay
|
||||
namespace: netbird
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: relay
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: relay
|
||||
spec:
|
||||
containers:
|
||||
- name: relay
|
||||
image: netbirdio/relay:latest
|
||||
env:
|
||||
- name: NB_LOG_LEVEL
|
||||
value: "info"
|
||||
- name: NB_LISTEN_ADDRESS
|
||||
value: ":33073"
|
||||
- name: NB_EXPOSED_ADDRESS
|
||||
value: "rels://netbird.archfox.org:443/relay"
|
||||
- name: NB_AUTH_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: netbird-secrets
|
||||
key: relay-auth-secret
|
||||
ports:
|
||||
- containerPort: 33073
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: relay
|
||||
namespace: netbird
|
||||
spec:
|
||||
selector:
|
||||
app: relay
|
||||
ports:
|
||||
- name: relay
|
||||
port: 33073
|
||||
targetPort: 33073
|
||||
@@ -0,0 +1,9 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: netbird-secrets
|
||||
namespace: netbird
|
||||
type: Opaque
|
||||
stringData:
|
||||
# Generate with: openssl rand -base64 32
|
||||
relay-auth-secret: "CHANGE_ME_openssl_rand_-base64_32"
|
||||
@@ -0,0 +1,55 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: signal
|
||||
namespace: netbird
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: signal
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: signal
|
||||
spec:
|
||||
containers:
|
||||
- name: signal
|
||||
image: netbirdio/signal:latest
|
||||
env:
|
||||
- name: COALESCE_INTERVAL
|
||||
value: "5s"
|
||||
ports:
|
||||
- containerPort: 10000
|
||||
volumeMounts:
|
||||
- name: signal-data
|
||||
mountPath: /var/lib/netbird
|
||||
volumes:
|
||||
- name: signal-data
|
||||
persistentVolumeClaim:
|
||||
claimName: signal-data
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: signal-data
|
||||
namespace: netbird
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: signal
|
||||
namespace: netbird
|
||||
spec:
|
||||
selector:
|
||||
app: signal
|
||||
ports:
|
||||
- name: grpc
|
||||
port: 10000
|
||||
targetPort: 10000
|
||||
@@ -0,0 +1,43 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: traefik
|
||||
namespace: traefik
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: traefik
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: traefik
|
||||
spec:
|
||||
serviceAccountName: traefik
|
||||
containers:
|
||||
- name: traefik
|
||||
image: traefik:v3.4
|
||||
args:
|
||||
- --log.level=INFO
|
||||
- --api.dashboard=true
|
||||
- --entrypoints.web.address=:80
|
||||
- --entrypoints.websecure.address=:443
|
||||
- --entrypoints.web.http.redirections.entrypoint.to=websecure
|
||||
- --entrypoints.web.http.redirections.entrypoint.scheme=https
|
||||
- --providers.kubernetescrd=true
|
||||
- --providers.kubernetesingress=true
|
||||
- --certificatesresolvers.letsencrypt.acme.email=poslop@archfox.org
|
||||
- --certificatesresolvers.letsencrypt.acme.storage=/data/acme.json
|
||||
- --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
|
||||
ports:
|
||||
- name: web
|
||||
containerPort: 80
|
||||
- name: websecure
|
||||
containerPort: 443
|
||||
volumeMounts:
|
||||
- name: acme-storage
|
||||
mountPath: /data
|
||||
volumes:
|
||||
- name: acme-storage
|
||||
persistentVolumeClaim:
|
||||
claimName: traefik-acme
|
||||
@@ -0,0 +1,4 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: traefik
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: traefik-acme
|
||||
namespace: traefik
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 128Mi
|
||||
@@ -0,0 +1,38 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: traefik
|
||||
namespace: traefik
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: traefik
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["services", "endpoints", "secrets"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["extensions", "networking.k8s.io"]
|
||||
resources: ["ingresses", "ingressclasses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["extensions", "networking.k8s.io"]
|
||||
resources: ["ingresses/status"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["traefik.io"]
|
||||
resources: ["ingressroutes", "ingressroutetcps", "ingressrouteudps", "middlewares",
|
||||
"middlewaretcps", "tlsoptions", "tlsstores", "traefikservices",
|
||||
"serverstransports", "serverstransporttcps"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: traefik
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: traefik
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: traefik
|
||||
namespace: traefik
|
||||
@@ -0,0 +1,16 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: traefik
|
||||
namespace: traefik
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
selector:
|
||||
app: traefik
|
||||
ports:
|
||||
- name: web
|
||||
port: 80
|
||||
targetPort: 80
|
||||
- name: websecure
|
||||
port: 443
|
||||
targetPort: 443
|
||||
Reference in New Issue
Block a user