jv
/
my-homelab-configs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Compare commits

base: jv:84b60979f2e4b368c2d04e3fde3c90605a166dfb
Branches Tags
jv:main
..
compare: jv:39d500866c9bf5c59d02a974411e5df475480b91
Branches Tags
jv:main

No commits in common. "84b60979f2e4b368c2d04e3fde3c90605a166dfb" and "39d500866c9bf5c59d02a974411e5df475480b91" have entirely different histories.
84b60979f2 ... 39d500866c

19 changed files with 68 additions and 67 deletions
Show Stats Expand all files Collapse all files

6
.gitea/workflows/homelab-main.yml
View File

@ -16,12 +16,12 @@ jobs:
find . -mindepth 1 -maxdepth 1 -exec rm -rf -- {} + find . -mindepth 1 -maxdepth 1 -exec rm -rf -- {} +
git init git init
git remote add origin ssh://git@192.168.100.73:32222/jv/my-homelab-configs.git git remote add origin https://lab2025.duckdns.org/git/jv/my-homelab-configs.git
git fetch --prune origin +refs/heads/main:refs/remotes/origin/main +refs/tags/*:refs/tags/* git fetch --prune origin +refs/heads/main:refs/remotes/origin/main +refs/tags/*:refs/tags/*
git checkout --force "${{ gitea.sha }}" git checkout --force "${{ gitea.sha }}"
git config --global --add safe.directory "$PWD" git config --global --add safe.directory "$PWD"
- name: Block automatic deploy for external Gitea changes - name: Block automatic deploy for Raspberry Pi Gitea changes
run: | run: |
set -euo pipefail set -euo pipefail
@ -115,7 +115,7 @@ jobs:
if [[ -n "${blocked_files}" ]]; then if [[ -n "${blocked_files}" ]]; then
printf '%s\n' "${blocked_files}" printf '%s\n' "${blocked_files}"
echo "External Gitea service changes require a manual Debian run." echo "Raspberry Pi Gitea service changes require a manual Debian run."
exit 1 exit 1
fi fi

53
README.md
View File

@ -142,8 +142,8 @@ cd ~/my-homelab-configs
./lab.sh up ./lab.sh up
``` ```
The script first deploys external Gitea to the Debian host with Docker Compose The script first deploys external Gitea to the Raspberry Pi with Docker Compose
under `/data/homelab-gitea`, backed by the HP laptop NVMe, so Git stays under `/data/homelab-gitea`, backed by the Raspberry Pi SSD, so Git stays
outside the Kubernetes rebuild blast radius. It then detects the outside the Kubernetes rebuild blast radius. It then detects the
Pimox host at `192.168.100.80` in auto mode. When SSH, `qm`, and `vmbr0` are Pimox host at `192.168.100.80` in auto mode. When SSH, `qm`, and `vmbr0` are
available, it applies `bootstrap/provisioning`, creates or reuses the Debian 13 available, it applies `bootstrap/provisioning`, creates or reuses the Debian 13
@ -197,8 +197,8 @@ translation endpoints such as `save_idea.php`, `visitor_ideas.php`,
`translate.php`, and `save_lang.php`. `translate.php`, and `save_lang.php`.
Set `LAB_GITEA_DEPLOY=false` to skip the external Gitea deployment step when the Set `LAB_GITEA_DEPLOY=false` to skip the external Gitea deployment step when the
service is already managed manually. The default Gitea target is Raspberry Pi service is already managed manually. The default Gitea target is
`jv@192.168.100.73`, install directory `/data/homelab-gitea`, HTTP port `3000`, `jv@192.168.100.89`, install directory `/data/homelab-gitea`, HTTP port `3000`,
and SSH port `32222`. and SSH port `32222`.
## Validation ## Validation
@ -215,7 +215,7 @@ kubectl -n website-production get pods -o wide
kubectl -n demos-static get pods -o wide kubectl -n demos-static get pods -o wide
kubectl -n heimdall get pods -o wide kubectl -n heimdall get pods -o wide
ssh jv@192.168.100.73 'cd /data/homelab-gitea && sudo docker compose ps' ssh jv@192.168.100.89 'cd /data/homelab-gitea && sudo docker compose ps'
docker info --format '{{.DockerRootDir}}' docker info --format '{{.DockerRootDir}}'
df -h / /data /data/openebs/local /data/docker df -h / /data /data/openebs/local /data/docker
@ -250,12 +250,13 @@ Run a full cluster rebuild from the Debian server with:
./lab.sh rebuild-cluster ./lab.sh rebuild-cluster
``` ```
That path preserves external Gitea, rebuilds the Pimox template That path preserves external Raspberry Pi Gitea, rebuilds the Pimox template
with 2 cores and 4 GiB memory, replaces two Pimox worker VMs with 2 cores and with 2 cores and 4 GiB memory, replaces two Pimox worker VMs with 2 cores and
4 GiB memory, and joins those workers to the Kubernetes cluster. CPU affinity is 4 GiB memory, and joins those workers to the Kubernetes cluster. CPU affinity is
disabled by default because the Bullseye-pinned Pimox `qm` does not support it. disabled by default because the Bullseye-pinned Pimox `qm` does not support it.
The Raspberry Pi is still included as a Kubernetes worker by default; `nuke` The Raspberry Pi is still included as a Kubernetes worker by default; `nuke`
does not clean it unless you explicitly add it to `WORKER_SSH_TARGETS`. does not clean it unless you explicitly add it to `WORKER_SSH_TARGETS`, so the
external Gitea Docker service survives cluster rebuilds.
To exclude the Raspberry Pi from the Kubernetes cluster, set To exclude the Raspberry Pi from the Kubernetes cluster, set
`LAB_INCLUDE_RASPBERRY_WORKER=false`. To manage workers manually instead, add `LAB_INCLUDE_RASPBERRY_WORKER=false`. To manage workers manually instead, add
@ -286,7 +287,7 @@ duplicate those PV manifests when you want storage on another node.
`homelab.dev/workload-class=control-plane` on the Debian control plane `homelab.dev/workload-class=control-plane` on the Debian control plane
- `homelab.dev/node-role=edge-app`, `homelab.dev/storage=local`, and - `homelab.dev/node-role=edge-app`, `homelab.dev/storage=local`, and
`homelab.dev/workload-class=edge` on the Raspberry Pi worker `homelab.dev/workload-class=edge` on the Raspberry Pi worker
- `homelab.dev/node-role=app`, `homelab.dev/storage=ssd`, and - `homelab.dev/node-role=app`, `homelab.dev/storage=nvme`, and
`homelab.dev/workload-class=platform` on automated Pimox worker clones when `homelab.dev/workload-class=platform` on automated Pimox worker clones when
those workers are enabled those workers are enabled
@ -389,8 +390,8 @@ are clean, individual policies can be promoted to `Enforce` in
`apps/supply-chain-policy` adds a separate Kyverno `ImageValidatingPolicy` for `apps/supply-chain-policy` adds a separate Kyverno `ImageValidatingPolicy` for
the images built by this repo and pushed to the local registry. The policy the images built by this repo and pushed to the local registry. The policy
targets `192.168.100.73:30500/php-website:*` and targets `192.168.100.68:30500/php-website:*` and
`192.168.100.73:30500/demos-static:*`, mutates admitted pods to image digests, `192.168.100.68:30500/demos-static:*`, mutates admitted pods to image digests,
and audits whether the image has both: and audits whether the image has both:
- a valid Cosign signature from the homelab signing key - a valid Cosign signature from the homelab signing key
@ -512,7 +513,7 @@ than a `/heimdall/` path.
The `n8n` app runs in the `n8n` namespace with retained OpenEBS storage and is The `n8n` app runs in the `n8n` namespace with retained OpenEBS storage and is
exposed at `https://n8n.lab2025.duckdns.org`. It receives exposed at `https://n8n.lab2025.duckdns.org`. It receives
`OLLAMA_BASE_URL=http://192.168.100.73:11434` so workflows can call the existing `OLLAMA_BASE_URL=http://192.168.100.68:11434` so workflows can call the existing
Debian-host Ollama API for translation prewarming and batch jobs. Debian-host Ollama API for translation prewarming and batch jobs.
The `arr-stack` app runs Prowlarr, Sonarr, Radarr, qBittorrent, Kapowarr, The `arr-stack` app runs Prowlarr, Sonarr, Radarr, qBittorrent, Kapowarr,
@ -538,14 +539,14 @@ Buildx state, and image caches from filling `/`.
## Gitea ## Gitea
Gitea is external bootstrap infrastructure. It runs on the Debian host as an Gitea is external bootstrap infrastructure. It runs on the Raspberry Pi as an
always-on Docker Compose service from `infra/gitea/docker-compose.yml`, not as a always-on Docker Compose service from `infra/gitea/docker-compose.yml`, not as a
Kubernetes workload. This keeps Git available when the Kubernetes cluster is Kubernetes workload. This keeps Git available when the Kubernetes cluster is
destroyed and rebuilt. destroyed and rebuilt.
The default data path is `/data/homelab-gitea/data` on the HP laptop NVMe. The The default data path is `/data/homelab-gitea/data` on the Raspberry Pi SSD.
Docker root is also expected to live on the `/data` storage path rather than the The Raspberry Pi Docker root is also expected to live on the SSD-backed `/data`
root filesystem. mount rather than the SD card.
Public source browsing stays available through Public source browsing stays available through
`https://lab2025.duckdns.org/git/`. Registration is disabled and anonymous users `https://lab2025.duckdns.org/git/`. Registration is disabled and anonymous users
@ -577,16 +578,16 @@ Deploy or refresh the external Gitea container from the Debian host with:
## Gitea Backups ## Gitea Backups
`./lab.sh up` installs a Debian-host systemd timer named `./lab.sh up` installs a Debian-host systemd timer named
`homelab-gitea-backup.timer`. The timer runs daily, SSHes to the configured `homelab-gitea-backup.timer`. The timer runs daily, SSHes to the Raspberry Pi,
Gitea host, executes `gitea dump` inside the Gitea Docker container, copies the executes `gitea dump` inside the Gitea Docker container, copies the dump back to
dump back to Debian, and stores it under `/home/jv/backups/gitea`. The default Debian, and stores it under `/home/jv/backups/gitea`. The default retention is
retention is 30 days. 30 days.
The same install step also creates `homelab-gitea-restore-drill.timer`. The The same install step also creates `homelab-gitea-restore-drill.timer`. The
monthly drill is non-destructive: it verifies the latest backup ZIP, extracts it monthly drill is non-destructive: it verifies the latest backup ZIP, extracts it
to a temporary directory, records a report under to a temporary directory, records a report under
`/home/jv/backups/gitea-restore-drills`, and removes the temporary extract. It `/home/jv/backups/gitea-restore-drills`, and removes the temporary extract. It
does not write into the live Gitea data directory. does not write into the live Raspberry Pi Gitea data directory.
Run a manual backup from the Debian server with: Run a manual backup from the Debian server with:
@ -616,7 +617,7 @@ This repo includes a Gitea Actions workflow at
`.gitea/workflows/homelab-main.yml`. It runs only on pushes to `main` and targets `.gitea/workflows/homelab-main.yml`. It runs only on pushes to `main` and targets
a repository-scoped Debian host runner with the label `homelab-debian`. a repository-scoped Debian host runner with the label `homelab-debian`.
The workflow only blocks automatic deploy for external Gitea service The workflow only blocks automatic deploy for Raspberry Pi Gitea service
changes: files under `infra/gitea/`, or edits inside the `deploy_gitea`, changes: files under `infra/gitea/`, or edits inside the `deploy_gitea`,
`install_gitea_backup_timer`, `backup_gitea`, or `drill_gitea_restore` `install_gitea_backup_timer`, `backup_gitea`, or `drill_gitea_restore`
functions in `lab.sh`. Other changes use `HOMELAB_ACTION_COMMAND=auto` by functions in `lab.sh`. Other changes use `HOMELAB_ACTION_COMMAND=auto` by
@ -630,7 +631,7 @@ on the runner to force one path.
`./lab.sh bootstrap-gitea-repo` also registers the Debian host SSH public key `./lab.sh bootstrap-gitea-repo` also registers the Debian host SSH public key
with the Gitea repository and switches the Debian working copy's `gitea` remote with the Gitea repository and switches the Debian working copy's `gitea` remote
to `ssh://git@192.168.100.73:32222/jv/my-homelab-configs.git`. The default key to `ssh://git@192.168.100.89:32222/jv/my-homelab-configs.git`. The default key
is `/home/jv/.ssh/id_ed25519.pub`; set `LAB_GITEA_REPO_SSH_KEY_PATH` to use a is `/home/jv/.ssh/id_ed25519.pub`; set `LAB_GITEA_REPO_SSH_KEY_PATH` to use a
different Debian-host key, or `LAB_GITEA_REPO_SSH_BOOTSTRAP=false` to leave SSH different Debian-host key, or `LAB_GITEA_REPO_SSH_BOOTSTRAP=false` to leave SSH
access unchanged. The Actions deploy job uses the checked-out Actions workspace access unchanged. The Actions deploy job uses the checked-out Actions workspace
@ -683,8 +684,8 @@ links, iptables rules, and local OpenTofu state. It does not delete retained dat
under `/data/openebs/local`. under `/data/openebs/local`.
For multi-node labs, set `WORKER_SSH_TARGETS` to a space-separated list of SSH For multi-node labs, set `WORKER_SSH_TARGETS` to a space-separated list of SSH
targets. It defaults to an empty string so worker nodes are not cleaned unless targets. It defaults to an empty string so the Raspberry Pi Gitea host is not
you explicitly include them. cleaned unless you explicitly include it.
## Website App ## Website App
@ -712,7 +713,7 @@ website image that points at it:
``` ```
Ollama must also listen on the Debian host LAN address so Kubernetes pods on Ollama must also listen on the Debian host LAN address so Kubernetes pods on
other nodes can reach `OLLAMA_HOST=http://192.168.100.73:11434`: other nodes can reach `OLLAMA_HOST=http://192.168.100.68:11434`:
```bash ```bash
./lab.sh website-ollama-listen ./lab.sh website-ollama-listen
@ -746,7 +747,7 @@ immutable. The Kyverno supply-chain policy mutates admitted pods to the verified
image digest, so the workload runs the same digest that was signed and attested. image digest, so the workload runs the same digest that was signed and attested.
After `./lab.sh apps`, the live deployment image should be a content-hash tag, After `./lab.sh apps`, the live deployment image should be a content-hash tag,
for example `192.168.100.73:30500/php-website:src-...`. If it still shows for example `192.168.100.68:30500/php-website:src-...`. If it still shows
`php-website:latest`, Argo CD has not rendered the current Application source. `php-website:latest`, Argo CD has not rendered the current Application source.
Check the `website-production` Application source, sync status, and repository Check the `website-production` Application source, sync status, and repository
access before restarting pods. access before restarting pods.

2
apps/demos-static/web-app.yaml
View File

@ -25,7 +25,7 @@ spec:
fsGroupChangePolicy: OnRootMismatch fsGroupChangePolicy: OnRootMismatch
containers: containers:
- name: demos-static - name: demos-static
image: 192.168.100.73:30500/demos-static:latest image: 192.168.100.68:30500/demos-static:latest
imagePullPolicy: Always imagePullPolicy: Always
securityContext: securityContext:
allowPrivilegeEscalation: false allowPrivilegeEscalation: false

2
apps/n8n/web-app.yaml
View File

@ -69,7 +69,7 @@ spec:
- name: N8N_RUNNERS_ENABLED - name: N8N_RUNNERS_ENABLED
value: "true" value: "true"
- name: OLLAMA_BASE_URL - name: OLLAMA_BASE_URL
value: http://192.168.100.73:11434 value: http://192.168.100.68:11434
ports: ports:
- containerPort: 5678 - containerPort: 5678
name: http name: http

4
apps/supply-chain-policy/local-registry-image-policy.yaml
View File

@ -32,8 +32,8 @@ spec:
resources: resources:
- pods - pods
matchImageReferences: matchImageReferences:
- glob: "192.168.100.73:30500/php-website:*" - glob: "192.168.100.68:30500/php-website:*"
- glob: "192.168.100.73:30500/demos-static:*" - glob: "192.168.100.68:30500/demos-static:*"
validationConfigurations: validationConfigurations:
mutateDigest: true mutateDigest: true
required: true required: true

2
apps/website/Dockerfile
View File

@ -86,7 +86,7 @@ RUN rm -f /var/www/localhost/htdocs/index.html && \
chmod 0755 /usr/local/bin/start-website chmod 0755 /usr/local/bin/start-website
ENV WEBSITE_LANG_WRITE_DIR=/var/www/localhost/htdocs/db/lang ENV WEBSITE_LANG_WRITE_DIR=/var/www/localhost/htdocs/db/lang
ENV OLLAMA_HOST=http://192.168.100.73:11434 ENV OLLAMA_HOST=http://192.168.100.68:11434
ENV OLLAMA_MODEL=website-translator ENV OLLAMA_MODEL=website-translator
USER apache USER apache

2
apps/website/README.md
View File

@ -64,7 +64,7 @@ translations back to Redis with a TTL, then returns results in the original
order. The browser never calls the private Ollama address directly. order. The browser never calls the private Ollama address directly.
n8n is deployed separately at `https://n8n.lab2025.duckdns.org` and receives n8n is deployed separately at `https://n8n.lab2025.duckdns.org` and receives
`OLLAMA_BASE_URL=http://192.168.100.73:11434` so workflows can prewarm `OLLAMA_BASE_URL=http://192.168.100.68:11434` so workflows can prewarm
translations or run batch jobs against the Debian-host Ollama API. translations or run batch jobs against the Debian-host Ollama API.
## Translation Observability ## Translation Observability

2
apps/website/buildkitd.toml
View File

@ -1,4 +1,4 @@
[registry."192.168.100.73:30500"] [registry."192.168.100.68:30500"]
http = true http = true
insecure = true insecure = true

2
apps/website/homelab-tree.php
View File

@ -181,7 +181,7 @@ $blogHref = 'blog.php?lang=' . urlencode($lang);
<rect class="tree-trunk" x="468" y="650" width="104" height="142" rx="12"></rect> <rect class="tree-trunk" x="468" y="650" width="104" height="142" rx="12"></rect>
<text class="tree-trunk-text" x="520" y="700">Debian</text> <text class="tree-trunk-text" x="520" y="700">Debian</text>
<text class="tree-trunk-text tree-small" x="520" y="722">control plane</text> <text class="tree-trunk-text tree-small" x="520" y="722">control plane</text>
<text class="tree-trunk-text tree-small" x="520" y="744">192.168.100.73</text> <text class="tree-trunk-text tree-small" x="520" y="744">192.168.100.68</text>
<path class="tree-root" d="M520 790 C456 814 390 822 310 822"></path> <path class="tree-root" d="M520 790 C456 814 390 822 310 822"></path>
<path class="tree-root" d="M520 790 C584 816 660 824 740 822"></path> <path class="tree-root" d="M520 790 C584 816 660 824 740 822"></path>

2
apps/website/translate.php
View File

@ -211,7 +211,7 @@ if (!$texts || count($texts) > 240 || $totalLength > 80000) {
translate_response(400, ['error' => 'Invalid translation batch']); translate_response(400, ['error' => 'Invalid translation batch']);
} }
$ollamaHost = rtrim(getenv('OLLAMA_HOST') ?: 'http://192.168.100.73:11434', '/'); $ollamaHost = rtrim(getenv('OLLAMA_HOST') ?: 'http://192.168.100.68:11434', '/');
$ollamaModel = getenv('OLLAMA_MODEL') ?: 'llama3.2:3b'; $ollamaModel = getenv('OLLAMA_MODEL') ?: 'llama3.2:3b';
$cachePrefix = getenv('TRANSLATION_CACHE_PREFIX') ?: 'translation:v1'; $cachePrefix = getenv('TRANSLATION_CACHE_PREFIX') ?: 'translation:v1';
$cacheKeys = []; $cacheKeys = [];

2
apps/website/web-app.yaml
View File

@ -69,7 +69,7 @@ spec:
- name: WEBSITE_IDEAS_WRITE_DIR - name: WEBSITE_IDEAS_WRITE_DIR
value: /var/www/localhost/htdocs/db/ideas value: /var/www/localhost/htdocs/db/ideas
- name: OLLAMA_HOST - name: OLLAMA_HOST
value: http://192.168.100.73:11434 value: http://192.168.100.68:11434
- name: OLLAMA_MODEL - name: OLLAMA_MODEL
value: website-translator value: website-translator
- name: TRANSLATION_REDIS_HOST - name: TRANSLATION_REDIS_HOST

2
bootstrap/apps/variables.tf
View File

@ -10,7 +10,7 @@ variable "argocd_namespace" {
variable "gitops_repo_url" { variable "gitops_repo_url" {
type = string type = string
default = "ssh://git@192.168.100.73:32222/jv/my-homelab-configs.git" default = "ssh://git@192.168.100.89:32222/jv/my-homelab-configs.git"
} }
variable "website_image_ref" { variable "website_image_ref" {

4
bootstrap/cluster/variables.tf
View File

@ -14,7 +14,7 @@ variable "control_plane_node_labels" {
variable "control_plane_advertise_address" { variable "control_plane_advertise_address" {
type = string type = string
default = "192.168.100.73" default = "192.168.100.68"
} }
variable "pod_network_cidr" { variable "pod_network_cidr" {
@ -34,7 +34,7 @@ variable "kubeconfig_owner" {
variable "registry_endpoint" { variable "registry_endpoint" {
type = string type = string
default = "192.168.100.73:30500" default = "192.168.100.68:30500"
} }
variable "node_dns_servers" { variable "node_dns_servers" {

2
bootstrap/edge/variables.tf
View File

@ -72,7 +72,7 @@ variable "gitea_backend_port" {
variable "gitea_backend_host" { variable "gitea_backend_host" {
type = string type = string
default = "192.168.100.73" default = "192.168.100.89"
} }
variable "haproxy_stats_user" { variable "haproxy_stats_user" {

2
bootstrap/platform/variables.tf
View File

@ -20,7 +20,7 @@ variable "calico_operator_node_name" {
variable "gitops_repo_url" { variable "gitops_repo_url" {
type = string type = string
default = "ssh://git@192.168.100.73:32222/jv/my-homelab-configs.git" default = "ssh://git@192.168.100.89:32222/jv/my-homelab-configs.git"
} }
variable "gitops_ssh_key_path" { variable "gitops_ssh_key_path" {

2
bootstrap/provisioning/README.md
View File

@ -60,7 +60,7 @@ generates a unique fallback name using `TF_VAR_clone_hostname_prefix`.
Create an arm64 VM in Pimox with UEFI firmware, a virtio disk, and a NIC on the same LAN as the Debian provisioning host. Put network boot first. Create an arm64 VM in Pimox with UEFI firmware, a virtio disk, and a NIC on the same LAN as the Debian provisioning host. Put network boot first.
PXE should load `grubaa64.efi`, boot the Debian installer, fetch the preseed from `http://192.168.100.73:8088/preseed/debian13-arm64-worker.cfg`, and install the golden image. PXE should load `grubaa64.efi`, boot the Debian installer, fetch the preseed from `http://192.168.100.68:8088/preseed/debian13-arm64-worker.cfg`, and install the golden image.
If your Pimox firmware needs a different Debian arm64 EFI loader, override `TF_VAR_pxe_boot_file`. If your Pimox firmware needs a different Debian arm64 EFI loader, override `TF_VAR_pxe_boot_file`.

6
bootstrap/provisioning/variables.tf
View File

@ -1,6 +1,6 @@
variable "provisioning_host" { variable "provisioning_host" {
type = string type = string
default = "192.168.100.73" default = "192.168.100.68"
} }
variable "provisioning_user" { variable "provisioning_user" {
@ -29,7 +29,7 @@ variable "proxy_dhcp_range" {
variable "http_host" { variable "http_host" {
type = string type = string
default = "192.168.100.73" default = "192.168.100.68"
} }
variable "http_port" { variable "http_port" {
@ -138,7 +138,7 @@ variable "kernel_cgroup_boot_options" {
variable "registry_endpoint" { variable "registry_endpoint" {
type = string type = string
default = "192.168.100.73:30500" default = "192.168.100.68:30500"
} }
variable "node_dns_servers" { variable "node_dns_servers" {

18
infra/gitea/README.md
View File

@ -2,14 +2,14 @@
Gitea is bootstrap infrastructure, not a Kubernetes workload. Gitea is bootstrap infrastructure, not a Kubernetes workload.
`lab.sh deploy-gitea` copies `docker-compose.yml` to the Debian host and runs `lab.sh deploy-gitea` copies `docker-compose.yml` to the Raspberry Pi and runs
Gitea as an always-on Docker Compose service. The current default stores data on Gitea as an always-on Docker Compose service. The current default stores data on
the HP laptop NVMe under `/data/homelab-gitea/data`; Docker root is also the Raspberry Pi SSD under `/data/homelab-gitea/data`; the Pi Docker root is
expected to live on the `/data` storage path. also expected to live on the SSD-backed `/data` mount.
Defaults: Defaults:
- host: `192.168.100.73` - host: `192.168.100.89`
- user: `jv` - user: `jv`
- install dir: `/data/homelab-gitea` - install dir: `/data/homelab-gitea`
- HTTP port: `3000` - HTTP port: `3000`
@ -25,14 +25,14 @@ adds the Debian host deploy key when needed, and points the Debian checkout's
`gitea` remote at: `gitea` remote at:
```text ```text
ssh://git@192.168.100.73:32222/jv/my-homelab-configs.git ssh://git@192.168.100.89:32222/jv/my-homelab-configs.git
``` ```
Argo CD does not read from the Gitea SSH port. It reads from the Argo CD does not read from the Raspberry Pi Gitea SSH port. It reads from the
Debian bare GitOps mirror through `gitops_repo_url`, normally: Debian bare GitOps mirror through `gitops_repo_url`, normally:
```text ```text
ssh://jv@192.168.100.73/home/jv/git-server/my-homelab-configs.git ssh://jv@192.168.100.68/home/jv/git-server/my-homelab-configs.git
``` ```
The platform bootstrap registers that repo secret and updates The platform bootstrap registers that repo secret and updates
@ -40,6 +40,6 @@ The platform bootstrap registers that repo secret and updates
refresh the Debian host key in that ConfigMap and restart `argocd-repo-server`. refresh the Debian host key in that ConfigMap and restart `argocd-repo-server`.
Backups are installed on the Debian host by `lab.sh deploy-gitea` and Backups are installed on the Debian host by `lab.sh deploy-gitea` and
`lab.sh backup-gitea`. The timer runs `gitea dump` inside the Gitea container, `lab.sh backup-gitea`. The timer runs `gitea dump` inside the Raspberry Pi
copies the archive to Debian, and stores it under container, copies the archive to Debian, and stores it under
`/home/jv/backups/gitea`. `/home/jv/backups/gitea`.

20
lab.sh
View File

@ -212,7 +212,7 @@ adopt_apps_existing_resources() {
ensure_homelab_node_labels() { ensure_homelab_node_labels() {
local control_plane_node="${LAB_CONTROL_PLANE_NODE_NAME:-debian}" local control_plane_node="${LAB_CONTROL_PLANE_NODE_NAME:-debian}"
local raspberry_node="${LAB_RASPBERRY_NODE_NAME:-raspberry}" local raspberry_node="${LAB_RASPBERRY_NODE_NAME:-raspberry}"
local prometheus_selector="homelab.dev/node-role=app,homelab.dev/storage=ssd" local prometheus_selector="homelab.dev/node-role=app,homelab.dev/storage=nvme"
local node local node
local target_nodes local target_nodes
@ -236,7 +236,7 @@ ensure_homelab_node_labels() {
if [[ "${node}" == pimox-worker-* ]]; then if [[ "${node}" == pimox-worker-* ]]; then
kubectl --kubeconfig "${KUBECONFIG_PATH}" label node "${node}" \ kubectl --kubeconfig "${KUBECONFIG_PATH}" label node "${node}" \
homelab.dev/node-role=app \ homelab.dev/node-role=app \
homelab.dev/storage=ssd \ homelab.dev/storage=nvme \
homelab.dev/workload-class=platform \ homelab.dev/workload-class=platform \
--overwrite --overwrite
elif [[ "${node}" == "${raspberry_node}" ]]; then elif [[ "${node}" == "${raspberry_node}" ]]; then
@ -813,7 +813,7 @@ write_cluster_worker_var_file() {
LAB_RASPBERRY_NODE_NAME="${LAB_RASPBERRY_NODE_NAME:-raspberry}" \ LAB_RASPBERRY_NODE_NAME="${LAB_RASPBERRY_NODE_NAME:-raspberry}" \
LAB_RASPBERRY_SSH_KEY_PATH="${LAB_RASPBERRY_SSH_KEY_PATH:-/home/jv/.ssh/id_ed25519}" \ LAB_RASPBERRY_SSH_KEY_PATH="${LAB_RASPBERRY_SSH_KEY_PATH:-/home/jv/.ssh/id_ed25519}" \
LAB_RASPBERRY_NODE_LABELS_JSON="${LAB_RASPBERRY_NODE_LABELS_JSON:-{\"node-role.kubernetes.io/worker\":\"worker\",\"homelab.dev/node-role\":\"edge-app\",\"homelab.dev/storage\":\"local\",\"homelab.dev/workload-class\":\"edge\"}}" \ LAB_RASPBERRY_NODE_LABELS_JSON="${LAB_RASPBERRY_NODE_LABELS_JSON:-{\"node-role.kubernetes.io/worker\":\"worker\",\"homelab.dev/node-role\":\"edge-app\",\"homelab.dev/storage\":\"local\",\"homelab.dev/workload-class\":\"edge\"}}" \
LAB_PIMOX_WORKER_NODE_LABELS_JSON="${LAB_PIMOX_WORKER_NODE_LABELS_JSON:-{\"node-role.kubernetes.io/worker\":\"worker\",\"homelab.dev/node-role\":\"app\",\"homelab.dev/storage\":\"ssd\",\"homelab.dev/workload-class\":\"platform\"}}" \ LAB_PIMOX_WORKER_NODE_LABELS_JSON="${LAB_PIMOX_WORKER_NODE_LABELS_JSON:-{\"node-role.kubernetes.io/worker\":\"worker\",\"homelab.dev/node-role\":\"app\",\"homelab.dev/storage\":\"nvme\",\"homelab.dev/workload-class\":\"platform\"}}" \
python3 - "${spec_file}" "${var_file}" <<'PY' python3 - "${spec_file}" "${var_file}" <<'PY'
import json import json
import os import os
@ -2046,8 +2046,8 @@ wait_for_deployment_ready() {
deploy_gitea() { deploy_gitea() {
local mode="${LAB_GITEA_DEPLOY:-true}" local mode="${LAB_GITEA_DEPLOY:-true}"
local gitea_host="${LAB_GITEA_HOST:-192.168.100.73}" local gitea_host="${LAB_GITEA_HOST:-${LAB_RASPBERRY_HOST:-192.168.100.89}}"
local gitea_user="${LAB_GITEA_USER:-jv}" local gitea_user="${LAB_GITEA_USER:-${LAB_RASPBERRY_USER:-jv}}"
local gitea_key="${LAB_GITEA_SSH_KEY_PATH:-${LAB_RASPBERRY_SSH_KEY_PATH:-/home/jv/.ssh/id_ed25519}}" local gitea_key="${LAB_GITEA_SSH_KEY_PATH:-${LAB_RASPBERRY_SSH_KEY_PATH:-/home/jv/.ssh/id_ed25519}}"
local install_dir="${LAB_GITEA_INSTALL_DIR:-/data/homelab-gitea}" local install_dir="${LAB_GITEA_INSTALL_DIR:-/data/homelab-gitea}"
local image="${LAB_GITEA_IMAGE:-gitea/gitea:1.21.7}" local image="${LAB_GITEA_IMAGE:-gitea/gitea:1.21.7}"
@ -2398,8 +2398,8 @@ ensure_gitea_repo_ssh_access() {
bootstrap_gitea_repo() { bootstrap_gitea_repo() {
local mode="${LAB_GITEA_REPO_BOOTSTRAP:-true}" local mode="${LAB_GITEA_REPO_BOOTSTRAP:-true}"
local gitea_host="${LAB_GITEA_HOST:-192.168.100.73}" local gitea_host="${LAB_GITEA_HOST:-${LAB_RASPBERRY_HOST:-192.168.100.89}}"
local gitea_user="${LAB_GITEA_USER:-jv}" local gitea_user="${LAB_GITEA_USER:-${LAB_RASPBERRY_USER:-jv}}"
local gitea_key="${LAB_GITEA_SSH_KEY_PATH:-${LAB_RASPBERRY_SSH_KEY_PATH:-/home/jv/.ssh/id_ed25519}}" local gitea_key="${LAB_GITEA_SSH_KEY_PATH:-${LAB_RASPBERRY_SSH_KEY_PATH:-/home/jv/.ssh/id_ed25519}}"
local container_name="${LAB_GITEA_CONTAINER_NAME:-homelab-gitea}" local container_name="${LAB_GITEA_CONTAINER_NAME:-homelab-gitea}"
local http_port="${LAB_GITEA_HTTP_PORT:-3000}" local http_port="${LAB_GITEA_HTTP_PORT:-3000}"
@ -2599,8 +2599,8 @@ ASKPASS_EOT
} }
install_gitea_backup_timer() { install_gitea_backup_timer() {
local gitea_host="${LAB_GITEA_HOST:-192.168.100.73}" local gitea_host="${LAB_GITEA_HOST:-${LAB_RASPBERRY_HOST:-192.168.100.89}}"
local gitea_user="${LAB_GITEA_USER:-jv}" local gitea_user="${LAB_GITEA_USER:-${LAB_RASPBERRY_USER:-jv}}"
local gitea_key="${LAB_GITEA_SSH_KEY_PATH:-${LAB_RASPBERRY_SSH_KEY_PATH:-/home/jv/.ssh/id_ed25519}}" local gitea_key="${LAB_GITEA_SSH_KEY_PATH:-${LAB_RASPBERRY_SSH_KEY_PATH:-/home/jv/.ssh/id_ed25519}}"
local gitea_container="${LAB_GITEA_CONTAINER_NAME:-homelab-gitea}" local gitea_container="${LAB_GITEA_CONTAINER_NAME:-homelab-gitea}"
local backup_dir="${LAB_GITEA_BACKUP_DIR:-/home/jv/backups/gitea}" local backup_dir="${LAB_GITEA_BACKUP_DIR:-/home/jv/backups/gitea}"
@ -3165,7 +3165,7 @@ rebuild_cluster() {
export LAB_PIMOX_WORKER_REPLACE_EXISTING="${LAB_PIMOX_WORKER_REPLACE_EXISTING:-true}" export LAB_PIMOX_WORKER_REPLACE_EXISTING="${LAB_PIMOX_WORKER_REPLACE_EXISTING:-true}"
export TF_VAR_force_worker_rejoin="${TF_VAR_force_worker_rejoin:-true}" export TF_VAR_force_worker_rejoin="${TF_VAR_force_worker_rejoin:-true}"
echo "Rebuilding the Kubernetes cluster without touching external Gitea..." echo "Rebuilding the Kubernetes cluster without touching external Raspberry Pi Gitea..."
nuke nuke
run_pimox_pipeline run_pimox_pipeline