talexander/machine_setup
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Add worker nodes.

Browse Source
This commit is contained in:
Tom Alexander
2025-12-15 22:32:32 -05:00
parent 5c58e30709
commit 19971d2463
41 changed files with 1012 additions and 165 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
nix/kubernetes/roles/containerd/default.nix Normal file
View File

@@ -0,0 +1,46 @@
{
config,
lib,
pkgs,
...
}:
{
imports = [ ];
options.me = {
containerd.enable = lib.mkOption {
type = lib.types.bool;
default = false;
example = true;
description = "Whether we want to install containerd.";
};
};
config = lib.mkIf config.me.containerd.enable {
virtualisation.containerd.enable = true;
virtualisation.containerd.settings = {
"plugins" = {
"io.containerd.grpc.v1.cri" = {
"cni" = {
"bin_dir" = "/opt/cni/bin";
"conf_dir" = "/etc/cni/net.d";
};
"containerd" = {
"default_runtime_name" = "runc";
"runtimes" = {
"runc" = {
"options" = {
"SystemdCgroup" = true;
};
"runtime_type" = "io.containerd.runc.v2";
};
};
"snapshotter" = "overlayfs";
};
};
};
"version" = 2;
};
};
}

1
nix/kubernetes/roles/etcd/default.nix
View File

@@ -105,5 +105,6 @@
gptfdisk # cgdisk
];
networking.firewall.enable = false; # TODO: This is just here for debugging / initial development.
# TODO: Maybe use networking.nftables.enable to switch to nftables?
};
}

2
nix/kubernetes/roles/minimal_base/default.nix
View File

@@ -24,8 +24,6 @@
me.ssh.enable = true;
me.sshd.enable = true;
me.user.enable = true;
me.zfs.enable = true;
me.zrepl.enable = true;
me.zsh.enable = true;
# TODO: Maybe add me.boot.enable ?

24
nix/kubernetes/roles/worker_node/default.nix Normal file
View File

@@ -0,0 +1,24 @@
{
config,
lib,
pkgs,
...
}:
{
imports = [ ];
options.me = {
worker_node.enable = lib.mkOption {
type = lib.types.bool;
default = false;
example = true;
description = "Whether we want to install worker_node.";
};
};
config = lib.mkIf config.me.worker_node.enable {
me.containerd.enable = true;
me.kubernetes.enable = true;
};
}

68
nix/kubernetes/roles/zfs/default.nix
View File

@@ -1,68 +0,0 @@
{
config,
lib,
pkgs,
...
}:
let
zfs_clone_send =
(pkgs.writeScriptBin "zfs_clone_send" (builtins.readFile ./files/zfs_clone_send.bash)).overrideAttrs
(old: {
buildCommand = "${old.buildCommand}\n patchShebangs $out";
});
zfs_clone_recv =
(pkgs.writeScriptBin "zfs_clone_recv" (builtins.readFile ./files/zfs_clone_recv.bash)).overrideAttrs
(old: {
buildCommand = "${old.buildCommand}\n patchShebangs $out";
});
zfs_clone_resume =
(pkgs.writeScriptBin "zfs_clone_resume" (builtins.readFile ./files/zfs_clone_resume.bash))
.overrideAttrs
(old: {
buildCommand = "${old.buildCommand}\n patchShebangs $out";
});
in
{
imports = [ ];
options.me = {
zfs.enable = lib.mkOption {
type = lib.types.bool;
default = false;
example = true;
description = "Whether we want to install zfs.";
};
};
config = lib.mkIf config.me.zfs.enable {
# Technically only needed when building the ISO because nix detects ZFS in the filesystem list normally. I basically always want this so I'm just setting it to always be on.
boot.supportedFilesystems.zfs = true;
boot.zfs.devNodes = "/dev/disk/by-partuuid";
services.zfs = {
autoScrub = {
enable = true;
interval = "monthly";
};
trim.enable = true;
};
environment.systemPackages = [
zfs_clone_send
zfs_clone_recv
zfs_clone_resume
];
environment.persistence."/persist" = lib.mkIf (config.me.mountPersistence) {
hideMounts = true;
directories = [
"/etc/zfs/zpool.cache" # Which zpools to import, the root zpool is already imported and does not need this cache file but this captures additional pools.
];
};
};
}

13
nix/kubernetes/roles/zfs/files/zfs_clone_recv.bash
View File

@@ -1,13 +0,0 @@
#!/usr/bin/env bash
#
# A zfs-send alias that creates a perfect clone with good defaults.
set -euo pipefail
IFS=$'\n\t'
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
# -s if the stream is interrupted, save the partial stream. The stream can then be resumed by doing a zfs send -t token where token is the receive_resume_token prop on the dataset we received into.
# -u Do not mount the filesystem we are receiving. We can always mount afterwards but this avoids issues with streams with mountpoints to places like /
# Can optionally add -F to destroy the dataset in the recv location.
exec zfs recv -s -u "${@}"
# To delete an interrupted recv, run `zfs receive -A dataset`

17
nix/kubernetes/roles/zfs/files/zfs_clone_resume.bash
View File

@@ -1,17 +0,0 @@
#!/usr/bin/env bash
#
# Resume a zfs send.
set -euo pipefail
IFS=$'\n\t'
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
function main {
local hst="$1"
local dst="$2"
local token
token=$(zfs get -H -o value receive_resume_token "$dst")
ssh "$hst" doas zfs send --verbose -t "$token" | doas zfs recv -s "$dst"
}
main "${@}"

8
nix/kubernetes/roles/zfs/files/zfs_clone_send.bash
View File

@@ -1,8 +0,0 @@
#!/usr/bin/env bash
#
# A zfs-send alias that creates a perfect clone with good defaults.
set -euo pipefail
IFS=$'\n\t'
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
exec zfs send --compressed --replicate --large-block --embed --verbose --raw "${@}"

55
nix/kubernetes/roles/zrepl/default.nix
View File

@@ -1,55 +0,0 @@
{
config,
lib,
...
}:
{
imports = [ ];
options.me = {
zrepl.enable = lib.mkOption {
type = lib.types.bool;
default = false;
example = true;
description = "Whether we want to install zrepl.";
};
};
config = lib.mkIf config.me.zrepl.enable {
services.zrepl = {
enable = true;
settings = {
jobs = [
{
name = "snapjob";
type = "snap";
filesystems = {
"zroot/linux/nix/persist<" = true;
"zroot/bridge<" = true;
};
snapshotting = {
type = "periodic";
interval = "15m";
prefix = "zrepl_";
};
pruning = {
keep = [
{
type = "grid";
grid = "1x1h(keep=all) | 24x1h | 14x1d";
regex = "^zrepl_.*";
}
{
type = "regex";
negate = true;
regex = "^zrepl_.*";
}
];
};
}
];
};
};
};
}