Deploy charts/dns

README.md

@@ -1,3 +1,10 @@
 # home-server
 
-Kubernetes manifests that define my home server
+Kubernetes manifests that define my home server
+
+THIS SPIRALED
+
+Originally a kustomize but I wanted to be able to let others use it and tweak
+hostname values, so it became my first ever Helm chart.
+
+I know I don't love Helm, but I needed to us it sadly.

charts/dns/Chart.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v2
+name: home-server-dns
+description: Deploys a master/slave DNS server with External DNS for declaring hostnames with annotations.
+version: 0.0.1

charts/dns/templates/clusterrole.yaml

@@ -0,0 +1,32 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: external-dns
+rules:
+  - apiGroups: [""]
+    resources: ["services","endpoints","pods"]
+    verbs: ["get","watch","list"]
+  - apiGroups: ["extensions","networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["get","watch","list"]
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["list","watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: external-dns-viewer
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: external-dns
+subjects:
+  - kind: ServiceAccount
+    name: external-dns
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: external-dns

charts/dns/templates/external-dns.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: external-dns
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: external-dns
+  template:
+    metadata:
+      labels:
+        app: external-dns
+    spec:
+      serviceAccountName: external-dns
+      containers:
+      - name: external-dns
+        image: bitnami/external-dns:latest
+        args:
+          - --source=service
+          - --source=ingress
+          - --provider=rfc2136
+          - --rfc2136-host=bind-master.dns.svc.cluster.local
+          - --rfc2136-port=53
+          - --rfc2136-zone=hxme.net
+          - --rfc2136-tsig-secret=$(RFC2136_TSIG_SECRET)
+          - --rfc2136-tsig-secret-alg=hmac-sha256
+          - --rfc2136-tsig-keyname=externaldns-key
+          - --policy=sync
+          - --registry=txt
+          - --txt-owner-id=my-cluster
+        env:
+            - name: RFC2136_TSIG_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: dns-secrets
+                  key: externaldns-secret

charts/dns/templates/master.yaml

@@ -0,0 +1,136 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: bind-master-config
+data:
+  named.conf: |
+    include "/etc/bind/externaldns-key.conf";
+
+    options {
+        directory "/var/cache/bind";
+
+        recursion yes;
+        allow-query { any; };
+
+        listen-on port 53 { any; };
+        listen-on-v6 port 53 { any; };
+
+        forwarders {
+            10.40.0.254;
+        };
+
+        dnssec-validation auto;
+    };
+
+    zone "." IN {
+        type hint;
+        file "/usr/share/dns/root.hints";
+    };
+
+    zone "hxme.net." IN {
+      type master;
+      file "/etc/bind/db.hxme.net";
+      allow-update { key "externaldns-key"; };
+    };
+  db.hxme.net: |
+    $TTL    3600
+    @       IN      SOA     ns1.hxme.net. admin.hxme.net. (
+                            1         ; Serial
+                            7200      ; Refresh
+                            1800      ; Retry
+                            1209600   ; Expire
+                            86400 )   ; Negative Cache TTL
+    ;
+    @       IN      NS      ns1.hxme.net.
+    ns1     IN      A       10.40.0.110
+    @       IN      A       10.40.0.110
+    www     IN      A       10.40.0.110
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: bind-master
+spec:
+  selector:
+    matchLabels:
+      app: bind-master
+  template:
+    metadata:
+      labels:
+        app: bind-master
+    spec:
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      securityContext:
+        fsGroup: 999
+      initContainers:
+        - name: fetch-root-hints
+          image: debian:12
+          command:
+            - sh
+            - -c
+            - |
+              apt update && apt -y install curl
+              curl -sfSL https://www.internic.net/domain/named.cache -o /usr/share/dns/root.hints
+          volumeMounts:
+            - mountPath: /usr/share/dns
+              name: root-hints
+      containers:
+        - name: bind-master
+          image: internetsystemsconsortium/bind9:9.18
+          command: ["named", "-g", "-c", "/etc/bind/named.conf"]
+          ports:
+            - containerPort: 53
+              protocol: UDP
+            - containerPort: 53
+              protocol: TCP
+          volumeMounts:
+            - name: config
+              mountPath: /etc/bind/named.conf
+              subPath: named.conf
+            - name: config
+              mountPath: /etc/bind/db.hxme.net
+              subPath: db.hxme.net
+            - name: dns-secrets
+              mountPath: /etc/bind/externaldns-key.conf
+              subPath: externaldns-key.conf
+            - name: bind-cache
+              mountPath: /var/cache/bind
+            - name: bind-rundir
+              mountPath: /var/run/named
+            - name: root-hints
+              mountPath: /usr/share/dns
+      volumes:
+        - name: dns-secrets
+          secret:
+            secretName: dns-secrets
+        - name: config
+          configMap:
+            name: bind-master-config
+        - name: bind-cache
+          emptyDir: {}
+        - name: bind-rundir
+          emptyDir: {}
+        - name: root-hints
+          emptyDir: {}
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: bind-master
+spec:
+  selector:
+    app: bind-master
+  ports:
+    - name: dns-udp
+      port: 53
+      protocol: UDP
+      targetPort: 53
+    - name: dns-tcp
+      port: 53
+      protocol: TCP
+      targetPort: 53
+
+

deployments/home-server.yaml

@@ -21,7 +21,7 @@ spec:
   interval: 1m
   chart:
     spec:
-      chart: ./home-server
+      chart: ./charts/dns
       sourceRef:
         kind: GitRepository
         name: home-server

home-server/Chart.yaml

@@ -7,35 +7,3 @@ dependencies:
   - name: util
     version: 0.0.1
     repository: "file://templates/util"
-
-  - name: dns
-    version: 0.0.1
-    repository: "file://templates/dns"
-#
-#  - name: files
-#    version: 0.0.1
-#    repository: "file://templates/files"
-#
-#  - name: ai
-#    version: 0.0.1
-#    repository: "file://templates/ai"
-#
-#  - name: media
-#    version: 0.0.1
-#    repository: "file://templates/media"
-#
-#  - name: monitoring
-#    version: 0.0.1
-#    repository: "file://templates/monitoring"
-#
-#  - name: remote
-#    version: 0.0.1
-#    repository: "file://templates/remote"
-#
-#  - name: social
-#    version: 0.0.1
-#    repository: "file://templates/social"
-#
-#  - name: sync
-#    version: 0.0.1
-#    repository: "file://templates/sync"

old-manifests/Chart.yaml

@@ -0,0 +1,41 @@
+apiVersion: v2
+name: home-server
+description: A Helm chart that rolls a curated, functional home server
+version: 0.0.1
+
+dependencies:
+  - name: util
+    version: 0.0.1
+    repository: "file://templates/util"
+
+  - name: dns
+    version: 0.0.1
+    repository: "file://templates/dns"
+#
+#  - name: files
+#    version: 0.0.1
+#    repository: "file://templates/files"
+#
+#  - name: ai
+#    version: 0.0.1
+#    repository: "file://templates/ai"
+#
+#  - name: media
+#    version: 0.0.1
+#    repository: "file://templates/media"
+#
+#  - name: monitoring
+#    version: 0.0.1
+#    repository: "file://templates/monitoring"
+#
+#  - name: remote
+#    version: 0.0.1
+#    repository: "file://templates/remote"
+#
+#  - name: social
+#    version: 0.0.1
+#    repository: "file://templates/social"
+#
+#  - name: sync
+#    version: 0.0.1
+#    repository: "file://templates/sync"

old-manifests/values.yaml

@@ -0,0 +1,24 @@
+ai:
+  enabled: true
+
+dns:
+  enabled: false
+
+media:
+  enabled: true
+
+monitoring:
+  enabled: true
+
+remote:
+  enabled: false
+
+social:
+  enabled: true
+
+sync:
+  enabled: false
+
+util:
+  enabled: true
+