Home Lab

This repository is essentially all is required to set up my Home Lab from scratch, automating as much as possible.

Instructions

Terraform and Ansible are required to provision and configure the various nodes. Provision nodes with:

$ terraform apply

Configure nodes with:

$ ansible-playbook --inventory=$(which terraform-inventory) ansible/site.yml

How to generate an OIDC client secret

$ docker run --rm authelia/authelia:latest authelia crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986

How to create a sealed secret

Create an env file with a list of key=value pairs:

# /tmp/env

oidc-client-id=some_id
oidc-client-secret=some_secret

Create a secret manifest on the client by reading the env file:

$ kubectl create secret generic actual-secret --dry-run=client --from-env-file=/tmp/env -o yaml > /tmp/secret.yaml

Seal the secret:

$ kubeseal -f /tmp/secret.yaml -o yaml > /tmp/sealed.yaml

Initialize an empty k8s cluster

$ sops exec-file k8s/argocd.enc.yaml \
  'helm upgrade --install argocd -n argocd --create-namespace argo/argo-cd --values {} --reset-values'
$ sops exec-file k8s/secrets.enc.yaml 'kubectl apply -f {}' 
$ helm upgrade --install cilium cilium/cilium --version 1.18.0 --namespace kube-system --values k8s/cilium.yaml 

$ kubectl apply -f deployments/metallb.yaml
$ kubectl apply -f deployments/traefik.yaml

$ kubectl apply -f deployments/democratic-csi.yaml
$ kubectl apply -f deployments/volumes.yaml

$ kube apply -f deployments/

Create authentik kubeconfig

KUBE_API=$(kubectl config view --minify --output jsonpath="{.clusters[*].cluster.server}")
NAMESPACE=authentik
SECRET_NAME=$(kubectl get serviceaccount authentik-remote-cluster -o jsonpath='{.secrets[0].name}' 2>/dev/null || echo -n "authentik-remote-cluster")
KUBE_CA=$(kubectl -n $NAMESPACE get secret/$SECRET_NAME -o jsonpath='{.data.ca\.crt}')
KUBE_TOKEN=$(kubectl -n $NAMESPACE get secret/$SECRET_NAME -o jsonpath='{.data.token}' | base64 --decode)

echo "apiVersion: v1
kind: Config
clusters:
- name: default-cluster
  cluster:
    certificate-authority-data: ${KUBE_CA}
    server: ${KUBE_API}
contexts:
- name: default-context
  context:
    cluster: default-cluster
    namespace: $NAMESPACE
    user: authentik-user
current-context: default-context
users:
- name: authentik-user
  user:
    token: ${KUBE_TOKEN}"

Fix nix template

qmrestore "$IMAGE" "$ID" || can_ignore || die "Could not restore $IMAGE to VM with ID $ID"
qm template "$ID" || die "Could not convert $ID to template"
qm set "$ID" --delete virtio0
qm set "$ID" -scsi0 "local-lvm:base-$ID-disk-0"

Talos system extensions

• i915
• iscsi-tools
• qemu-guest-agent
• util-linux-tools
• xe
• intel-ucode