Pve on Alwaldend

flux

Mon, 01 Jan 0001 00:00:00 +0000

Set up port forwarding

ssh -L 6443:127.0.0.1:6443 -N flux.alwaldend.com

Run flux CLI

bazel run //infra/flux/cl:flux

Show flux status

bazel run infra/flux/cl:flux -- get all -A

Run bootstrap

bazel run //infra/flux/cl:flux.bootstrap

Run flux operator

bazel run //infra/flux/cl:op

Show oidc info

bazel run //infra/flux/cl:oidc

Renew certificate

bazel run //infra/flux/cl:cmctl -- renew traefik-gateway-websecure-tls -n traefik

Update secrets

Generate secret id and the token:

SECRET_ID=$(bazel run //infra/flux/cl:vault.secret_id | jq -r .data.secret_id)
TOKEN=$(echo "${SECRET_ID}" | bazel run //infra/flux/cl:vault.ops_token | jq -r .auth.client_token)
echo "Secret id: ${SECRET_ID}, Token: ${TOKEN}"

Patch secret-id in ./cl/cert-manager/issuer-approle.yaml
Patch token in projects/kustomization/flux-repo/flux-sops-secret.yaml

Encrypt:

bazel run //infra/flux/cl:sops.encrypt infra/flux/cl/cert-manager/issuer-approle.yaml
bazel run //infra/flux/cl:sops.encrypt projects/kustomization/flux-repo/flux-sops-secret.yaml
bazel run //infra/flux/cl:sops.encrypt projects/kustomization/flux-repo/flux-git-src-secret.yaml

forgejo

Mon, 01 Jan 0001 00:00:00 +0000

Deployment

bazel run //infra/forgejo/tf_setup # Create hosts
bazel run //infra/forgejo/ansible # Configure hosts
bazel run //infra/forgejo/tf # Configure forgejo

Forgejo runner

Mon, 01 Jan 0001 00:00:00 +0000

Deploy VMs

bazel run //infra/forgejo_runner/tf_setup # Create VMs
bazel run //infra/forgejo_runner/ansible # Configure VMs

harbor

Mon, 01 Jan 0001 00:00:00 +0000

Update secrets

Generate approle secret id:

SECRET_ID=$(bazel run //infra/harbor/cl:vault.secret_id | jq -r .data.secret_id)
echo "Secret id: ${SECRET_ID}"

Patch secret-id in ./cl/cert-manager/issuer-approle.yaml

Encrypt:

bazel run //infra/flux/cl:sops.encrypt infra/harbor/cl/cert-manager/issuer-approle.yaml

Pve

Mon, 01 Jan 0001 00:00:00 +0000

Deployment

bazel run //infra/pve/ansible # host setup
bazel run //infra/pve/tf/tf.apply # tf setup

Recreate the test VM

bazel run //infra/pve/tf:tf.apply -- --replace module.vm_cloudinit_test.proxmox_vm_qemu.vm

Cloud-init snippet update

bazel run //infra/pve/ansible -- --tags pve_snippets

Update ACME account

Create an EAB:

bazel run //infra/dc1/vault -- write -f pki/ica_servers/roles/src_infra_dc1_pve1_pki_server/acme/new-eab

Login as root@pam
Go to Datacenter -> ACME

Create a new account with the EAB and a directory:

https://vault.dc1.alwaldend.com:8200/v1/pki/ica_servers/roles/src_infra_dc1_pve1_pki_server/acme/directory

Pve token

Create a token with Privilege Separation
Grant it required roles

Create json:

{
  "token_id": "",
  "token_secret": ""
}

Write the data:

bazel run //infra/pve:vault.kv_put alwaldend.com/vault1/approles/src_infra_dc1_pve1/pve_token @"${PWD}/data.json"

PVE login

Mon, 01 Jan 0001 00:00:00 +0000

The plugin requests an API token with a one-hour expiry and deletes that token on shutdown using the retained login ticket and CSRF token. The token name is registered for cleanup before creation, so cleanup is attempted even when a creation response is lost or malformed. Failures to delete are reported; expiry is the fallback when shutdown cannot complete. Pre-existing credentials are not revoked. Vault tokens created by the invocation are revoked after token cleanup.

Pve vm qemu

Mon, 01 Jan 0001 00:00:00 +0000

Terraform setup

Mon, 01 Jan 0001 00:00:00 +0000

Tf

Mon, 01 Jan 0001 00:00:00 +0000

Tf setup

Mon, 01 Jan 0001 00:00:00 +0000

Tf setup

Mon, 01 Jan 0001 00:00:00 +0000

Tf setup

Mon, 01 Jan 0001 00:00:00 +0000

Tf setup

Mon, 01 Jan 0001 00:00:00 +0000

Tf setup

Mon, 01 Jan 0001 00:00:00 +0000

Pve on Alwaldend

flux

Links

Set up port forwarding

Run flux CLI

Show flux status

Run bootstrap

Run flux operator

Show oidc info

Renew certificate

Update secrets

forgejo

Links

Deployment

Forgejo runner

Deploy VMs

harbor

Links

Update secrets

Pve

Links

Deployment

Recreate the test VM

Cloud-init snippet update

Update ACME account

Pve token

PVE login

Pve vm qemu

Terraform setup

Tf

Tf setup

Tf setup

Tf setup

Tf setup

Tf setup

Pve on Alwaldend

flux

Links

Set up port forwarding

Run flux CLI

Show flux status

Run bootstrap

Run flux operator

Show oidc info

Renew certificate

Update secrets

forgejo

Links

Deployment

Forgejo runner

Deploy VMs

harbor

Links

CE Login

Update secrets

Pve

Links

Deployment

Recreate the test VM

Cloud-init snippet update

Update ACME account

Pve token

PVE login

Pve vm qemu

Terraform setup

Tf

Tf setup

Tf setup

Tf setup

Tf setup

Tf setup