InstantLinux Docker Tools

ez-ipupdate

ez-ipupdate is a Dynamic-DNS client designed to automatically update a public DNS name with your current dynamic IP address. It is intended to be run in environments like Kubernetes or Docker Swarm to ensure continuous operation.

Note: This project is sunsetted. It is recommended to use the instantlinux/ddclient image instead if possible.

This project provides Ansible playbooks to securely set up Kubernetes nodes following Kubernetes, Docker, and 3rd-party best practices. It also includes tools for configuring LVM for LUKS encrypted disk volumes.

Note: Ansible is used exclusively for managing cluster nodes, not for managing containerized applications. Applications should be managed via SCM-managed configuration files and Makefiles.

The git-dump Docker image runs a script that creates git bundle backups of private git servers. It supports GitHub, GitLab, and Gitea.

For GitLab, the tool can use the GitLab v3 API to automatically fetch the list of projects at runtime, meaning you don't have to manually specify the REPOS parameter.

Retention Policy: Backups are organized into subdirectories within the DEST_DIR based on the time interval. The KEEP_DAYS variable controls how many days of snapshots are retained; backups older than this value are automatically removed. For example, setting KEEP_DAYS to 7 will keep a directory for each day of the week.

git clone https://github.com/instantlinux/docker-tools.git
cd docker-tools/k8s
make git-dump

The data-sync tool provides High Availability (HA) storage for bare-metal clusters by synchronizing volumes mounted under /var/data-sync. It uses the unison file synchronizer to perform bidirectional synchronization, acting similarly to a bidirectional rsync.

In a Kubernetes environment, it typically uses a star topology where the host with ordinal 0 acts as the hub. To scale beyond two nodes, you can add the service.data-sync=allow label to more nodes and use kubectl scale. Note that scaling increases memory usage as the number of nodes and files grows.

The method of authentication affects how you scale the deployment:

• GitHub: Due to restrictions against using the same read-only deploy key for multiple repositories, you may need to set up multiple instances of the git-dump container if you want to back up more than one GitHub repo via SSH. Alternatively, use the HTTPS access method.
• GitLab/Bitbucket/Other: You can back up an arbitrary number of repositories using a single shared deploy key. For GitLab, providing an API token allows the script to automatically discover all accessible projects.

The container utilizes secrets for sensitive configuration:

SASL Authentication

To provide credentials for SASL destinations, create a secret named after the value of SASL_SECRETNAME (defaults to postfix-sasl-passwd). The secret must contain a mapped list of credentials. For the specific format required for sasl_passwd, refer to the official Postfix SASL documentation.

TLS/SSL

If using TLS, create a secret containing your SSL private key. You must then reference this key in your configuration using the smtpd_tls_key_file directive.

For the initial run (provisioning or joining a domain), you must provide a secret containing the domain-administrator password.

Warning: Do NOT leave your domain-controller administrator secret activated at any other time. It should only be present during the initial setup.

Secret Details

• Secret Name: samba-admin-password (or the value specified in ADMIN_PASSWORD_SECRET).
• Content: A complex passphrase for the domain administrator.
• Implementation: Can be provided as a Kubernetes secret, a file (see docker-compose.yml in this repo), or a Docker Swarm secret.

The cluster-deployment tools utilize Helm charts and Ansible playbooks to deploy bare-metal or VM master/worker nodes. Key features included in the deployment include:

• Storage: Direct-attached SSD local storage pools and Local-volume sync.
• Security & Auth: Keycloak (OpenID/OAuth2), Vaultwarden (password manager), MFA via Authelia and Google Authenticator, and Pod security policies.
• Networking: Calico or Flannel networking, ingress-nginx, and node-local-dns for reliable pod DNS.
• Secrets Management: Mozilla sops for encrypted credentials in local git repos and encryption for internal etcd.
• Observability: Grafana with Prometheus-based alerting.
• Object Storage: Garage object storage.
• Namespace Management: Non-default namespace with its own service account (full permissions within namespace, limited read-only in kube-system).

You can customize the Samba server using two methods:

1. Environment Variables: Use these for common directives like drive mapping, server name, and timezone.
2. Configuration Files: For advanced customization, mount files into /etc/samba/conf.d. Files are appended in alphabetical order. To ensure global settings are applied first, name your primary configuration file starting with a zero (e.g., 0globals.conf).