• 0 Posts
  • 24 Comments
Joined 2 years ago
cake
Cake day: June 18th, 2023

help-circle
  • Cool, I haven’t tried either of those.

    I’m the type of person who likes to upgrade my systems via the terminal because I like to know the detailed processes, but I’ve also burned myself numerous times; hence my preference for declarative and immutable/atomic solutions.

    It’s (quite) a bit more of a hassle, but I’ve lost trust in GUIs.

    k3s is fairly simple (as far as k8s distros go). Helm is good to start with but for the long run I recommend using kubernetes manifests directly (i.e. kubectl apply -f pvc.yaml, deployment.yaml, etc) rather than helm, because there are quite a few gotchas with helm which can cause trouble. Besides that, it’s good practice to use the --secrets-encryption flag on the server node(s), and if you’re deploying agent nodes it’s good to use bootstrap tokens (k3s token create)


  • Working on a split staging/prod hybrid-cloud k3s setup using nixos, tailscale, systemd-nspawn and fluxcd. If someone has advice for running k3s in unprivileged (mounts idmapped) nspawn containers, I’m all👂.

    This will run

    • (openwisp)[https://openwisp.org/] to make it feasible to provide lots of less tech-savvy people in the local community with secure, simple, privacy-respecting wifi using free software and recycled routers.
    • Various libre software I’m helping community, unions and political orgs adopt. Notably Discourse and Peertube.