Skip to content

Commit 7bd7c5f

Browse files
loic-roux-404loic-roux-404
committed
feat: add libre chat and cilium in install process
1 parent c34a2f8 commit 7bd7c5f

File tree

14 files changed

+334
-44
lines changed

14 files changed

+334
-44
lines changed

‎.github/workflows/release-nixos.yml

+3-17
Original file line numberDiff line numberDiff line change
@@ -20,23 +20,9 @@ jobs:
2020
runs-on: ubuntu-latest
2121
name: Release nix image
2222
steps:
23-
- name: Checkout
24-
uses: actions/checkout@v3
25-
with:
26-
fetch-depth: 0
27-
28-
- uses: cachix/install-nix-action@v25
29-
with:
30-
extra_nix_config: |
31-
experimental-features = nix-command flakes
32-
github_access_token: ${{ secrets.GITHUB_TOKEN }}
33-
34-
- name: Restore and cache Nix store
35-
uses: nix-community/cache-nix-action@v5
36-
with:
37-
primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix') }}
38-
restore-prefixes-first-match: nix-${{ runner.os }}-
39-
gc-max-store-size-linux: 1073741824
23+
- uses: actions/checkout@v4
24+
- uses: DeterminateSystems/nix-installer-action@main
25+
- uses: DeterminateSystems/magic-nix-cache-action@main
4026

4127
- name: Build production image
4228
id: build-stable

‎Makefile

+6
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ MAKEFLAGS += --no-builtin-rules --no-builtin-variables
33
TF_CMD:=apply -auto-approve
44
VARIANT=builder
55
SYSTEM?=aarch64-linux
6+
TESTING_X86_URL=https://github.com/loic-roux-404/k3s-paas/releases/download/nixos-testing/nixos.qcow2
67

78
#### Nix
89

@@ -28,6 +29,11 @@ nixos-local: bootstrap build
2829
build:
2930
@nix build .#nixosConfigurations.initial.config.formats.qcow --system $(SYSTEM)
3031

32+
pull-testing-x86:
33+
@rm -rf result && mkdir result
34+
@wget -q --show-progress -O result/nixos.qcow2 $(TESTING_X86_URL)
35+
@qemu-img resize result/nixos.qcow2 16G
36+
3137
TERRAGRUNT_FILES:=$(shell find terragrunt -type d -name '.*' -prune -o -name 'terragrunt.hcl' -exec dirname {} \;)
3238

3339
$(TERRAGRUNT_FILES):

‎nixos-options/default.nix

+72-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{ lib, ... }:
1+
{ lib, pkgs, config, ... }:
22

33
{
44
options.k3s-paas = {
@@ -62,11 +62,82 @@
6262
default = "";
6363
};
6464

65+
k3s.podCIDR = lib.mkOption {
66+
type = lib.types.str;
67+
description = "Pod CIDR";
68+
default = "10.100.0.0/16";
69+
};
70+
71+
k3s.serviceCIDR = lib.mkOption {
72+
type = lib.types.str;
73+
description = "Pod CIDR";
74+
default = "10.110.0.0/16";
75+
};
76+
77+
k3s.clusterDns = lib.mkOption {
78+
type = lib.types.str;
79+
description = "Cluster DNS";
80+
default = "10.110.0.10";
81+
};
82+
83+
k3s.serviceIp = lib.mkOption {
84+
type = lib.types.str;
85+
description = "Service IP";
86+
default = "10.110.0.1";
87+
};
88+
89+
k3s.serviceHost = lib.mkOption {
90+
type = lib.types.str;
91+
description = "Service host";
92+
default = "";
93+
};
94+
95+
k3s.servicePort = lib.mkOption {
96+
type = lib.types.int;
97+
description = "Service port";
98+
default = 6443;
99+
};
100+
101+
cilium.version = lib.mkOption {
102+
type = lib.types.str;
103+
description = "Cilium version";
104+
default = "1.16.1";
105+
};
106+
65107
dex.dexClientId = lib.mkOption {
66108
type = lib.types.str;
67109
description = "Client ID for Dex";
68110
default = "dex-k3s-paas";
69111
};
70112

113+
cert-manager.version = lib.mkOption {
114+
type = lib.types.str;
115+
description = "Cert Manager version";
116+
default = "1.15.2";
117+
};
118+
119+
defaultK3sConfigPath = lib.mkOption {
120+
type = lib.types.str;
121+
description = "Default config yaml";
122+
default = "";
123+
};
124+
125+
};
126+
127+
config = with config.k3s-paas; {
128+
k3s-paas.defaultK3sConfigPath = pkgs.writeText ''
129+
cluster-cidr: ${k3s.podCIDR}
130+
service-cidr: ${k3s.serviceCIDR}
131+
cluster-dns: ${k3s.clusterDns}
132+
tls-san:
133+
- localhost
134+
- ${k3s.serviceIp}
135+
- ${config.networking.hostName}
136+
kube-apiserver-arg=authorization-mode: Node,RBAC
137+
kube-apiserver-arg=oidc-issuer-url: https://dex.${dns.name}
138+
kube-apiserver-arg=oidc-client-id: ${dex.dexClientId}
139+
kube-apiserver-arg=oidc-username-claim: email
140+
kube-apiserver-arg=oidc-groups-claim: groups
141+
'';
71142
};
72143
}

‎nixos/configuration.nix

+87-20
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ in {
8282
config.services.tailscale.enable
8383
) {
8484
serviceConfig = {
85-
RemainAfterExit = true; # Ensures it's remains active after running.
85+
RemainAfterExit = true;
8686
};
8787
};
8888

@@ -105,7 +105,6 @@ in {
105105
services.k3s = {
106106
enable = lib.mkDefault false;
107107
role = "server";
108-
package = k3sPkg;
109108
extraFlags = lib.strings.concatStringsSep " " (
110109
map (service: "--disable=${service}") k3s.disableServices
111110
++ k3s.serverExtraArgs
@@ -116,25 +115,93 @@ in {
116115
"--egress-selector-mode=disabled"
117116
]
118117
);
119-
# manifests = {
120-
# certManager = {
121-
# name = "cert-manager";
122-
# namespace = certManagerNamespace;
123-
# createNamespace = true;
124-
# repository = "https://charts.jetstack.io";
125-
# chart = "cert-manager";
126-
# version = "1.15.2";
127-
# waitForJobs = true;
128-
# atomic = true;
129-
# timeout = 120;
130-
131-
# values = ''
132-
# crds:
133-
# enabled = true
134-
# '';
135-
# };
136-
# };
118+
configPath = k3s.defaultK3sConfigPath;
119+
manifests = {
120+
certManager = {
121+
name = "cert-manager";
122+
namespace = certManagerNamespace;
123+
createNamespace = true;
124+
repository = "https://charts.jetstack.io";
125+
chart = "cert-manager";
126+
version = cert-manager.version;
127+
waitForJobs = true;
128+
atomic = true;
129+
timeout = 120;
130+
131+
values = ''
132+
crds:
133+
enabled = true
134+
'';
135+
};
136+
cilium = {
137+
name = "cilium";
138+
namespace = var.cilium_namespace;
139+
repository = "https://helm.cilium.io";
140+
chart = "cilium";
141+
atomic = true;
142+
version = cilium.version;
143+
values = ''
144+
l2announcements:
145+
enabled: true
146+
147+
kubeProxyReplacement: true
148+
149+
bpf:
150+
masquerade: true
151+
lbExternalClusterIP: false
152+
153+
gatewayAPI:
154+
enabled: false
155+
156+
routingMode: tunnel
157+
158+
tunnelProtocol: vxlan
159+
160+
ingressController:
161+
enabled: true
162+
default: true
163+
loadbalancerMode: dedicated
164+
service:
165+
name: cilium-ingress-external
166+
labels:
167+
k3s-paas/internal: "true"
168+
169+
prometheus:
170+
enabled: true
171+
serviceMonitor:
172+
enabled: true
173+
174+
operator:
175+
replicas: 1
176+
prometheus:
177+
enabled: true
178+
179+
hubble:
180+
relay:
181+
enabled: true
182+
metrics:
183+
enabled:
184+
- dns
185+
- drop
186+
- tcp
187+
- flow
188+
- port-distribution
189+
- icmp
190+
- httpV2:exemplars=true;labelsContext=source_ip,source_namespace,source_workload,destination_ip,destination_namespace,destination_workload,traffic_direction
191+
enableOpenMetrics: true
192+
193+
ipam:
194+
operator:
195+
clusterPoolIPv4PodCIDRList:
196+
- "${k3s.podCIDR}"
197+
'' + lib.mkIf (k3s.serviceHost != "") ''
198+
k8sServiceHost: "${k3s.serviceHost}"
199+
k8sServicePort: "${k3s.servicePort}"
200+
'';
201+
};
202+
};
137203
};
204+
138205
services.fail2ban.enable = true;
139206

140207
security.pki.certificateFiles = certs;

‎nixos/deploy.nix

+4-4
Original file line numberDiff line numberDiff line change
@@ -44,13 +44,13 @@ with config.k3s-paas;
4444
node-name: "${config.networking.hostName}"
4545
cluster-domain: ${config.sops.placeholder.paasDomain}
4646
node-external-ip: "${config.sops.placeholder.nodeIp}"
47-
cluster-cidr: 10.100.0.0/16
48-
service-cidr: 10.110.0.0/16
49-
cluster-dns: 10.110.0.10
47+
cluster-cidr: ${k3s.podCIDR}
48+
service-cidr: ${k3s.serviceCIDR}
49+
cluster-dns: ${k3s.clusterDns}
5050
vpn-auth: "name=tailscale,joinKey=${config.sops.placeholder.tailscaleNodeKey}"
5151
tls-san:
5252
- localhost
53-
- 10.43.0.1
53+
- ${k3s.serviceIp}
5454
- ${config.networking.hostName}
5555
- "${config.sops.placeholder.tailscaleDomain}"
5656
- "${config.sops.placeholder.nodeIp}"

‎nixos/qcow-compressed.nix

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
];
55
system.build.qcow = lib.mkForce (import "${toString modulesPath}/../lib/make-disk-image.nix" {
66
inherit lib config pkgs;
7-
diskSize = "auto";
7+
diskSize = 8192;
88
format = "qcow2-compressed";
99
partitionTableType = "hybrid";
1010
});

‎tf-modules-ai/librechat/main.tf

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
2+
3+
resource "random_string" "creds_key" {
4+
length = 64
5+
special = false
6+
}
7+
8+
resource "random_string" "creds_iv" {
9+
length = 32
10+
special = false
11+
}
12+
13+
resource "random_string" "jwt_secret" {
14+
length = 64
15+
special = false
16+
}
17+
18+
resource "random_string" "jwt_refresh_secret" {
19+
length = 64
20+
special = false
21+
}
22+
23+
resource "kubernetes_secret" "librechat" {
24+
metadata {
25+
name = "librechat"
26+
namespace = "default"
27+
}
28+
29+
data = {
30+
CREDS_KEY = "${random_string.creds_key.result}"
31+
CREDS_IV = "${random_string.creds_iv.result}"
32+
MONGO_URI = "${helm_release.mongodb.output.mongodb_uri}"
33+
JWT_SECRET = "${random_string.jwt_secret.result}"
34+
JWT_REFRESH_SECRET = "${random_string.jwt_refresh_secret.result}"
35+
}
36+
}
37+
38+
resource "helm_release" "librechat" {
39+
name = "librechat"
40+
chart = "<path-to-librechat-helm-chart>" # Path to the LibreChat chart.
41+
namespace = "default"
42+
43+
44+
values = [
45+
yamlencode({
46+
config = {
47+
env_secrets = {
48+
secret_ref = kubernetes_secret.librechat.metadata[0].name
49+
}
50+
}
51+
52+
env = {
53+
ALLOW_EMAIL_LOGIN = true
54+
ALLOW_REGISTRATION = true
55+
ALLOW_SOCIAL_LOGIN = false
56+
ALLOW_SOCIAL_REGISTRATION = false
57+
CUSTOM_FOOTER = "Orga-404 librechat"
58+
DEBUG_CONSOLE = true
59+
DEBUG_LOGGING = true
60+
DEBUG_OPENAI = true
61+
DEBUG_PLUGINS = true
62+
DOMAIN_CLIENT = ""
63+
DOMAIN_SERVER = ""
64+
ENDPOINTS = "openAI,azureOpenAI,bingAI,chatGPTBrowser,google,gptPlugins,anthropic"
65+
MONGO_URI = "mongodb://${var.mongo_user}:${var.mongo_password}@${var.mongo_host}:${var.mongo_port}/${var.mongo_database}"
66+
}
67+
})
68+
]
69+
}
70+

‎tf-modules-ai/librechat/terraform.tf

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
terraform {
2+
required_providers {
3+
helm = {
4+
source = "hashicorp/helm"
5+
}
6+
kubernetes = {
7+
source = "hashicorp/kubernetes"
8+
}
9+
mongodb = {
10+
source = "01Joseph-Hwang10/mongodb"
11+
}
12+
}
13+
}

‎tf-modules-ai/librechat/variables.tf

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
variable "mongo_database" {
2+
description = "The name of the MongoDB database to use."
3+
default = "librechat"
4+
}
5+
6+
variable "mongo_host" {
7+
description = "The hostname of the MongoDB server."
8+
}
9+
10+
variable "mongo_password" {
11+
description = "The password to use to connect to the MongoDB server."
12+
}
13+
14+
variable "mongo_user" {
15+
description = "The username to use to connect to the MongoDB server."
16+
}
17+
18+
variable "mongo_port" {
19+
default = 27017
20+
}

0 commit comments

Comments
 (0)