feat: add libre chat and cilium in install process

.github/workflows/release-nixos.yml

@@ -20,23 +20,9 @@ jobs:
     runs-on: ubuntu-latest
     name: Release nix image
     steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-
-      - uses: cachix/install-nix-action@v25
-        with:
-          extra_nix_config: |
-            experimental-features = nix-command flakes
-          github_access_token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Restore and cache Nix store
-        uses: nix-community/cache-nix-action@v5
-        with:
-          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix') }}
-          restore-prefixes-first-match: nix-${{ runner.os }}-
-          gc-max-store-size-linux: 1073741824
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/nix-installer-action@main
+      - uses: DeterminateSystems/magic-nix-cache-action@main
 
       - name: Build production image
         id: build-stable

Makefile

@@ -3,6 +3,7 @@ MAKEFLAGS += --no-builtin-rules --no-builtin-variables
 TF_CMD:=apply -auto-approve
 VARIANT=builder
 SYSTEM?=aarch64-linux
+TESTING_X86_URL=https://github.com/loic-roux-404/k3s-paas/releases/download/nixos-testing/nixos.qcow2
 
 #### Nix
 
@@ -28,12 +29,13 @@ nixos-local: bootstrap build
 build:
 	@nix build .#nixosConfigurations.initial.config.formats.qcow --system $(SYSTEM)
 
+pull-testing-x86:
+	@rm -rf result && mkdir result
+	@wget -q --show-progress -O result/nixos.qcow2 $(TESTING_X86_URL)
+
 TERRAGRUNT_FILES:=$(shell find terragrunt -type d -name '.*' -prune -o -name 'terragrunt.hcl' -exec dirname {} \;)
 
 $(TERRAGRUNT_FILES):
 	@cd $@ && terragrunt $(TF_CMD)
 
-release-stable:
-	@git tag nixos-stable -f && git push --tags --force
-
 .PHONY: fmt bootstrap nixos-local trust-ca $(TERRAGRUNT_FILES)

nixos-options/default.nix

@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ lib, pkgs, config, ... }:
 
 {
   options.k3s-paas = {
@@ -62,11 +62,82 @@
       default = "";
     };
 
+    k3s.podCIDR = lib.mkOption {
+      type = lib.types.str;
+      description = "Pod CIDR";
+      default = "10.100.0.0/16";
+    };
+
+    k3s.serviceCIDR = lib.mkOption {
+      type = lib.types.str;
+      description = "Pod CIDR";
+      default = "10.110.0.0/16";
+    };
+
+    k3s.clusterDns = lib.mkOption {
+      type = lib.types.str;
+      description = "Cluster DNS";
+      default = "10.110.0.10";
+    };
+
+    k3s.serviceIp = lib.mkOption {
+      type = lib.types.str;
+      description = "Service IP";
+      default = "10.110.0.1";
+    };
+
+    k3s.serviceHost = lib.mkOption {
+      type = lib.types.str;
+      description = "Service host";
+      default = "";
+    };
+
+    k3s.servicePort = lib.mkOption {
+      type = lib.types.int;
+      description = "Service port";
+      default = 6443;
+    };
+
+    cilium.version = lib.mkOption {
+      type = lib.types.str;
+      description = "Cilium version";
+      default = "1.16.1";
+    };
+
     dex.dexClientId = lib.mkOption {
       type = lib.types.str;
       description = "Client ID for Dex";
       default = "dex-k3s-paas";
     };
 
+    cert-manager.version = lib.mkOption {
+      type = lib.types.str;
+      description = "Cert Manager version";
+      default = "1.15.2";
+    };
+
+    defaultK3sConfigPath = lib.mkOption {
+      type = lib.types.path;
+      description = "Default config yaml";
+      default = "";
+    };
+  };
+
+  config = with config.k3s-paas; {
+    k3s-paas.defaultK3sConfigPath = pkgs.writeText ''
+      cluster-cidr: ${k3s.podCIDR}
+      service-cidr: ${k3s.serviceCIDR}
+      cluster-dns: ${k3s.clusterDns}
+      tls-san:
+        - localhost
+        - 127.0.0.1
+        - ${k3s.serviceIp}
+        - ${config.networking.hostName}
+      kube-apiserver-arg=authorization-mode: Node,RBAC
+      kube-apiserver-arg=oidc-issuer-url: https://dex.${dns.name}
+      kube-apiserver-arg=oidc-client-id: ${dex.dexClientId}
+      kube-apiserver-arg=oidc-username-claim: email
+      kube-apiserver-arg=oidc-groups-claim: groups
+    '';
   };
 }

nixos/configuration.nix

@@ -82,7 +82,7 @@ in {
     config.services.tailscale.enable 
   ) {
     serviceConfig = {
-      RemainAfterExit = true; # Ensures it's remains active after running.
+      RemainAfterExit = true;
     };
   };
 
@@ -103,9 +103,8 @@ in {
 
   systemd.services.k3s.serviceConfig.Environment = "PATH=${pkgs.tailscale}/bin:${pkgs.coreutils}/bin";
   services.k3s = {
-    enable = lib.mkDefault false;
+    enable = lib.mkDefault true;
     role = "server";
-    package = k3sPkg;
     extraFlags = lib.strings.concatStringsSep " " (
       map (service: "--disable=${service}") k3s.disableServices
       ++ k3s.serverExtraArgs
@@ -116,25 +115,109 @@ in {
         "--egress-selector-mode=disabled"
       ]
     );
-    # manifests = {
-    #   certManager = {
-    #     name = "cert-manager";
-    #     namespace = certManagerNamespace;
-    #     createNamespace = true;
-    #     repository = "https://charts.jetstack.io";
-    #     chart = "cert-manager";
-    #     version = "1.15.2";
-    #     waitForJobs = true;
-    #     atomic = true;
-    #     timeout = 120;
-
-    #     values = ''
-    #       crds:
-    #         enabled = true
-    #     '';
-    #   };
-    # };
+    configPath = lib.mkDefault defaultK3sConfigPath;
+    manifests.certManager.content = {
+      apiVersion = "helm.cattle.io/v1";
+      kind = "HelmChart";
+      metadata = {
+        name = "cilium";
+        namespace = "kube-system";
+      };
+      spec = {
+        name = "cert-manager";
+        namespace = "cert-manager";
+        createNamespace = true;
+        repository = "https://charts.jetstack.io";
+        chart = "cert-manager";
+        version = cert-manager.version;
+        wait = true;
+        cleanup_on_fail = true;
+        waitForJobs = true;
+        timeout = 120;
+
+        valuesContent = ''
+          crds:
+            enabled = true
+        '';
+      };
+    };
+    manifests.cilium.content = {
+      apiVersion = "helm.cattle.io/v1";
+      kind = "HelmChart";
+      metadata = {
+        name = "cilium";
+        namespace = "kube-system";
+      };
+      spec = {
+        name     = "cilium";
+        namespace        = "kube-system";
+        repository       = "https://helm.cilium.io";
+        chart            = "cilium";
+        wait = true;
+        cleanup_on_fail = true;
+        version          = cilium.version;
+        valuesContent = ''
+          l2announcements:
+            enabled: true
+
+          kubeProxyReplacement: true
+
+          bpf:
+            masquerade: true
+            lbExternalClusterIP: false
+
+          gatewayAPI:
+            enabled: false
+
+          routingMode: tunnel
+
+          tunnelProtocol: vxlan
+
+          ingressController:
+            enabled: true
+            default: true
+            loadbalancerMode: dedicated
+            service:
+              name: cilium-ingress-external
+              labels:
+                k3s-paas/internal: "true"
+
+          prometheus:
+            enabled: true
+            serviceMonitor:
+              enabled: true
+
+          operator:
+            replicas: 1
+            prometheus:
+              enabled: true
+
+          hubble:
+            relay:
+              enabled: true
+            metrics:
+              enabled:
+                - dns
+                - drop
+                - tcp
+                - flow
+                - port-distribution
+                - icmp
+                - httpV2:exemplars=true;labelsContext=source_ip,source_namespace,source_workload,destination_ip,destination_namespace,destination_workload,traffic_direction
+              enableOpenMetrics: true
+
+          ipam:
+            operator:
+              clusterPoolIPv4PodCIDRList:
+                - "${k3s.podCIDR}"
+        '' + (if k3s.serviceHost != "" then ''
+          k8sServiceHost: "${k3s.serviceHost}"
+          k8sServicePort: "${k3s.servicePort}"
+        '' else "");
+      };
+    };
   };
+
   services.fail2ban.enable = true;
 
   security.pki.certificateFiles = certs;

nixos/deploy.nix

@@ -36,22 +36,20 @@ with config.k3s-paas;
   sops.secrets.tailscaleDomain = {};
   sops.secrets.password = { neededForUsers = true; };
 
-  services.k3s.enable = true;
   services.k3s.configPath = config.sops.templates."config.yaml".path;
 
   sops.templates."config.yaml".content = ''
     advertise-address: ${config.sops.placeholder.internalNodeIp}
     node-name: "${config.networking.hostName}"
     cluster-domain: ${config.sops.placeholder.paasDomain}
     node-external-ip: "${config.sops.placeholder.nodeIp}"
-    cluster-cidr: 10.100.0.0/16
-    service-cidr: 10.110.0.0/16
-    cluster-dns: 10.110.0.10
+    cluster-cidr: ${k3s.podCIDR}
+    service-cidr: ${k3s.serviceCIDR}
+    cluster-dns: ${k3s.clusterDns}
     vpn-auth: "name=tailscale,joinKey=${config.sops.placeholder.tailscaleNodeKey}"
     tls-san:
-      - localhost
-      - 10.43.0.1
-      - ${config.networking.hostName}
+      - "${k3s.serviceIp}"
+      - "${config.networking.hostName}"
       - "${config.sops.placeholder.tailscaleDomain}"
       - "${config.sops.placeholder.nodeIp}"
       - "${config.sops.placeholder.internalNodeIp}"

nixos/qcow-compressed.nix

@@ -4,7 +4,7 @@
   ];
   system.build.qcow = lib.mkForce (import "${toString modulesPath}/../lib/make-disk-image.nix" {
     inherit lib config pkgs;
-    diskSize = "auto";
+    diskSize = 8192;
     format = "qcow2-compressed";
     partitionTableType = "hybrid";
   });

tf-modules-ai/librechat/main.tf

@@ -0,0 +1,70 @@
+
+
+resource "random_string" "creds_key" {
+  length  = 64
+  special = false
+}
+
+resource "random_string" "creds_iv" {
+  length  = 32
+  special = false
+}
+
+resource "random_string" "jwt_secret" {
+  length  = 64
+  special = false
+}
+
+resource "random_string" "jwt_refresh_secret" {
+  length  = 64
+  special = false
+}
+
+resource "kubernetes_secret" "librechat" {
+  metadata {
+    name      = "librechat"
+    namespace = "default"
+  }
+
+  data = {
+    CREDS_KEY              = "${random_string.creds_key.result}"
+    CREDS_IV               = "${random_string.creds_iv.result}"
+    MONGO_URI              = "${helm_release.mongodb.output.mongodb_uri}"
+    JWT_SECRET             = "${random_string.jwt_secret.result}"
+    JWT_REFRESH_SECRET     = "${random_string.jwt_refresh_secret.result}"
+  }
+}
+
+resource "helm_release" "librechat" {
+  name       = "librechat"
+  chart      = "<path-to-librechat-helm-chart>"  # Path to the LibreChat chart.
+  namespace  = "default"
+
+
+  values = [
+    yamlencode({
+      config = {
+        env_secrets = {
+          secret_ref = kubernetes_secret.librechat.metadata[0].name
+        }
+      }
+
+      env = {
+        ALLOW_EMAIL_LOGIN         = true
+        ALLOW_REGISTRATION        = true
+        ALLOW_SOCIAL_LOGIN        = false
+        ALLOW_SOCIAL_REGISTRATION = false
+        CUSTOM_FOOTER             = "Orga-404 librechat"
+        DEBUG_CONSOLE             = true
+        DEBUG_LOGGING             = true
+        DEBUG_OPENAI              = true
+        DEBUG_PLUGINS             = true
+        DOMAIN_CLIENT             = ""
+        DOMAIN_SERVER             = ""
+        ENDPOINTS                 = "openAI,azureOpenAI,bingAI,chatGPTBrowser,google,gptPlugins,anthropic"
+        MONGO_URI                 = "mongodb://${var.mongo_user}:${var.mongo_password}@${var.mongo_host}:${var.mongo_port}/${var.mongo_database}"
+      }
+    })
+  ]
+}
+