Colmena is a simple, stateless NixOS deployment tool modeled after NixOps and morph, written in Rust. It's a thin wrapper over Nix commands like nix-instantiate and nix-copy-closure, and supports parallel deployment.
PostgreSQL High Availability Options: Why PostgreSQL High Availability Matters and How to Achieve It
A Guide to PostgreSQL High Availability
Ensuring your application can handle failures and outages is crucial, and the availability of your application is only as good as the availability of your PostgreSQL instance. With that in mind, you may be wondering which PostgreSQL high availability (HA) deployment option is best for your application.
Let’s review several popular solutions that increase the high availability of PostgreSQL deployments and, as a result, the availability overall of your application. Why several and not one? Well, there’s no silver bullet or one-size-fits-all solution when it comes to high availability and PostgreSQL. So, walk through the options for a highly available deployment of PostgreSQL and then you can make a choice that fits your use case.
Build Your Own Darknet
Discover the simplest way to re-enter independent computing with our framework. Placing control directly at your fingertips.
Self-hosting services empowers you with greater control and flexibility over your data. However, maintaining such systems today often comes with significant technical challenges, including firewall/NAT configuration, data loss prevention, and security management.
The Clan project aims to lower the technical barriers of self-hosting with NixOS, making it accessible even to non-technical users. Our goal is to simplify the installation and maintenance of NixOS machines.
In this talk, we will present the new NixOS extensions we've developed to scale self-hosting, including VPN integration, backup management, secret management, a unified CLI for installation and updates, and an inventory system for managing clusters of machines.
We will also provide a sneak preview of the upcoming graphical user interface.
microvm.nix is a Flake to run lightweight NixOS virtual machines on NixOS. Starting with the reasons why for the remainder of this chapter, this handbook guides you through the provisioning of MicroVMs on your NixOS machine.
Compartmentalization
NixOS makes running services a breeze. Being able to quickly rollback configuration is a life-saver. Not so much however on systems that are shared by multiple services where maintenance of one affects others.
Increase stability by partitioning services into virtual NixOS systems that can be updated individually.
microvm.nix can isolate your /nix/store into exactly what is required for the guest's NixOS: the root filesystem is a read-only erofs/squashfs file-systems that include only the binaries of your configuration. Of course, that holds only true until you mount the host's /nix/store as a share for faster build times, or mount the store with a writable overlay for Nix builds inside the VM.
The Case Against Containers
Linux containers are not a single technology but a plethora of kernel features that serve to isolate various system resources so that the running system appears as one. It is still one shared Linux kernel with a huge attack surface.
Virtual machines on the other hand run their own OS kernel, reducing the attack surface to the hypervisor and its device drivers. The resource usage however incurs some overhead when compared with containers, with memory allocation being especially inflexible.
microvm.nix is a tool that helps you building the guest's OS and running it in ways that are easier than writing a Dockerfile, once you know how to put a NixOS config into a flake.nix file.
Just Virtual Machines?
Full virtualization has been available for a long time with QEMU and VirtualBox. The MicroVM machine type highlights that virtualization overhead has been reduced a lot by replacing emulated devices with virtio interfaces that have been optimized for this environment.
This Flake offers you to run your MicroVMs not only on QEMU but with other Hypervisors that have been explicitly authored for virtio. Some of them are written in Rust, a programming language that is renowned for being safer than C.
A KISS deployment tool to keep your NixOS fleet (servers & workstations) up to date.
This name was chosen because Bento are good, and comes with the idea of "ready to use". And it doesn't use "nix" in its name.
Use with flakes: nix shell github:rapenne-s/bento
If your machine doesn't currently have an operating system installed, you can still run nixos-anywhere remotely to automate the install. To do this, you would first need to boot the target machine from the standard NixOS installer. You can either boot from a USB or use netboot.
The NixOS installation guide has detailed instructions on how to boot the installer.
When you run nixos-anywhere, it will determine whether a NixOS installer is present by checking whether the /etc/os-release file contains the identifier VARIANT_ID=installer. This identifier is available on releases NixOS 23.05 or later.
If an installer is detected, nixos-anywhere will not attempt to kexec into its own image. This is particularly useful for targets that don't have enough RAM for kexec or don't support kexec.
NixOS starts an SSH server on the installer by default, but you need to set a password in order to access it.
NixOS is a Linux distribution where everything is described as code, with one exception: during installation, the disk partitioning and formatting are manual steps. disko aims to correct this sad 🤡 omission.
This is especially useful for unattended installations, re-installation after a system crash or for setting up more than one identical server.
Setting up a new machine is time-consuming, and becomes complicated when it needs to be done remotely. If you're installing NixOS, the nixos-anywhere tool allows you to pre-configure the whole process including:
- Disk partitioning and formatting
- Configuring and installing NixOS
- Installing additional files and software
You can then initiate an unattended installation with a single CLI command. Since nixos-anywhere can access the new machine using SSH, it's ideal for remote installations.
Once you have initiated the command, there is no need to 'babysit' the installation. It all happens automatically.
You can use the stored configuration to repeat the same installation if you need to.
disko can either be used after booting from a NixOS installer, or in conjunction with nixos-anywhere if you're installing remotely.
Before using disko, the specifications of the disks, partitions, type of formatting and the mount points must be defined in a Nix configuration. You can find examples of typical configurations in the Nix community repository, and use one of these as the basis of your own configuration.
You can keep your configuration and re-use it for other installations, or for a system rebuild.
disko is flexible, in that it supports most of the common formatting and partitioning options, including:
Disk layouts: GPT, MBR, and mixed.
Partition tools: LVM, mdadm, LUKS, and more.
Filesystems: ext4, btrfs, ZFS, bcachefs, tmpfs, and others.It can work with these in various configurations and orders, and supports recursive layouts.
I erase my systems at every boot.
Over time, a system collects state on its root partition. This state lives in assorted directories like /etc and /var, and represents every under-documented or out-of-order step in bringing up the services.
“Right, run myapp-init.”These small, inconsequential “oh, oops” steps are the pieces that get lost and don’t appear in your runbooks.
“Just download ca-certificates to … to fix …”Each of these quick fixes leaves you doomed to repeat history in three years when you’re finally doing that dreaded RHEL 7 to RHEL 8 upgrade.
“Oh, touch /etc/ipsec.secrets or the l2tp tunnel won’t work.”
An Ansible AWX operator for Kubernetes built with Operator SDK and Ansible.
Kubermatic KubeOne automates cluster operations on all your cloud, on-prem, edge, and IoT environments. It comes as a CLI that allows you to manage the full lifecycle of your clusters, including installing and provisioning, upgrading, repairing, and unprovisioning your Kubernetes clusters.
Flux is a tool that automatically ensures that the state of a cluster matches the config in git. It uses an operator in the cluster to trigger deployments inside Kubernetes, which means you don't need a separate CD tool. It monitors all relevant image repositories, detects new images, triggers deployments and updates the desired running configuration based on that (and a configurable policy).
The benefits are: you don't need to grant your CI access to the cluster, every change is atomic and transactional, git has your audit log. Each transaction either fails or succeeds cleanly. You're entirely code centric and don't need new infrastructure.
Heute läuft der Server mit Ubuntu 20.04. Darauf laufen keine LXC/LXD Container mehr. Stattdessen läuft jetzt Kubernetes darauf. Zu Beginn nutzte ich für die Installation von Kubernetes Kubespray ein, das Standard-Kubernetes war allerdings deutlich zu fett. Größtes Manko war, dass das etcd verdammt viel auf die SSD geschrieben hat und ich regelmäßig bei jedem Upgrade das Setup kaputt gespielt habe. Für den Privatgebrauch ergab das so daher keinen Sinn.
Mittlerweile setze ich auf das vergleichsweise schlanke k3s.io. Das braucht im Heimbetrieb deutlich weniger Leistung und erledigt trotzdem das, was ich brauche. Statt etcd setzt es auf sqlite und statt Docker auf containerd.
The certified Kubernetes distribution built for IoT & Edge computing
Infrastructure as Code (IaC) is changing the way that we’re doing things. Some people think that it’s the motorway that we have to follow and be aligned with business, as a resume they want us to be agile.
The arrival of tools such as Ansible, Puppet, SaltStack, and Chef, have enabled sysadmins to maintain modular, automatable infrastructure. This time I would like to introduce the Terraform tool.
Terraform is a provisioning declarative tool that is based on the Infrastructure as Code paradigm. Terraform is a multipurpose composition tool: it composes multiple tiers (SaaS/PaaS/IaaS).
Terraform is not a cloud agnostic tool, but in combination with OpenNebula, it can be amazing. By taking advantage of the template concept it will allow us to deploy vm’s agnostically in different cloud providers, such as AWS, Azure or on premise cloud infrastructure.
aenigma provisions a fully functional and out-of-the-box secure XMPP server you can get running today.
It does for XMPP what Mail-in-a-Box has done for email, Streisand for VPNs, and Easyengine for wordpress.
The installation takes you on a 15 minute, clearly worded, step-by-step setup and takes care of everything automagically.
kubeadm helps you bootstrap a minimum viable Kubernetes cluster that conforms to best practices. With kubeadm, your cluster should pass Kubernetes Conformance tests. Kubeadm also supports other cluster lifecycle functions, such as upgrades, downgrade, and managing bootstrap tokens.
Because you can install kubeadm on various types of machine (e.g. laptop, server, Raspberry Pi, etc.), it’s well suited for integration with provisioning systems such as Terraform or Ansible.
kubeadm’s simplicity means it can serve a wide range of use cases:
New users can start with kubeadm to try Kubernetes out for the first time.
Users familiar with Kubernetes can spin up clusters with kubeadm and test their applications.
Larger projects can include kubeadm as a building block in a more complex system that can also include other installer tools.kubeadm is designed to be a simple way for new users to start trying Kubernetes out, possibly for the first time, a way for existing users to test their application on and stitch together a cluster easily, and also to be a building block in other ecosystem and/or installer tool with a larger scope.
You can install kubeadm very easily on operating systems that support installing deb or rpm packages. The responsible SIG for kubeadm, SIG Cluster Lifecycle, provides these packages pre-built for you, but you may also on other OSes.
There are multiple ways to run a Kubernetes cluster with Ubuntu. These pages explain how to deploy Kubernetes on Ubuntu on multiple public and private clouds, as well as bare metal.