Skip to content

Configuration

Open the development shell, which includes all the tools needed:

nix develop

If your Initial controller Linux distribution is Ubuntu, you need to execute the following command:

# Install nix
sudo apt install -y nix

# Add your normal user to the nix* group
sudo usermod -aG nixbld $USER
sudo usermod -aG nix-users $USER

# Re-login to apply the changes
# You can also run the following command to activate the changes to groups:
newgrp nixbld
newgrp nix-user

# nix develop
nix develop --extra-experimental-features nix-command --extra-experimental-features flakes

Run the following script to configure the homelab:

make configure

Example

Enter your env (prod):
Text editor (nvim):
Enter seed repo (github.com/east4ming/homelab2): github.com/example/homelab
Enter your domain (west-beta.ts.net): example.ts.net

It will prompt you to edit the inventory:

  • control_plane_endpoint
  • tailscale_auth_key
  • tailscale_client_id
  • tailscale_client_secret
  • registries_config_yaml
  • IP address: the desired one, not the current one, since your servers have no operating system installed yet
  • Disk: based on /dev/$DISK, in my case it's sda, but yours can be sdb, nvme0n1...
  • Network interface: usually it's eth0, mine is eno1
  • MAC address: the lowercase, colon separated MAC address of the above network interface

Example

metal/inventories/prod.yml.example
# Sanitized example of metal/inventories/prod.yml.
#
# This is the only inventory the documentation site inlines
# (docs/installation/production/configuration.md). Keep it free of real
# values: it is committed and published to homelab2.e-whisper.com.
# Your own metal/inventories/prod.yml is never part of the docs build.
all:
  vars:
    control_plane_endpoint: 192.0.2.100
    load_balancer_ip_pool:
      - 192.0.2.32/27
    # Site ULA (RFC 4193): pick your own random 40-bit global ID.
    # k3s cluster-cidr and Cilium clusterPoolIPv6PodCIDRList must use the same
    # pool, so it is defined once here and shared by both roles.
    dualstack_ipv6_pod_cidr: "fd00:1:2:3:4200::/56"       # Pod IPv6（每节点 /64）
    dualstack_ipv6_service_cidr: "fd00:1:2:3:4300::/112"  # Service IPv6
    ntp_server: "ntp.ubuntu.com"
    # Used for tailscale k8s node
    tailscale_auth_key: "tskey-auth-REPLACE_ME"
    # Used for tailscale-operator
    tailscale_client_id: "REPLACE_ME"
    tailscale_client_secret: "tskey-client-REPLACE_ME"
    registries_config_yaml: |
      mirrors:
        "*":
        docker.io:
          endpoint:
            - "https://registry.cn-hangzhou.aliyuncs.com"
metal:
  children:
    masters:
      hosts:
        node-0:
          ansible_host: 192.0.2.101
          mac: "aa:bb:cc:dd:ee:01"
          disk: nvme0n1
          network_interface: enp3s0
        node-1:
          ansible_host: 192.0.2.102
          mac: "aa:bb:cc:dd:ee:02"
          disk: nvme0n1
          network_interface: enp3s0
        node-2:
          ansible_host: 192.0.2.103
          mac: "aa:bb:cc:dd:ee:03"
          disk: nvme0n1
          network_interface: enp3s0
    workers:
      hosts:
        worker-0:
          ansible_host: 192.0.2.104
          mac: "aa:bb:cc:dd:ee:04"
          disk: nvme0n1
          network_interface: enp2s0

This is a sanitized example. The documentation site only ever inlines metal/inventories/prod.yml.example, never your own metal/inventories/prod.yml: mkdocs.yml restricts pymdownx.snippets to an allowlist of snippet files, so pointing a page at a real inventory fails the build instead of publishing it.

At the end it will show what has changed. After examining the diff, commit and ~~push~~ the changes.

🐾Warning: 不要将您的任何密钥 PUSH 到 GitHub 公共仓库. 包括不限于:

  • tailscale_auth_key
  • tailscale_client_id
  • tailscale_client_secret
  • registries_config_yaml
  • 各节点的 mac

以上值不再写进 prod.yml，而是放在被 gitignore 的 metal/inventories/group_vars/all/zz-secrets.yml（模板见同目录 .example）；缺少真实值时 play 会在写任何配置之前 fail。要填哪些值、 为什么、轮换注意事项见 metal/README.md。