feat: add gen-certs script and update adguard
This commit is contained in:
parent
7075e08573
commit
abd0e9bb4d
3 changed files with 105 additions and 117 deletions
116
README.md
116
README.md
|
|
@ -7,119 +7,3 @@
|
|||
```bash
|
||||
ethtool -K eno1 tx off rx off
|
||||
```
|
||||
|
||||
## scripts
|
||||
|
||||
### `hbd.sh` - Helm Build and Deploy
|
||||
|
||||
Package and push Helm charts to an OCI registry.
|
||||
|
||||
```bash
|
||||
scripts/hbd.sh <chart-name> [version] [--oci-registry <registry>]
|
||||
```
|
||||
|
||||
**Arguments:**
|
||||
- `chart-name` - Name of the chart in `k8s/charts/`
|
||||
- `version` (optional) - Version to deploy. If omitted, bumps patch version (e.g., 0.1.0 → 0.1.1)
|
||||
- `--oci-registry <registry>` (optional) - Override default OCI registry
|
||||
|
||||
**Default registry:** `oci://git.roboces.dev/catalin/fukuops`
|
||||
|
||||
**Examples:**
|
||||
```bash
|
||||
# Deploy next patch version (0.1.0 → 0.1.1)
|
||||
scripts/hbd.sh vaultwarden
|
||||
|
||||
# Deploy specific version
|
||||
scripts/hbd.sh vaultwarden 0.2.0
|
||||
|
||||
# Deploy to custom registry
|
||||
scripts/hbd.sh vaultwarden 0.1.1 --oci-registry oci://my-registry.com/charts
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### `k3scale.sh` - Kubernetes Scaling
|
||||
|
||||
Scale deployments and statefulsets in a k3s cluster.
|
||||
|
||||
```bash
|
||||
scripts/k3scale.sh REPLICAS [RESOURCE...] [OPTIONS]
|
||||
```
|
||||
|
||||
**Arguments:**
|
||||
- `REPLICAS` - Number of replicas to scale to
|
||||
- `RESOURCE` - Resource to scale in `namespace/name` format (can specify multiple)
|
||||
|
||||
**Options:**
|
||||
- `--all` - Scale all deployments/statefulsets in current namespace
|
||||
- `--all-namespaces` - Scale across all namespaces
|
||||
- `-n, --namespace NAMESPACE` - Target namespace
|
||||
- `--dry-run` - Show actions without executing
|
||||
- `-v|-vv|-vvv` - Verbosity levels
|
||||
|
||||
**Examples:**
|
||||
```bash
|
||||
scripts/k3scale.sh 1 mynamespace/mydeployment
|
||||
scripts/k3scale.sh 0 --all --namespace production
|
||||
scripts/k3scale.sh 3 --all --dry-run
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### `proxmox-power.sh` - Proxmox VM Management
|
||||
|
||||
Start or shutdown QEMU VMs and LXC containers on a Proxmox cluster.
|
||||
|
||||
```bash
|
||||
scripts/proxmox-power.sh --op start|shutdown [--all | --ids <vmid> ...]] [OPTIONS]
|
||||
```
|
||||
|
||||
**Options:**
|
||||
- `--op OP` - Operation: `start` or `shutdown` (required)
|
||||
- `--all` - Operate on all VMs/containers (honors filters)
|
||||
- `--ids LIST` - Space-separated list of VMIDs
|
||||
- `--only-qemu` - Only QEMU VMs
|
||||
- `--only-lxc` - Only LXC containers
|
||||
- `--force` - Force shutdown if timeout exceeded
|
||||
- `--timeout SEC` - Shutdown wait timeout (default: 120)
|
||||
- `--concurrency N` - Parallel operations (default: 4)
|
||||
- `--node NODE` - Restrict to specific node
|
||||
- `--dry-run` - Show actions without executing
|
||||
- `--insecure` - Skip SSL verification
|
||||
|
||||
**Authentication (env vars):**
|
||||
- API Token: `PVE_TOKEN_ID` + `PVE_TOKEN_SECRET`
|
||||
- Password: `PVE_USER` + `PVE_PASSWORD` (or via GNOME keyring)
|
||||
|
||||
**Examples:**
|
||||
```bash
|
||||
scripts/proxmox-power.sh --op shutdown --all
|
||||
scripts/proxmox-power.sh --op start --ids 100 101 --node mynode
|
||||
PVE_TOKEN_ID=user@pam!ci scripts/proxmox-power.sh --op start --all
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
|
||||
### `update-argo.sh` - ArgoCD Upgrades
|
||||
|
||||
Upgrade ArgoCD to a new version.
|
||||
|
||||
```bash
|
||||
scripts/update-argo.sh [VERSION] [OPTIONS]
|
||||
```
|
||||
|
||||
**Arguments:**
|
||||
- `VERSION` (optional) - Target version. If omitted, auto-detects latest
|
||||
|
||||
**Options:**
|
||||
- `--dry-run` - Show what would be done
|
||||
- `-v|-vv|-vvv` - Verbosity levels
|
||||
|
||||
**Examples:**
|
||||
```bash
|
||||
scripts/update-argo.sh # Upgrade to latest
|
||||
scripts/update-argo.sh v2.9.0 # Upgrade to specific version
|
||||
scripts/update-argo.sh --dry-run -vv # Preview with verbose output
|
||||
```
|
||||
|
|
|
|||
93
scripts/gen-certs.sh
Executable file
93
scripts/gen-certs.sh
Executable file
|
|
@ -0,0 +1,93 @@
|
|||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
usage() {
|
||||
echo "Usage: $0 <fqdn> [-o destination]"
|
||||
echo " <fqdn> Fully qualified domain name for the certificate"
|
||||
echo " -o Optional destination (local path or ssh://host:port/path)"
|
||||
echo " Supported protocols: ssh://"
|
||||
exit 1
|
||||
}
|
||||
|
||||
if [ $# -lt 1 ]; then
|
||||
usage
|
||||
fi
|
||||
|
||||
if [[ "$1" == -* ]]; then
|
||||
usage
|
||||
fi
|
||||
|
||||
FQDN="$1"
|
||||
shift 1
|
||||
|
||||
DEST=""
|
||||
OPTIND=1
|
||||
while getopts "ho:" opt; do
|
||||
case "$opt" in
|
||||
h) usage ;;
|
||||
o) DEST="$OPTARG" ;;
|
||||
*) usage ;;
|
||||
esac
|
||||
done
|
||||
|
||||
CERT_FILE="${FQDN}.pem"
|
||||
KEY_FILE="${FQDN}.key.pem"
|
||||
|
||||
generate_cert() {
|
||||
echo "Generating SSL certificate for ${FQDN}..."
|
||||
|
||||
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
|
||||
-keyout "${KEY_FILE}" \
|
||||
-out "${CERT_FILE}" \
|
||||
-subj "/CN=${FQDN}" \
|
||||
-addext "subjectAltName=DNS:${FQDN}" \
|
||||
2>/dev/null
|
||||
|
||||
echo "Certificate generated: ${CERT_FILE}"
|
||||
echo "Key generated: ${KEY_FILE}"
|
||||
}
|
||||
|
||||
transfer_via_ssh() {
|
||||
local dest="$1"
|
||||
local host port path
|
||||
|
||||
dest="${dest#*://}"
|
||||
host="${dest%%:*}"
|
||||
|
||||
local remainder="${dest#*:}"
|
||||
if [[ "$remainder" == /* ]]; then
|
||||
path="$remainder"
|
||||
port="22"
|
||||
else
|
||||
port="${remainder%%/*}"
|
||||
path="/${remainder#*/}"
|
||||
fi
|
||||
|
||||
echo "Transferring certificates to ${host}:${port}${path}..."
|
||||
|
||||
scp -P "${port}" "${CERT_FILE}" "${KEY_FILE}" "${host}:${path}/"
|
||||
|
||||
echo "Certificates transferred successfully."
|
||||
}
|
||||
|
||||
main() {
|
||||
generate_cert
|
||||
|
||||
|
||||
if [ -z "${DEST}" ]; then
|
||||
echo "Certificates are in the current directory (no -o destination provided)."
|
||||
return
|
||||
fi
|
||||
|
||||
if [[ "$DEST" == ssh://* ]]; then
|
||||
transfer_via_ssh "${DEST#ssh://}"
|
||||
else
|
||||
if [ ! -d "${DEST}" ]; then
|
||||
mkdir -p "${DEST}"
|
||||
fi
|
||||
cp "${CERT_FILE}" "${KEY_FILE}" "${DEST}/"
|
||||
echo "Certificates copied to ${DEST}/"
|
||||
fi
|
||||
}
|
||||
|
||||
main
|
||||
|
|
@ -17,7 +17,8 @@ terraform {
|
|||
provider "adguard" {
|
||||
host = "dns.fuku"
|
||||
username = "admin"
|
||||
scheme = "http"
|
||||
scheme = "https"
|
||||
insecure = "true"
|
||||
timeout = 5
|
||||
}
|
||||
|
||||
|
|
@ -111,3 +112,13 @@ resource "adguard_rewrite" "vault" {
|
|||
domain = "vault.roboces.dev"
|
||||
answer = "192.168.1.12"
|
||||
}
|
||||
|
||||
resource "adguard_rewrite" "pocketid" {
|
||||
domain = "auth.roboces.dev"
|
||||
answer = "192.168.1.12"
|
||||
}
|
||||
|
||||
resource "adguard_rewrite" "dns" {
|
||||
domain = "dns.fuku"
|
||||
answer = "192.168.1.12"
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue