Cloudinit-Nm on Janusworx

2025-12-12 Notes

feedback@janusworx.com (Mario Jason Braganza) — Fri, 12 Dec 2025 08:15:59 +0530

Goals + Recap
#

Read a book on Traefik, yesterday. Pretty helpful. It covered the older version of Traefik though, so I’ll have to adapt the advice to my new version. I tried reading the actual documentation next, but they are umm, I cannot put my finger on it, but I keep getting lost. What is written, is pretty well written, but I think there is a lack of a connecting link from the big picture to the nitty gritty, or if there is, is just glossed over. If it wasn’t for the book, I’d be pretty lost. But as a reference though, it is really good.
The cluster is still up and running well. Miniflux works. Been using it all day yesterday and today. Pretty please with the decision to move to a cluster, now that it is set up.
Look at The Big Plan (Done! 🎉🎉🎉), to see if anything needs adding or changing
Today, figure out http to https redirects. And move the main site https://janusworx.com to the cluster

2025-12-12 09:15
#

Let’s get to work!
2025-12-12 09:30: Changed all my Hugo archetypes to no longer include links to my discourse. Will need to maket the time someday to remove existing links from all the pages.
2025-12-12 10:04: Got my http to https redirect working! Also fixed my tls sealed-secret for traefix. Nothing big, but in my haste, yesterday, I forgot to export it in yaml. And today, I wondered why my manifest was formatted so queerly, until I realisde I was looking at json. Surprisingly, Traefik had taken that json-in-yaml manifest and worked without complaint! Tea break.

2025-12-12 10:30
#

Thoughts to move https://janusworx.com to the new cluster.
- Doing this first, because this is the most public facing part of my VM. If there are any issues here, better get them out as soon as possible.
- Have a folder that I can rsync all my new posts to (like it is on the old one)
- Have an nginx container look at it via some hostpath pvc?
- Serve!
Now to go stumble about doing it and fixing any hiccoughs along the way
Disabled miniflux on the old VM as well
2025-12-12 10:45: Ok think I will first fix my deploy action to sync to the new VM
2025-12-12 11:27: Use ansible to create a folder for my hugo deploy
Switched variables in my forgejo action to the new VM, gave it my new key, as well as updated known hosts (No other change)
Manually running the action now. Did not realise how big my site has grown in size over the years
2025-12-12 11:33: Ok my action timed out. Think I will manually move stuff first with a syncthing sync. (Thank god i set it up yesterday!)
2025-12-12 11:40: Running action again. It works! It works!
Now I know why gitops! Change a few variables, drink some soup et voilà, your new site deploy is done! Wow! Love this!
2025-12-12 11:45: Also realised my original manual action run had not timed out. It was, in fact, interrupted by a subsequent automated run, which had succeeded!
Now that the data is in place, I’m off to get nginx working in the cluster.
2025-12-12 12:45: Just realised, I might have to have two containers. One for https://fr.janusworx.com as well. Seems wasteful. Checking to see, if one pod / nginx instance can do both.
2025-12-12 12:57: Realised, I am then asking Nginx to do another level of routing. Hmm, no thank you. I’ll keep things simple, be a little wasteful and run two nginx containers.
Lunch break

2025-12-12 13:30
#

Back for a while
2025-12-12 14:28: Yay! Done! https://janusworx.com is now served from the cluster! Done with work for the day :)

2025-12-12 14:45
#

Some NMC work now
2025-12-12 15:00: Tea. Be back later.

2025-12-12 16:20
#

Done with French. Off for a walk.

2025-12-12 17:30
#

2025-12-12 18:00: Send out a mail to the newsletter list. I might not be able to later, with this migration.
2025-12-12 19:20: Moved the french version of the site over as well. One less thing to do tomorrow.

Tomorrow
#

Enable image updation of the nginx image for both jw and fr.jw
Figure out how to go about moving the mastodon archive and keeping it updated

Feedback on this post?
Mail me at feedback at this domain.

2025-12-11 Notes

feedback@janusworx.com (Mario Jason Braganza) — Thu, 11 Dec 2025 08:18:29 +0530

Goals + Recap
#

I think, I think, that most of the fundamental pieces are in places after yesterday’s work.
The Big Plan is done!
Now to move each production item from the old VM to the new cluster.
Today, figure out http to https redirects. And move one app.
Note to Self: Quit at 1p. Get back to life.

The Big Plan (Done! 🎉🎉🎉)
#

The plan is to redo the cluster again and do my own instance of
- K3s
- Sealed Secrets
- ~~Certmanager~~ (Not using it)
- ~~Letsencrypt~~ (using pre existing Letsencrypt certs)
- Get Traefik Ingress to work
- Figure out a way to get certs automatically into the cluster
And once that is done, figure out an app to move (Miniflux or Hedgedoc?); 2025-12-03: Kanboard it is!
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed (Wildcard cert works now, just like it does without the cluster)
- Convert a docker-compose to kubernetes manifests
- Learn how to configure an app with code
- Learn how to store data and back it up
- Figure out secrets, if there are any (for now sealed secrets ok, figure out vault and vault injection later)
- Learn how to tunnel through and reverse proxy
- Make Kubernetes manifests work with flux
- Figure out how to automate deployment of manual manifests
- Figure out how to migrate there if there is any in an old app
- Figue out how to automate updation of images in manual manifests
- Get another app (Miniflux) deployed
- Figure out what needs to happen as part of the lifecycle. What you want in the cluster, what stays out, do they intersect, how do updates of cluster happen? VM (node) updates as well?
- Then begin to think along the lines of Live Deploys. Prototype locally and once it works, migrate to production immediately
- Convert Kubernetes manifests to Helm Charts (optional, based on energy)
Go live! Git is source of truth. Two repos.
- One for the Main node and its update
  - Terraform will provision node and install package, setup firewall
  - Figure out how to get Terraform to get the node talking to the git forge
  - Structure repo, copy every thing node related there, and make sure stuff gets updated periodically and idempotantly, via ansible pull and a systemd timer
- The other one for k3s and flux
  - Convert everything I have done locally to run on prod. Add more steps as you do them below

2025-12-11 09:30
#

The night passed well for the new VM. It rebooted on time, just as scheduled. Hetzner backed it up, just as instructed.
2025-12-11 09:37: Also, Oi, wot? Traefik natively supports what I have been trying to do with Lego! Get Lego to generate certs and install them as a sealed secret into the cluster for Traefik to use. Will try to figure out what to do once my Letsencrypt jail time gets over. Maybe do both. Traefik can handle stuff for the cluster and Lego can get them as well and keep them in another place in the VM in case I need it outside the cluster.
2025-12-11 09:55: Don’t think I want to work on the VM today. Will sit and read a book about Traefik. Tea Break

2025-12-11 10:15
#

Back. Begin reading!
2025-12-11 12:42: Lunch. Finished half of the book. Will do the rest after lunch.

2025-12-11 13:05
#

Back to the book.
2025-12-11 13:30: Done with the book. Nap time!

2025-12-11 17:15
#

Did my Duolingo and had a long walk after quite a few weeks
2025-12-11 17:16: Reading Traefik docs
2025-12-11 17:54: Client call

2025-12-11 18:35
#

Back.
2025-12-11 19:12: Shutting down for the day!

Feedback on this post?
Mail me at feedback at this domain.

2025-12-10 Notes

feedback@janusworx.com (Mario Jason Braganza) — Wed, 10 Dec 2025 08:26:26 +0530

Goals + Recap
#

Got Ansible Pull working, so now I can update a playbook and the VM fetches it and does what I tell to! Who’s a good VM?
Struggled with getting LEGO to generate a first time cert. And then like a ignorant fool, I made too many requests of Letsencrypt and got locked out. Shoulda done dry runs! I forgot! Will simply copy over my certs from ye olde plaice and then figure out a way to do the renew script. Even for later, methinks I will leave initial certificate generation to be a manual thing. For the big AWS project, I will figure something else out.
Will focus on getting Lego and certs working and getting an app or two at most deployed on the new production cluster.
Note to Self: Quit at 3p. Get back to life.

The Big Plan
#

The plan is to redo the cluster again and do my own instance of
- K3s
- Sealed Secrets
- ~~Certmanager~~ (Not using it)
- ~~Letsencrypt~~ (using pre existing Letsencrypt certs)
- Get Traefik Ingress to work
- Figure out a way to get certs automatically into the cluster
And once that is done, figure out an app to move (Miniflux or Hedgedoc?); 2025-12-03: Kanboard it is!
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed (Wildcard cert works now, just like it does without the cluster)
- Convert a docker-compose to kubernetes manifests
- Learn how to configure an app with code
- Learn how to store data and back it up
- Figure out secrets, if there are any (for now sealed secrets ok, figure out vault and vault injection later)
- Learn how to tunnel through and reverse proxy
- Make Kubernetes manifests work with flux
- Figure out how to automate deployment of manual manifests
- Figure out how to migrate there if there is any in an old app
- Figue out how to automate updation of images in manual manifests
- Get another app (Miniflux) deployed
- Figure out what needs to happen as part of the lifecycle. What you want in the cluster, what stays out, do they intersect, how do updates of cluster happen? VM (node) updates as well?
- Then begin to think along the lines of Live Deploys. Prototype locally and once it works, migrate to production immediately
- Convert Kubernetes manifests to Helm Charts (optional, based on energy)
Go live! Git is source of truth. Two repos.
- One for the Main node and its update
  - Terraform will provision node and install package, setup firewall
  - Figure out how to get Terraform to get the node talking to the git forge
  - Structure repo, copy every thing node related there, and make sure stuff gets updated periodically and idempotantly, via ansible pull and a systemd timer
- The other one for k3s and flux
  - Convert everything I have done locally to run on prod. Add more steps as you do them below

2025-12-10 09:50
#

Paused a systemd service via Ansible-Pull. Feels very cool!
2025-12-10 10:21: I keep getting distracted with the bigger picture and what ifs rather than focussing on what is right in front of me.
2025-12-10 13:00: Lots of ansible work. Good progress. Lunch break. I used to think that Ansible roles were too granular and now I seem to be doing the same with my tasks 😂

2025-12-10 14:15
#

Will just copy the certs for now
2025-12-10 17:23: Got the plays structured nad worknig just the way i want
Got syncthing installed, service installed, and working through the firewall.
2025-12-10 18:14: Copied files and got sealed secrets up and runnig within seconds!
2025-12-10 18:35: Got Kubeseal installed via ansible, without a single hitch!
2025-12-10 19:24: Manually put in the secret to the cluster. Will look at automation after a few days when Letsencrypt decides to talk to me.
2025-12-10 19:25: And just like that Traefik is up!
2025-12-10 20:06: Couldn’t get Miniflux working. Will work on it tomorrow. Calling it a night.
2025-12-10 20:30: Couldn’t quite leave it alone. I think I forgot to encrypt the cert with the new cluster’s sealed certificate. Will give that a try. If it works good. If not, we try again tomorrow! :)
2025-12-10 21:00: It was the damned cert! Ok, now I know I was not going batty :)
Figure out http to https tomorrow. Haproxy was doing it here. Need to figure out how to do it with Traefix directly. Time for bed.

Feedback on this post?
Mail me at feedback at this domain.

2025-12-09 Notes

feedback@janusworx.com (Mario Jason Braganza) — Tue, 09 Dec 2025 09:05:32 +0530

Goals + Recap
#

Got Terraform working and the node is now up, exactly the way I want it!
The cluster also got installed perfectly and I was able to connect to it.
Today will work on Ansible, so that local updates are easy.

The Big Plan
#

The plan is to redo the cluster again and do my own instance of
- K3s
- Sealed Secrets
- ~~Certmanager~~ (Not using it)
- ~~Letsencrypt~~ (using pre existing Letsencrypt certs)
- Get Traefik Ingress to work
- Figure out a way to get certs automatically into the cluster
And once that is done, figure out an app to move (Miniflux or Hedgedoc?); 2025-12-03: Kanboard it is!
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed (Wildcard cert works now, just like it does without the cluster)
- Convert a docker-compose to kubernetes manifests
- Learn how to configure an app with code
- Learn how to store data and back it up
- Figure out secrets, if there are any (for now sealed secrets ok, figure out vault and vault injection later)
- Learn how to tunnel through and reverse proxy
- Make Kubernetes manifests work with flux
- Figure out how to automate deployment of manual manifests
- Figure out how to migrate there if there is any in an old app
- Figue out how to automate updation of images in manual manifests
- Get another app (Miniflux) deployed
- Figure out what needs to happen as part of the lifecycle. What you want in the cluster, what stays out, do they intersect, how do updates of cluster happen? VM (node) updates as well?
- Then begin to think along the lines of Live Deploys. Prototype locally and once it works, migrate to production immediately
- Convert Kubernetes manifests to Helm Charts (optional, based on energy)
Go live! Git is source of truth. Two repos.
- One for the Main node and its update
  - Terraform will provision node and install package, setup firewall
  - Figure out how to get Terraform to get the node talking to the git forge
  - Structure repo, copy every thing node related there, and make sure stuff gets updated periodically and idempotantly, via ansible pull and a systemd timer
- The other one for k3s and flux
  - Convert everything I have done locally to run on prod. Add more steps as you do them below

2025-12-09 09:00
#

2025-12-09 10:13: The net is down, so am trying to work via codeberg. Makes me thankful, that I worked out of a private repo and didn’t commit private stuff to it
2025-12-09 10:13: Tea break

2025-12-09 10:52
#

Back
2025-12-09 11:21: Now learing the push/pull dance with ansible-pull. Making changes here. Pushing to the forge and then pulling in on the VM is a novel experience. As compared to editing conf files on the VM itself
2025-12-09 13:12: Lunch. making steady progress though

2025-12-09 13:39
#

Back. Got ansible pull working as well.
Now, to take all the changes I’ve done, commit them to git and rebuild the cluster, hopefully, one last time
2025-12-09 15:00: It worked! It all worked! Tea break.

2025-12-09 17:20
#

Bootstrapped flux on the VM cluster

2025-12-09 21:01
#

Bootstrapping a Letencrypt cert with lego is causing no end of problems.
Tomrrow will just import. and then use the current certs
And adapt the ansible playbook to just do an install

Feedback on this post?
Mail me at feedback at this domain.

2025-12-08 Notes

feedback@janusworx.com (Mario Jason Braganza) — Mon, 08 Dec 2025 09:25:33 +0530

Goals + Recap
#

Thank you PS, for being my sounding board.
Created repos and moved around directories and fixed scripts so that most of my infrastructure stuff is properly organised. Created the repos I needed for the new VM and the single node cluster that will run on it.

The Big Plan
#

The plan is to redo the cluster again and do my own instance of
- K3s
- Sealed Secrets
- ~~Certmanager~~ (Not using it)
- ~~Letsencrypt~~ (using pre existing Letsencrypt certs)
- Get Traefik Ingress to work
- Figure out a way to get certs automatically into the cluster
And once that is done, figure out an app to move (Miniflux or Hedgedoc?); 2025-12-03: Kanboard it is!
Begin by moving (lifting and shifting in popular parlance) Kanboard to the cluster
- Cert will probably be needed (Wildcard cert works now, just like it does without the cluster)
- Convert a docker-compose to kubernetes manifests
- Learn how to configure an app with code
- Learn how to store data and back it up
- Figure out secrets, if there are any (for now sealed secrets ok, figure out vault and vault injection later)
- Learn how to tunnel through and reverse proxy
- Make Kubernetes manifests work with flux
- Figure out how to automate deployment of manual manifests
- Figure out how to migrate there if there is any in an old app
- Figue out how to automate updation of images in manual manifests
- Get another app (Miniflux) deployed
- Figure out what needs to happen as part of the lifecycle. What you want in the cluster, what stays out, do they intersect, how do updates of cluster happen? VM (node) updates as well?
- Then begin to think along the lines of Live Deploys. Prototype locally and once it works, migrate to production immediately
- Convert Kubernetes manifests to Helm Charts (optional, based on energy)
Go live! Git is source of truth. Two repos.
- One for the Main node and its update
  - Terraform will provision node and install package, setup firewall
  - Figure out how to get Terraform to get the node talking to the git forge
  - Structure repo, copy every thing node related there, and make sure stuff gets updated periodically and idempotantly, via ansible pull and a systemd timer
- The other one for k3s and flux
  - Convert everything I have done locally to run on prod. Add more steps as you do them below

2025-12-08 09:00
#

Client call

2025-12-08 10:30
#

Beginning work
Installed the 1Password CLI tool and figured out how to read stuff into an environment variable. Will see how to integrate this with scripts over time. I am getting tired of copy pasting stuff. Plus a few critical secrets are on text files on the disk. The disk is encrypted, so I’m not that worried; but still.
2025-12-08 11:10: Found https://yaml-multiline.info/. Pretty handy!
2025-12-08 12:16: Lunch Break. Got into a flow state after a long time

2025-12-08 13:30
#

Back
Currently working on setting up and getting ansible-pull installed and working.
Ansible lint wasn’t working. Got it to work. Ansible and Ansible Lint
2025-12-08 16:15: Tea Break

2025-12-08 17:15
#

Back.
Thought I had it all setup, and the VM gets deployed, but I cannot seem to login
Simplifying my cloud-init and doing things one by one
TIL, even if I botch my cloud-init config, keys are inserted into the root login, so I can do a root login and diagnose. This helps!
Stuff was getting stuck, because point 1. an operation had to be deferred to the end. Checking the second thing now
Figured it out. It was some multiline data, that is sticking in cloud-init’s craw. Now to base64 encode it and pass it.
Done! At least the Terraform bit :) The cluster’s up.
Most of the plumbing for Ansible updates is done as well. I can talk to my Git forge from the VM. Next step is to get VM updates working tomorrow.

Feedback on this post?
Mail me at feedback at this domain.

Cloudinit-Nm on Janusworx

2025-12-12 Notes

Goals + Recap #

2025-12-12 09:15 #

2025-12-12 10:30 #

2025-12-12 13:30 #

2025-12-12 14:45 #

2025-12-12 16:20 #

2025-12-12 17:30 #

Tomorrow #

2025-12-11 Notes

Goals + Recap #

The Big Plan (Done! 🎉🎉🎉) #

2025-12-11 09:30 #

2025-12-11 10:15 #

2025-12-11 13:05 #

2025-12-11 17:15 #

2025-12-11 18:35 #

2025-12-10 Notes

Goals + Recap #

The Big Plan #

2025-12-10 09:50 #

2025-12-10 14:15 #

2025-12-09 Notes

Goals + Recap #

The Big Plan #

2025-12-09 09:00 #

2025-12-09 10:52 #

2025-12-09 13:39 #

2025-12-09 17:20 #

2025-12-09 21:01 #

2025-12-08 Notes

Goals + Recap #

The Big Plan #

2025-12-08 09:00 #

2025-12-08 10:30 #

2025-12-08 13:30 #

2025-12-08 17:15 #

Goals + Recap
#

2025-12-12 09:15
#

2025-12-12 10:30
#

2025-12-12 13:30
#

2025-12-12 14:45
#

2025-12-12 16:20
#

2025-12-12 17:30
#

Tomorrow
#

Goals + Recap
#

The Big Plan (Done! 🎉🎉🎉)
#

2025-12-11 09:30
#

2025-12-11 10:15
#

2025-12-11 13:05
#

2025-12-11 17:15
#

2025-12-11 18:35
#

Goals + Recap
#

The Big Plan
#

2025-12-10 09:50
#

2025-12-10 14:15
#

Goals + Recap
#

The Big Plan
#

2025-12-09 09:00
#

2025-12-09 10:52
#

2025-12-09 13:39
#

2025-12-09 17:20
#

2025-12-09 21:01
#

Goals + Recap
#

The Big Plan
#

2025-12-08 09:00
#

2025-12-08 10:30
#

2025-12-08 13:30
#

2025-12-08 17:15
#