Cloudia - as foreman - accounts for providing, configuring and managing IT ressources.
Why?
How?
What?
All supported components are marked by their implementation state:
- 🚀 production-ready - I use it in my own home environment.
- 🔍 dev-mode - I am currently integrating this feature/component.
- 💡 idea - Not available, but I want to integrate it. Raise a feature request, if you also want it.
It's done with 'cloud-init' and 'operating system auto-install' by booting an USB stick.
Note
Unfortunately, this feature isn't well maintained by myself. If you need help, raise an issue.
| Component | Description | State | Recommendation |
|---|---|---|---|
| Topton Mini PC with Ubuntu x64 server | My home environment consists of three Topton Mini PC with Ubuntu x64 server (Intel N100, 32 GB RAM, 128 GB SSD) | 🔍 dev-mode | |
| Raspberry Pi with Ubuntu x64 server | 💡 idea | ||
| Raspberry Pi with Raspberry Pi OS | 💡 idea |
It's done with 'ansible'.
| Component | Description | State |
|---|---|---|
| Ubuntu | Ubuntu Operating System operations (with tools cURL, and VIM) | 🚀 production-ready |
| ArchLinux | ArchLinux Operating System operations | 💡 idea |
| Raspberry Pi OS | Raspberry Pi OS operations | 💡 idea |
| Component | Description | State |
|---|---|---|
| Canonical Microcloud | LXD-based Virtualization Runtime | 💡 idea |
| Component | Description | State |
|---|---|---|
| Suse K3s | (inspired by https://github.com/k3s-io/k3s-ansible) with storage (local-path-provisioner, Longhorn), network (Flannel), ingress (Traefik, NGINX-deprecated), and load-balancing (Kube-VIP for Kube-API AND K8s Apps) | 🚀 production-ready |
| Canonical Microcloud | LXC-based Container Runtime | 💡 idea |
| Component | Description | State | Recommendation |
|---|---|---|---|
| cert-manager | Certificate Manager for Kubernetes Ingress/Services | 🚀 production-ready | ⭐ |
| Gatus | Monitoring Solution | 🚀 production-ready | ⭐ |
| Home Assistant | Smart Home (with HACS support) | 🚀 production-ready | ⭐ |
| Mosquitto | MQTT Broker | 🚀 production-ready | ⭐ |
| Zigbee2MQTT | Zigbee to MQTT Bridge | 🚀 production-ready | ⭐ |
| TaskView | It combines task management, custom workflows, developer integrations, analytics, and AI-assisted automation in a platform you can run on your own infrastructure. (https://github.com/Gimanh/taskview-community) | 💡 idea | |
| SilverBullet | Personal Knowledge Management (see https://silverbullet.md/) | 💡 idea | |
| CloudNativePG (CNPG) | PostgreSQL Database (Operator with 1 Shared Cluster) for any K8s app (https://medium.com/@surbhi19/we-put-our-production-database-on-kubernetes-heres-what-dbre-taught-us-c0875f3acfc3) | 🔍 dev-mode | ⭐ |
| Kubernetes Reflector | Reflector for Kubernetes ConfigMaps and Secrets (original use case didn't work as expected - therefore postponed) | 🔍 dev-mode | |
| Karakeep | 💡 idea | ||
| Immich | Photo Management like Google Photos | 💡 idea | |
| SearXNG | Search machine proxy | 💡 idea | |
| Seafile | File-Sharing like Dropbox or OneDrive | 💡 idea | |
| Jellyfin | Media and Streaming Service, like Netflix or Spotify | 💡 idea | |
| ConvertX | A self-hosted online file converter. Supports over a thousand different formats. | 💡 idea | |
| Kimai | timetracker (working hours, holidays, ...) | 💡 idea | |
| PocketID | The most user-friendly OpenID Connect Certified™ and OAuth 2.0 provider that lets users sign in to your applications with passkeys. | 💡 idea | ⭐ |
| Dex | Light-weight Identity Broker (because everyone already has a preferred Identity Provider - like Microsoft Entra ID, Google Identity, or your local Synology User Directory) | 💡 idea | |
| Authentik | Light-weight Identity and Access Management | 💡 idea | |
| Authelia | Light-weight Identity and Access Management (https://www.reddit.com/r/selfhosted/comments/1vs2t4u/best_2fa_selfhosted_recommendations/) | 💡 idea | ⭐ |
| rauthy | Light-weight Identity and Access Management | 💡 idea | |
| Vaultwarden | Bitwarden compatible Password Manager (other solution: Keepass with database hosting on Seafile or local NAS) | 💡 idea | |
| NetBird | Secure Access to Kubernetes Resource Access (Nodes, Pods, Services, see https://netbird.io/knowledge-hub/using-netbird-for-kubernetes-access) | 💡 idea | |
| Headlamp | Kubernetes Dashboard (idea from https://raveeshagarwal.medium.com/building-the-observability-stack-for-my-4-node-homelab-kubernetes-cluster-with-headlamp-and-beszel-b48fa73674ea) | 💡 idea | |
| Hermes-Agent | Self-improving AI agent (https://github.com/nousresearch/hermes-agent) | 💡 idea | |
| WasmEdge | Server-side WebAssembly Runtime on K3s (https://wasmedge.org/docs/develop/deploy/kubernetes/k3s) | 💡 idea |
needs to be proofed
| Component | Description | State | Recommendation |
|---|---|---|---|
| NetBird Hub / Agent | Secure Access Platform (https://netbird.io/) | 💡 idea | |
| FlexiWAN | Open Source SD-WAN & SASE (! critical license !) | 💡 idea | |
| Beszel | Lightweight server monitoring platform built on PocketBase (idea from https://raveeshagarwal.medium.com/building-the-observability-stack-for-my-4-node-homelab-kubernetes-cluster-with-headlamp-and-beszel-b48fa73674ea) | 💡 idea |
| Component | Description | State | Recommendation |
|---|---|---|---|
| k9s | Kubernetes CLI To Manage Your Clusters In Style (https://k9scli.io/) | 🚀 production-ready | |
| kubectl | K8s/K3s Console Tool | 🚀 production-ready | ⭐ |
| mqttx | MQTT Client | 🚀 production-ready | |
| etcdctl | ETCD Console Tool | 🔍 dev-mode | |
| trufflehog | most powerful secrets Discovery, Classification, Validation, and Analysis tool | 🔍 dev-mode | |
| k8sgpt | AI-powered tool that helps diagnose and fix Kubernetes issues with intelligent insights and automated troubleshooting | 🔍 dev-mode | |
| Kubescape | Security Scanning for Your Cluster | 💡 idea | ⭐ |
| Popeye | Popeye scans a live cluster and grades it from A to F, surfacing misconfigurations that quietly accumulate over time. | 💡 idea |
- Inventory
- Multiple environments with Ansible inventories
- Orchestration Service: Shell script cloudia-4man.sh
- controls Provisioning Service ( 🔍 dev-mode ) and Configuration & Deployment Management ( 🚀 production-ready)
- Provisioning Service: cloud-init ( 🔍 dev-mode )
- stages Infrastructure like Bare Metal Server (e.g. Raspberry Pi, Topton Mini-PC) based on initial state definition
- Configuration & Deployment Management: Ansible ( 🚀 production-ready)
- installs and updes Middleware, Software, and so on based on recommendation
- configures Middleware, Software, and so on based on Best-Practice guidelines
Important
Requirements: You need a computer with any kind of Linux operating system. If you have a computer with Windows operating system installed, use Windows Subsystem for Linux (WSL, more info: https://learn.microsoft.com/en-us/windows/wsl/about).
- Change working directory to your preferred location (eg. home directory:
cd ~) - Clone this repository to your computer (
git clone git@github.com:0x01af/cloudia-4man.git) - Change file mode of main script cloudia-4man.sh to executable (
chmod 755 cloudia-4man.sh)
Note
All your own environment definitions won't be touched. Therefore, never change the file .gitignore.
- Because you change the state of the main script, you need to restore it first (
git restore cloudia-4man.sh). - Afterwards, use
git pullto download the newest release of cloudia-4man.
- Define a new environment based on the template in folder /inventory
- copy the folder /0-template and name it using your environment name.
- describe your environment within file environment.yaml
- configure your components by variables under group_vars and host_vars
- Run Orchestration Service shell script cloudia-4man.sh (
./cloudia-4man.sh)- Orchestration Service detects new infrastructure component, asks about any special parameters like one-time-passwords, or similar, run provisioning service, and start configuration & deployment management.
Cloudia as foreman allows you to control Ansible plays by execution modes:
| Execution Mode | Description | State |
|---|---|---|
| bootstrap (default) | install/update/configure, it's the production-ready default behavior | 🔍 dev-mode |
| housekeeping | save/backup/clean logs/remove temporary | 💡 idea |
| shutdown | save/backup/stop | 💡 idea |
| uninstall | save/backup/stop/uninstall/remove files | 💡 idea |
If a role doesn't apply an execution mode, than Cloudia as foreman informs you.
- *rr-Stack: It seems, that all components of *rr-Stack are calling home. I don't like that.
- https://blog.devgenius.io/provisioning-vs-configuration-management-with-terraform-4bf07b9c79db
- Why Terraform and Ansible? -> https://serverfault.com/questions/1022690/is-it-possible-to-run-ansible-on-a-bare-metal
- Using YAML instead INI -> https://docs.ansible.com/ansible/latest/user_guide/intro_inventory.html#inventory-aliases
- Kubernetes Deployments: Stop using CPU limits, set Memory limit equals to requested: https://home.robusta.dev/blog/stop-using-cpu-limits / https://medium.com/@danielvalev/stop-setting-kubernetes-cpu-limits-yes-really-285dbdf8ff51
- Class idea: Guaranteed / critical workload (Highest Priority) -> set cpu and memory, memory limits = requests; Burstable / default (Medium Priority) -> set memory limits = 2 x requests, no cpu; best effort (low priority, kill if necessary) -> neither set cpu nor memory.
- Kubara: If you only need to initialize K8s cluster, and you are a DevOps engineer. -> https://github.com/kubara-io/kubara