From 2b034797107660d4d83f8a7acdc55d32db785b82 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Thu, 2 Oct 2025 11:28:55 +0300 Subject: Update content for md --- ...6-04-09-jails-and-zfs-on-freebsd-with-puppet.md | 1 + ...2022-07-30-lets-encrypt-with-openbsd-and-rex.md | 1 + .../2024-01-13-one-reason-why-i-love-openbsd.md | 1 + ...24-04-01-KISS-high-availability-with-OpenBSD.md | 1 + ...024-11-17-f3s-kubernetes-with-freebsd-part-1.md | 2 + ...024-12-03-f3s-kubernetes-with-freebsd-part-2.md | 5 +- ...025-02-01-f3s-kubernetes-with-freebsd-part-3.md | 2 + ...025-04-05-f3s-kubernetes-with-freebsd-part-4.md | 2 + ...025-05-11-f3s-kubernetes-with-freebsd-part-5.md | 2 + ...025-07-14-f3s-kubernetes-with-freebsd-part-6.md | 10 +- ...025-10-02-f3s-kubernetes-with-freebsd-part-7.md | 960 ++++++++++ gemfeed/DRAFT-kubernetes-with-freebsd-part-7.md | 580 ------ gemfeed/examples/conf/Rexfile | 3 + gemfeed/examples/conf/babylon5/backup-start | 64 + .../conf/babylon5/docker-start-anki-sync-server | 4 + .../conf/babylon5/docker-start-audiobookshelf | 12 + .../conf/babylon5/docker-start-nextcloud-aio | 15 + .../conf/babylon5/docker-start-vaultwarden | 10 + .../examples/conf/babylon5/docker-start-wallabag | 4 + gemfeed/examples/conf/dotfiles/Rexfile | 225 +++ gemfeed/examples/conf/dotfiles/bash/bash_profile | 3 + gemfeed/examples/conf/dotfiles/bash/bashrc | 15 + gemfeed/examples/conf/dotfiles/fish/conf.d/ai.fish | 39 + .../conf/dotfiles/fish/conf.d/alternatives.fish | 17 + .../examples/conf/dotfiles/fish/conf.d/config.fish | 31 + .../conf/dotfiles/fish/conf.d/dotfiles.fish | 48 + .../examples/conf/dotfiles/fish/conf.d/editor.fish | 44 + .../examples/conf/dotfiles/fish/conf.d/fuzzy.fish | 5 + .../examples/conf/dotfiles/fish/conf.d/games.fish | 15 + .../examples/conf/dotfiles/fish/conf.d/gos.fish | 6 + .../examples/conf/dotfiles/fish/conf.d/k8s.fish | 76 + .../conf/dotfiles/fish/conf.d/quickedit.fish | 93 + .../conf/dotfiles/fish/conf.d/supersync.fish | 114 ++ .../conf/dotfiles/fish/conf.d/taskwarrior.fish | 121 ++ .../examples/conf/dotfiles/fish/conf.d/timr.fish | 25 + .../conf/dotfiles/fish/conf.d/tmputils.fish | 54 + .../examples/conf/dotfiles/fish/conf.d/tmux.fish | 94 + .../examples/conf/dotfiles/fish/conf.d/update.fish | 75 + .../examples/conf/dotfiles/fish/conf.d/utils.fish | 142 ++ .../conf/dotfiles/fish/conf.d/worktime.fish | 122 ++ .../examples/conf/dotfiles/fish/conf.d/zoxide.fish | 6 + .../examples/conf/dotfiles/fish/conf.d/zsh.fish | 12 + gemfeed/examples/conf/dotfiles/ghostty/config | 17 + .../examples/conf/dotfiles/gitsyncer/config.json | 33 + gemfeed/examples/conf/dotfiles/helix/config.toml | 87 + .../examples/conf/dotfiles/helix/languages.toml | 203 +++ gemfeed/examples/conf/dotfiles/nvim/init.lua | 70 + .../examples/conf/dotfiles/pipewire/pipewire.conf | 257 +++ gemfeed/examples/conf/dotfiles/scripts/ai | 7 + .../conf/dotfiles/scripts/brokenlinkfinder | 73 + gemfeed/examples/conf/dotfiles/scripts/gvim | 7 + .../conf/dotfiles/scripts/hx.aichat-prompt | 9 + .../conf/dotfiles/scripts/hx.chatgpt-prompt | 3 + .../examples/conf/dotfiles/scripts/hx.goformatter | 3 + .../examples/conf/dotfiles/scripts/hx.hexai-prompt | 9 + .../conf/dotfiles/scripts/hx.nvim-copilot-prompt | 32 + gemfeed/examples/conf/dotfiles/scripts/hx.prompt | 14 + .../examples/conf/dotfiles/scripts/randomnote.rb | 30 + .../conf/dotfiles/scripts/taskwarriorfeeder.rb | 221 +++ gemfeed/examples/conf/dotfiles/signature | 2 + gemfeed/examples/conf/dotfiles/ssh/config | 21 + .../conf/dotfiles/sway/config.d/keyboard.conf | 6 + gemfeed/examples/conf/dotfiles/tmux/tmux.conf | 32 + .../examples/conf/dotfiles/tmux/tmux.local.conf | 2 + gemfeed/examples/conf/dotfiles/vale.ini | 6 + gemfeed/examples/conf/dotfiles/waybar/config.jsonc | 194 ++ gemfeed/examples/conf/dotfiles/waybar/style.css | 326 ++++ .../examples/conf/f3s/anki-sync-server/Justfile | 12 + .../f3s/anki-sync-server/docker-image/Dockerfile | 39 + .../f3s/anki-sync-server/docker-image/Justfile | 6 + .../anki-sync-server/docker-image/entrypoint.sh | 31 + .../f3s/anki-sync-server/helm-chart/Chart.yaml | 5 + .../helm-chart/templates/deployment.yaml | 35 + .../helm-chart/templates/ingress.yaml | 20 + .../helm-chart/templates/persistent-volume.yaml | 27 + .../helm-chart/templates/service.yaml | 15 + gemfeed/examples/conf/f3s/audiobookshelf/Justfile | 12 + .../conf/f3s/audiobookshelf/helm-chart/Chart.yaml | 5 + .../helm-chart/templates/deployment.yaml | 53 + .../helm-chart/templates/ingress.yaml | 20 + .../helm-chart/templates/persistent-volumes.yaml | 83 + .../conf/f3s/example-apache-volume-claim/Justfile | 12 + .../helm-chart/Chart.yaml | 5 + .../helm-chart/templates/apache-deployment.yaml | 41 + .../helm-chart/templates/apache-ingress.yaml | 41 + .../templates/apache-persistent-volume.yaml | 27 + .../helm-chart/templates/apache-service.yaml | 17 + gemfeed/examples/conf/f3s/example-apache/Justfile | 12 + .../conf/f3s/example-apache/helm-chart/Chart.yaml | 5 + .../helm-chart/templates/apache-deployment.yaml | 21 + .../helm-chart/templates/apache-ingress.yaml | 40 + .../helm-chart/templates/apache-service.yaml | 16 + gemfeed/examples/conf/f3s/freshrss/Justfile | 12 + .../conf/f3s/freshrss/helm-chart/Chart.yaml | 6 + .../freshrss/helm-chart/templates/deployment.yaml | 48 + .../f3s/freshrss/helm-chart/templates/ingress.yaml | 21 + .../helm-chart/templates/persistent-volumes.yaml | 28 + gemfeed/examples/conf/f3s/miniflux/Justfile | 12 + .../conf/f3s/miniflux/helm-chart/Chart.yaml | 5 + .../miniflux/helm-chart/templates/deployment.yaml | 92 + .../f3s/miniflux/helm-chart/templates/ingress.yaml | 20 + .../helm-chart/templates/persistent-volumes.yaml | 27 + .../f3s/miniflux/helm-chart/templates/service.yaml | 23 + gemfeed/examples/conf/f3s/opodsync/Justfile | 12 + .../conf/f3s/opodsync/helm-chart/Chart.yaml | 5 + .../helm-chart/templates/configmap-nginx.yaml | 46 + .../opodsync/helm-chart/templates/deployment.yaml | 43 + .../f3s/opodsync/helm-chart/templates/ingress.yaml | 20 + .../helm-chart/templates/persistent-volumes.yaml | 27 + .../f3s/opodsync/helm-chart/templates/service.yaml | 15 + gemfeed/examples/conf/f3s/radicale/Justfile | 12 + .../conf/f3s/radicale/helm-chart/Chart.yaml | 5 + .../radicale/helm-chart/templates/deployment.yaml | 67 + .../f3s/radicale/helm-chart/templates/ingress.yaml | 20 + .../helm-chart/templates/persistent-volumes.yaml | 55 + gemfeed/examples/conf/f3s/registry/Justfile | 12 + .../conf/f3s/registry/helm-chart/Chart.yaml | 5 + .../registry/helm-chart/templates/deployment.yaml | 29 + .../conf/f3s/registry/helm-chart/templates/pv.yaml | 14 + .../f3s/registry/helm-chart/templates/pvc.yaml | 12 + .../f3s/registry/helm-chart/templates/service.yaml | 14 + gemfeed/examples/conf/f3s/syncthing/Justfile | 12 + .../conf/f3s/syncthing/helm-chart/Chart.yaml | 5 + .../syncthing/helm-chart/templates/deployment.yaml | 33 + .../syncthing/helm-chart/templates/ingress.yaml | 20 + .../helm-chart/templates/persistent-volume.yaml | 55 + .../syncthing/helm-chart/templates/service.yaml | 19 + gemfeed/examples/conf/f3s/wallabag/Justfile | 12 + .../conf/f3s/wallabag/helm-chart/Chart.yaml | 5 + .../wallabag/helm-chart/templates/deployment.yaml | 51 + .../f3s/wallabag/helm-chart/templates/ingress.yaml | 20 + .../helm-chart/templates/persistent-volumes.yaml | 55 + gemfeed/examples/conf/frontends/Rexfile | 648 +++++++ .../conf/frontends/etc/acme-client.conf.tpl | 41 + .../conf/frontends/etc/dserver/dtail.json.tpl | 127 ++ .../examples/conf/frontends/etc/gogios.cron.tpl | 3 + .../examples/conf/frontends/etc/gogios.json.tpl | 98 + gemfeed/examples/conf/frontends/etc/gorum.json.tpl | 18 + gemfeed/examples/conf/frontends/etc/httpd.conf.tpl | 184 ++ gemfeed/examples/conf/frontends/etc/inetd.conf | 2 + .../examples/conf/frontends/etc/login.conf.d/inetd | 3 + gemfeed/examples/conf/frontends/etc/mail/aliases | 103 ++ .../conf/frontends/etc/mail/smtpd.conf.tpl | 23 + .../conf/frontends/etc/mail/virtualdomains | 20 + .../examples/conf/frontends/etc/mail/virtualusers | 5 + gemfeed/examples/conf/frontends/etc/myname.tpl | 1 + gemfeed/examples/conf/frontends/etc/newsyslog.conf | 14 + gemfeed/examples/conf/frontends/etc/rc.conf.local | 5 + .../examples/conf/frontends/etc/rc.d/dserver.tpl | 16 + gemfeed/examples/conf/frontends/etc/rc.d/gorum.tpl | 16 + .../examples/conf/frontends/etc/relayd.conf.tpl | 86 + .../examples/conf/frontends/etc/rsyncd.conf.tpl | 28 + gemfeed/examples/conf/frontends/etc/taskrc.tpl | 40 + gemfeed/examples/conf/frontends/etc/tmux.conf | 24 + .../examples/conf/frontends/scripts/acme.sh.tpl | 68 + .../conf/frontends/scripts/dns-failover.ksh | 133 ++ .../scripts/dserver-update-key-cache.sh.tpl | 34 + .../examples/conf/frontends/scripts/fooodds.txt | 191 ++ .../examples/conf/frontends/scripts/foostats.pl | 1910 ++++++++++++++++++++ .../conf/frontends/scripts/gemtexter.sh.tpl | 65 + .../examples/conf/frontends/scripts/rsync.sh.tpl | 8 + .../conf/frontends/scripts/taskwarrior.sh.tpl | 5 + .../conf/frontends/var/nsd/etc/key.conf.tpl | 4 + .../conf/frontends/var/nsd/etc/nsd.conf.master.tpl | 17 + .../conf/frontends/var/nsd/etc/nsd.conf.slave.tpl | 17 + .../var/nsd/zones/master/buetow.org.zone.tpl | 124 ++ .../var/nsd/zones/master/dtail.dev.zone.tpl | 21 + .../var/nsd/zones/master/foo.zone.zone.tpl | 34 + .../var/nsd/zones/master/irregular.ninja.zone.tpl | 23 + .../var/nsd/zones/master/paul.cyou.zone.tpl | 20 + .../var/nsd/zones/master/snonux.foo.zone.tpl | 20 + .../var/www/htdocs/buetow.org/self/index.txt.tpl | 1 + gemfeed/examples/conf/playground/Rexfile | 24 + .../conf/playground/openbsd_cron_test.debug.txt | 766 ++++++++ .../examples/conf/playground/openbsd_cron_test.txt | 42 + gemfeed/index.md | 3 +- gemfeed/stunnel-nfs-quick-reference.txt | 78 - 177 files changed, 10769 insertions(+), 663 deletions(-) create mode 100644 gemfeed/2025-10-02-f3s-kubernetes-with-freebsd-part-7.md delete mode 100644 gemfeed/DRAFT-kubernetes-with-freebsd-part-7.md create mode 100644 gemfeed/examples/conf/Rexfile create mode 100755 gemfeed/examples/conf/babylon5/backup-start create mode 100755 gemfeed/examples/conf/babylon5/docker-start-anki-sync-server create mode 100755 gemfeed/examples/conf/babylon5/docker-start-audiobookshelf create mode 100755 gemfeed/examples/conf/babylon5/docker-start-nextcloud-aio create mode 100755 gemfeed/examples/conf/babylon5/docker-start-vaultwarden create mode 100755 gemfeed/examples/conf/babylon5/docker-start-wallabag create mode 100644 gemfeed/examples/conf/dotfiles/Rexfile create mode 100644 gemfeed/examples/conf/dotfiles/bash/bash_profile create mode 100644 gemfeed/examples/conf/dotfiles/bash/bashrc create mode 100644 gemfeed/examples/conf/dotfiles/fish/conf.d/ai.fish create mode 100644 gemfeed/examples/conf/dotfiles/fish/conf.d/alternatives.fish create mode 100644 gemfeed/examples/conf/dotfiles/fish/conf.d/config.fish create mode 100644 gemfeed/examples/conf/dotfiles/fish/conf.d/dotfiles.fish create mode 100644 gemfeed/examples/conf/dotfiles/fish/conf.d/editor.fish create mode 100644 gemfeed/examples/conf/dotfiles/fish/conf.d/fuzzy.fish create mode 100644 gemfeed/examples/conf/dotfiles/fish/conf.d/games.fish create mode 100644 gemfeed/examples/conf/dotfiles/fish/conf.d/gos.fish create mode 100644 gemfeed/examples/conf/dotfiles/fish/conf.d/k8s.fish create mode 100644 gemfeed/examples/conf/dotfiles/fish/conf.d/quickedit.fish create mode 100644 gemfeed/examples/conf/dotfiles/fish/conf.d/supersync.fish create mode 100644 gemfeed/examples/conf/dotfiles/fish/conf.d/taskwarrior.fish create mode 100644 gemfeed/examples/conf/dotfiles/fish/conf.d/timr.fish create mode 100644 gemfeed/examples/conf/dotfiles/fish/conf.d/tmputils.fish create mode 100644 gemfeed/examples/conf/dotfiles/fish/conf.d/tmux.fish create mode 100644 gemfeed/examples/conf/dotfiles/fish/conf.d/update.fish create mode 100644 gemfeed/examples/conf/dotfiles/fish/conf.d/utils.fish create mode 100644 gemfeed/examples/conf/dotfiles/fish/conf.d/worktime.fish create mode 100644 gemfeed/examples/conf/dotfiles/fish/conf.d/zoxide.fish create mode 100644 gemfeed/examples/conf/dotfiles/fish/conf.d/zsh.fish create mode 100644 gemfeed/examples/conf/dotfiles/ghostty/config create mode 100644 gemfeed/examples/conf/dotfiles/gitsyncer/config.json create mode 100644 gemfeed/examples/conf/dotfiles/helix/config.toml create mode 100644 gemfeed/examples/conf/dotfiles/helix/languages.toml create mode 100644 gemfeed/examples/conf/dotfiles/nvim/init.lua create mode 100644 gemfeed/examples/conf/dotfiles/pipewire/pipewire.conf create mode 100755 gemfeed/examples/conf/dotfiles/scripts/ai create mode 100644 gemfeed/examples/conf/dotfiles/scripts/brokenlinkfinder create mode 100755 gemfeed/examples/conf/dotfiles/scripts/gvim create mode 100755 gemfeed/examples/conf/dotfiles/scripts/hx.aichat-prompt create mode 100755 gemfeed/examples/conf/dotfiles/scripts/hx.chatgpt-prompt create mode 100755 gemfeed/examples/conf/dotfiles/scripts/hx.goformatter create mode 100755 gemfeed/examples/conf/dotfiles/scripts/hx.hexai-prompt create mode 100755 gemfeed/examples/conf/dotfiles/scripts/hx.nvim-copilot-prompt create mode 100755 gemfeed/examples/conf/dotfiles/scripts/hx.prompt create mode 100644 gemfeed/examples/conf/dotfiles/scripts/randomnote.rb create mode 100644 gemfeed/examples/conf/dotfiles/scripts/taskwarriorfeeder.rb create mode 100644 gemfeed/examples/conf/dotfiles/signature create mode 100644 gemfeed/examples/conf/dotfiles/ssh/config create mode 100644 gemfeed/examples/conf/dotfiles/sway/config.d/keyboard.conf create mode 100644 gemfeed/examples/conf/dotfiles/tmux/tmux.conf create mode 100644 gemfeed/examples/conf/dotfiles/tmux/tmux.local.conf create mode 100644 gemfeed/examples/conf/dotfiles/vale.ini create mode 100644 gemfeed/examples/conf/dotfiles/waybar/config.jsonc create mode 100644 gemfeed/examples/conf/dotfiles/waybar/style.css create mode 100644 gemfeed/examples/conf/f3s/anki-sync-server/Justfile create mode 100644 gemfeed/examples/conf/f3s/anki-sync-server/docker-image/Dockerfile create mode 100644 gemfeed/examples/conf/f3s/anki-sync-server/docker-image/Justfile create mode 100644 gemfeed/examples/conf/f3s/anki-sync-server/docker-image/entrypoint.sh create mode 100644 gemfeed/examples/conf/f3s/anki-sync-server/helm-chart/Chart.yaml create mode 100644 gemfeed/examples/conf/f3s/anki-sync-server/helm-chart/templates/deployment.yaml create mode 100644 gemfeed/examples/conf/f3s/anki-sync-server/helm-chart/templates/ingress.yaml create mode 100644 gemfeed/examples/conf/f3s/anki-sync-server/helm-chart/templates/persistent-volume.yaml create mode 100644 gemfeed/examples/conf/f3s/anki-sync-server/helm-chart/templates/service.yaml create mode 100644 gemfeed/examples/conf/f3s/audiobookshelf/Justfile create mode 100644 gemfeed/examples/conf/f3s/audiobookshelf/helm-chart/Chart.yaml create mode 100644 gemfeed/examples/conf/f3s/audiobookshelf/helm-chart/templates/deployment.yaml create mode 100644 gemfeed/examples/conf/f3s/audiobookshelf/helm-chart/templates/ingress.yaml create mode 100644 gemfeed/examples/conf/f3s/audiobookshelf/helm-chart/templates/persistent-volumes.yaml create mode 100644 gemfeed/examples/conf/f3s/example-apache-volume-claim/Justfile create mode 100644 gemfeed/examples/conf/f3s/example-apache-volume-claim/helm-chart/Chart.yaml create mode 100644 gemfeed/examples/conf/f3s/example-apache-volume-claim/helm-chart/templates/apache-deployment.yaml create mode 100644 gemfeed/examples/conf/f3s/example-apache-volume-claim/helm-chart/templates/apache-ingress.yaml create mode 100644 gemfeed/examples/conf/f3s/example-apache-volume-claim/helm-chart/templates/apache-persistent-volume.yaml create mode 100644 gemfeed/examples/conf/f3s/example-apache-volume-claim/helm-chart/templates/apache-service.yaml create mode 100644 gemfeed/examples/conf/f3s/example-apache/Justfile create mode 100644 gemfeed/examples/conf/f3s/example-apache/helm-chart/Chart.yaml create mode 100644 gemfeed/examples/conf/f3s/example-apache/helm-chart/templates/apache-deployment.yaml create mode 100644 gemfeed/examples/conf/f3s/example-apache/helm-chart/templates/apache-ingress.yaml create mode 100644 gemfeed/examples/conf/f3s/example-apache/helm-chart/templates/apache-service.yaml create mode 100644 gemfeed/examples/conf/f3s/freshrss/Justfile create mode 100644 gemfeed/examples/conf/f3s/freshrss/helm-chart/Chart.yaml create mode 100644 gemfeed/examples/conf/f3s/freshrss/helm-chart/templates/deployment.yaml create mode 100644 gemfeed/examples/conf/f3s/freshrss/helm-chart/templates/ingress.yaml create mode 100644 gemfeed/examples/conf/f3s/freshrss/helm-chart/templates/persistent-volumes.yaml create mode 100644 gemfeed/examples/conf/f3s/miniflux/Justfile create mode 100644 gemfeed/examples/conf/f3s/miniflux/helm-chart/Chart.yaml create mode 100644 gemfeed/examples/conf/f3s/miniflux/helm-chart/templates/deployment.yaml create mode 100644 gemfeed/examples/conf/f3s/miniflux/helm-chart/templates/ingress.yaml create mode 100644 gemfeed/examples/conf/f3s/miniflux/helm-chart/templates/persistent-volumes.yaml create mode 100644 gemfeed/examples/conf/f3s/miniflux/helm-chart/templates/service.yaml create mode 100644 gemfeed/examples/conf/f3s/opodsync/Justfile create mode 100644 gemfeed/examples/conf/f3s/opodsync/helm-chart/Chart.yaml create mode 100644 gemfeed/examples/conf/f3s/opodsync/helm-chart/templates/configmap-nginx.yaml create mode 100644 gemfeed/examples/conf/f3s/opodsync/helm-chart/templates/deployment.yaml create mode 100644 gemfeed/examples/conf/f3s/opodsync/helm-chart/templates/ingress.yaml create mode 100644 gemfeed/examples/conf/f3s/opodsync/helm-chart/templates/persistent-volumes.yaml create mode 100644 gemfeed/examples/conf/f3s/opodsync/helm-chart/templates/service.yaml create mode 100644 gemfeed/examples/conf/f3s/radicale/Justfile create mode 100644 gemfeed/examples/conf/f3s/radicale/helm-chart/Chart.yaml create mode 100644 gemfeed/examples/conf/f3s/radicale/helm-chart/templates/deployment.yaml create mode 100644 gemfeed/examples/conf/f3s/radicale/helm-chart/templates/ingress.yaml create mode 100644 gemfeed/examples/conf/f3s/radicale/helm-chart/templates/persistent-volumes.yaml create mode 100644 gemfeed/examples/conf/f3s/registry/Justfile create mode 100644 gemfeed/examples/conf/f3s/registry/helm-chart/Chart.yaml create mode 100644 gemfeed/examples/conf/f3s/registry/helm-chart/templates/deployment.yaml create mode 100644 gemfeed/examples/conf/f3s/registry/helm-chart/templates/pv.yaml create mode 100644 gemfeed/examples/conf/f3s/registry/helm-chart/templates/pvc.yaml create mode 100644 gemfeed/examples/conf/f3s/registry/helm-chart/templates/service.yaml create mode 100644 gemfeed/examples/conf/f3s/syncthing/Justfile create mode 100644 gemfeed/examples/conf/f3s/syncthing/helm-chart/Chart.yaml create mode 100644 gemfeed/examples/conf/f3s/syncthing/helm-chart/templates/deployment.yaml create mode 100644 gemfeed/examples/conf/f3s/syncthing/helm-chart/templates/ingress.yaml create mode 100644 gemfeed/examples/conf/f3s/syncthing/helm-chart/templates/persistent-volume.yaml create mode 100644 gemfeed/examples/conf/f3s/syncthing/helm-chart/templates/service.yaml create mode 100644 gemfeed/examples/conf/f3s/wallabag/Justfile create mode 100644 gemfeed/examples/conf/f3s/wallabag/helm-chart/Chart.yaml create mode 100644 gemfeed/examples/conf/f3s/wallabag/helm-chart/templates/deployment.yaml create mode 100644 gemfeed/examples/conf/f3s/wallabag/helm-chart/templates/ingress.yaml create mode 100644 gemfeed/examples/conf/f3s/wallabag/helm-chart/templates/persistent-volumes.yaml create mode 100644 gemfeed/examples/conf/frontends/Rexfile create mode 100644 gemfeed/examples/conf/frontends/etc/acme-client.conf.tpl create mode 100644 gemfeed/examples/conf/frontends/etc/dserver/dtail.json.tpl create mode 100644 gemfeed/examples/conf/frontends/etc/gogios.cron.tpl create mode 100644 gemfeed/examples/conf/frontends/etc/gogios.json.tpl create mode 100644 gemfeed/examples/conf/frontends/etc/gorum.json.tpl create mode 100644 gemfeed/examples/conf/frontends/etc/httpd.conf.tpl create mode 100644 gemfeed/examples/conf/frontends/etc/inetd.conf create mode 100644 gemfeed/examples/conf/frontends/etc/login.conf.d/inetd create mode 100644 gemfeed/examples/conf/frontends/etc/mail/aliases create mode 100644 gemfeed/examples/conf/frontends/etc/mail/smtpd.conf.tpl create mode 100644 gemfeed/examples/conf/frontends/etc/mail/virtualdomains create mode 100644 gemfeed/examples/conf/frontends/etc/mail/virtualusers create mode 100644 gemfeed/examples/conf/frontends/etc/myname.tpl create mode 100644 gemfeed/examples/conf/frontends/etc/newsyslog.conf create mode 100644 gemfeed/examples/conf/frontends/etc/rc.conf.local create mode 100755 gemfeed/examples/conf/frontends/etc/rc.d/dserver.tpl create mode 100755 gemfeed/examples/conf/frontends/etc/rc.d/gorum.tpl create mode 100644 gemfeed/examples/conf/frontends/etc/relayd.conf.tpl create mode 100644 gemfeed/examples/conf/frontends/etc/rsyncd.conf.tpl create mode 100644 gemfeed/examples/conf/frontends/etc/taskrc.tpl create mode 100644 gemfeed/examples/conf/frontends/etc/tmux.conf create mode 100644 gemfeed/examples/conf/frontends/scripts/acme.sh.tpl create mode 100644 gemfeed/examples/conf/frontends/scripts/dns-failover.ksh create mode 100644 gemfeed/examples/conf/frontends/scripts/dserver-update-key-cache.sh.tpl create mode 100644 gemfeed/examples/conf/frontends/scripts/fooodds.txt create mode 100644 gemfeed/examples/conf/frontends/scripts/foostats.pl create mode 100644 gemfeed/examples/conf/frontends/scripts/gemtexter.sh.tpl create mode 100644 gemfeed/examples/conf/frontends/scripts/rsync.sh.tpl create mode 100644 gemfeed/examples/conf/frontends/scripts/taskwarrior.sh.tpl create mode 100644 gemfeed/examples/conf/frontends/var/nsd/etc/key.conf.tpl create mode 100644 gemfeed/examples/conf/frontends/var/nsd/etc/nsd.conf.master.tpl create mode 100644 gemfeed/examples/conf/frontends/var/nsd/etc/nsd.conf.slave.tpl create mode 100644 gemfeed/examples/conf/frontends/var/nsd/zones/master/buetow.org.zone.tpl create mode 100644 gemfeed/examples/conf/frontends/var/nsd/zones/master/dtail.dev.zone.tpl create mode 100644 gemfeed/examples/conf/frontends/var/nsd/zones/master/foo.zone.zone.tpl create mode 100644 gemfeed/examples/conf/frontends/var/nsd/zones/master/irregular.ninja.zone.tpl create mode 100644 gemfeed/examples/conf/frontends/var/nsd/zones/master/paul.cyou.zone.tpl create mode 100644 gemfeed/examples/conf/frontends/var/nsd/zones/master/snonux.foo.zone.tpl create mode 100644 gemfeed/examples/conf/frontends/var/www/htdocs/buetow.org/self/index.txt.tpl create mode 100644 gemfeed/examples/conf/playground/Rexfile create mode 100644 gemfeed/examples/conf/playground/openbsd_cron_test.debug.txt create mode 100644 gemfeed/examples/conf/playground/openbsd_cron_test.txt delete mode 100644 gemfeed/stunnel-nfs-quick-reference.txt (limited to 'gemfeed') diff --git a/gemfeed/2016-04-09-jails-and-zfs-on-freebsd-with-puppet.md b/gemfeed/2016-04-09-jails-and-zfs-on-freebsd-with-puppet.md index f2735c9a..a404257a 100644 --- a/gemfeed/2016-04-09-jails-and-zfs-on-freebsd-with-puppet.md +++ b/gemfeed/2016-04-09-jails-and-zfs-on-freebsd-with-puppet.md @@ -397,6 +397,7 @@ E-Mail your comments to `paul@nospam.buetow.org` :-) Other *BSD related posts are: +[2025-10-02 f3s: Kubernetes with FreeBSD - Part 7: k3s and first pod deployments](./2025-10-02-f3s-kubernetes-with-freebsd-part-7.md) [2025-07-14 f3s: Kubernetes with FreeBSD - Part 6: Storage](./2025-07-14-f3s-kubernetes-with-freebsd-part-6.md) [2025-05-11 f3s: Kubernetes with FreeBSD - Part 5: WireGuard mesh network](./2025-05-11-f3s-kubernetes-with-freebsd-part-5.md) [2025-04-05 f3s: Kubernetes with FreeBSD - Part 4: Rocky Linux Bhyve VMs](./2025-04-05-f3s-kubernetes-with-freebsd-part-4.md) diff --git a/gemfeed/2022-07-30-lets-encrypt-with-openbsd-and-rex.md b/gemfeed/2022-07-30-lets-encrypt-with-openbsd-and-rex.md index 89733b51..bc316eba 100644 --- a/gemfeed/2022-07-30-lets-encrypt-with-openbsd-and-rex.md +++ b/gemfeed/2022-07-30-lets-encrypt-with-openbsd-and-rex.md @@ -676,6 +676,7 @@ E-Mail your comments to `paul@nospam.buetow.org` :-) Other *BSD related posts are: +[2025-10-02 f3s: Kubernetes with FreeBSD - Part 7: k3s and first pod deployments](./2025-10-02-f3s-kubernetes-with-freebsd-part-7.md) [2025-07-14 f3s: Kubernetes with FreeBSD - Part 6: Storage](./2025-07-14-f3s-kubernetes-with-freebsd-part-6.md) [2025-05-11 f3s: Kubernetes with FreeBSD - Part 5: WireGuard mesh network](./2025-05-11-f3s-kubernetes-with-freebsd-part-5.md) [2025-04-05 f3s: Kubernetes with FreeBSD - Part 4: Rocky Linux Bhyve VMs](./2025-04-05-f3s-kubernetes-with-freebsd-part-4.md) diff --git a/gemfeed/2024-01-13-one-reason-why-i-love-openbsd.md b/gemfeed/2024-01-13-one-reason-why-i-love-openbsd.md index 9f6f400d..ae0ce0c7 100644 --- a/gemfeed/2024-01-13-one-reason-why-i-love-openbsd.md +++ b/gemfeed/2024-01-13-one-reason-why-i-love-openbsd.md @@ -53,6 +53,7 @@ E-Mail your comments to `paul@nospam.buetow.org` :-) Other *BSD related posts are: +[2025-10-02 f3s: Kubernetes with FreeBSD - Part 7: k3s and first pod deployments](./2025-10-02-f3s-kubernetes-with-freebsd-part-7.md) [2025-07-14 f3s: Kubernetes with FreeBSD - Part 6: Storage](./2025-07-14-f3s-kubernetes-with-freebsd-part-6.md) [2025-05-11 f3s: Kubernetes with FreeBSD - Part 5: WireGuard mesh network](./2025-05-11-f3s-kubernetes-with-freebsd-part-5.md) [2025-04-05 f3s: Kubernetes with FreeBSD - Part 4: Rocky Linux Bhyve VMs](./2025-04-05-f3s-kubernetes-with-freebsd-part-4.md) diff --git a/gemfeed/2024-04-01-KISS-high-availability-with-OpenBSD.md b/gemfeed/2024-04-01-KISS-high-availability-with-OpenBSD.md index 0c8455af..c72c4e0a 100644 --- a/gemfeed/2024-04-01-KISS-high-availability-with-OpenBSD.md +++ b/gemfeed/2024-04-01-KISS-high-availability-with-OpenBSD.md @@ -300,6 +300,7 @@ E-Mail your comments to `paul@nospam.buetow.org` :-) Other *BSD and KISS related posts are: +[2025-10-02 f3s: Kubernetes with FreeBSD - Part 7: k3s and first pod deployments](./2025-10-02-f3s-kubernetes-with-freebsd-part-7.md) [2025-07-14 f3s: Kubernetes with FreeBSD - Part 6: Storage](./2025-07-14-f3s-kubernetes-with-freebsd-part-6.md) [2025-05-11 f3s: Kubernetes with FreeBSD - Part 5: WireGuard mesh network](./2025-05-11-f3s-kubernetes-with-freebsd-part-5.md) [2025-04-05 f3s: Kubernetes with FreeBSD - Part 4: Rocky Linux Bhyve VMs](./2025-04-05-f3s-kubernetes-with-freebsd-part-4.md) diff --git a/gemfeed/2024-11-17-f3s-kubernetes-with-freebsd-part-1.md b/gemfeed/2024-11-17-f3s-kubernetes-with-freebsd-part-1.md index 05ba7e53..a4603be6 100644 --- a/gemfeed/2024-11-17-f3s-kubernetes-with-freebsd-part-1.md +++ b/gemfeed/2024-11-17-f3s-kubernetes-with-freebsd-part-1.md @@ -14,6 +14,7 @@ These are all the posts so far: [2025-04-05 f3s: Kubernetes with FreeBSD - Part 4: Rocky Linux Bhyve VMs](./2025-04-05-f3s-kubernetes-with-freebsd-part-4.md) [2025-05-11 f3s: Kubernetes with FreeBSD - Part 5: WireGuard mesh network](./2025-05-11-f3s-kubernetes-with-freebsd-part-5.md) [2025-07-14 f3s: Kubernetes with FreeBSD - Part 6: Storage](./2025-07-14-f3s-kubernetes-with-freebsd-part-6.md) +[2025-10-02 f3s: Kubernetes with FreeBSD - Part 7: k3s and first pod deployments](./2025-10-02-f3s-kubernetes-with-freebsd-part-7.md) [![f3s logo](./f3s-kubernetes-with-freebsd-part-1/f3slogo.png "f3s logo")](./f3s-kubernetes-with-freebsd-part-1/f3slogo.png) @@ -162,6 +163,7 @@ Read the next post of this series: Other *BSD-related posts: +[2025-10-02 f3s: Kubernetes with FreeBSD - Part 7: k3s and first pod deployments](./2025-10-02-f3s-kubernetes-with-freebsd-part-7.md) [2025-07-14 f3s: Kubernetes with FreeBSD - Part 6: Storage](./2025-07-14-f3s-kubernetes-with-freebsd-part-6.md) [2025-05-11 f3s: Kubernetes with FreeBSD - Part 5: WireGuard mesh network](./2025-05-11-f3s-kubernetes-with-freebsd-part-5.md) [2025-04-05 f3s: Kubernetes with FreeBSD - Part 4: Rocky Linux Bhyve VMs](./2025-04-05-f3s-kubernetes-with-freebsd-part-4.md) diff --git a/gemfeed/2024-12-03-f3s-kubernetes-with-freebsd-part-2.md b/gemfeed/2024-12-03-f3s-kubernetes-with-freebsd-part-2.md index 5337f8e4..7a5ce6c6 100644 --- a/gemfeed/2024-12-03-f3s-kubernetes-with-freebsd-part-2.md +++ b/gemfeed/2024-12-03-f3s-kubernetes-with-freebsd-part-2.md @@ -1,4 +1,4 @@ - f3s: Kubernetes with FreeBSD - Part 2: Hardware and base installation +# f3s: Kubernetes with FreeBSD - Part 2: Hardware and base installation > Published at 2024-12-02T23:48:21+02:00 @@ -14,6 +14,7 @@ These are all the posts so far: [2025-04-05 f3s: Kubernetes with FreeBSD - Part 4: Rocky Linux Bhyve VMs](./2025-04-05-f3s-kubernetes-with-freebsd-part-4.md) [2025-05-11 f3s: Kubernetes with FreeBSD - Part 5: WireGuard mesh network](./2025-05-11-f3s-kubernetes-with-freebsd-part-5.md) [2025-07-14 f3s: Kubernetes with FreeBSD - Part 6: Storage](./2025-07-14-f3s-kubernetes-with-freebsd-part-6.md) +[2025-10-02 f3s: Kubernetes with FreeBSD - Part 7: k3s and first pod deployments](./2025-10-02-f3s-kubernetes-with-freebsd-part-7.md) [![f3s logo](./f3s-kubernetes-with-freebsd-part-1/f3slogo.png "f3s logo")](./f3s-kubernetes-with-freebsd-part-1/f3slogo.png) @@ -23,6 +24,7 @@ Let's continue... ## Table of Contents +* [⇢ f3s: Kubernetes with FreeBSD - Part 2: Hardware and base installation](#f3s-kubernetes-with-freebsd---part-2-hardware-and-base-installation) * [⇢ Deciding on the hardware](#deciding-on-the-hardware) * [⇢ ⇢ Not ARM but Intel N100 ](#not-arm-but-intel-n100-) * [⇢ ⇢ Beelink unboxing](#beelink-unboxing) @@ -302,6 +304,7 @@ Read the next post of this series: Other *BSD-related posts: +[2025-10-02 f3s: Kubernetes with FreeBSD - Part 7: k3s and first pod deployments](./2025-10-02-f3s-kubernetes-with-freebsd-part-7.md) [2025-07-14 f3s: Kubernetes with FreeBSD - Part 6: Storage](./2025-07-14-f3s-kubernetes-with-freebsd-part-6.md) [2025-05-11 f3s: Kubernetes with FreeBSD - Part 5: WireGuard mesh network](./2025-05-11-f3s-kubernetes-with-freebsd-part-5.md) [2025-04-05 f3s: Kubernetes with FreeBSD - Part 4: Rocky Linux Bhyve VMs](./2025-04-05-f3s-kubernetes-with-freebsd-part-4.md) diff --git a/gemfeed/2025-02-01-f3s-kubernetes-with-freebsd-part-3.md b/gemfeed/2025-02-01-f3s-kubernetes-with-freebsd-part-3.md index f11a637f..cdf1eb84 100644 --- a/gemfeed/2025-02-01-f3s-kubernetes-with-freebsd-part-3.md +++ b/gemfeed/2025-02-01-f3s-kubernetes-with-freebsd-part-3.md @@ -10,6 +10,7 @@ This is the third blog post about my f3s series for my self-hosting demands in m [2025-04-05 f3s: Kubernetes with FreeBSD - Part 4: Rocky Linux Bhyve VMs](./2025-04-05-f3s-kubernetes-with-freebsd-part-4.md) [2025-05-11 f3s: Kubernetes with FreeBSD - Part 5: WireGuard mesh network](./2025-05-11-f3s-kubernetes-with-freebsd-part-5.md) [2025-07-14 f3s: Kubernetes with FreeBSD - Part 6: Storage](./2025-07-14-f3s-kubernetes-with-freebsd-part-6.md) +[2025-10-02 f3s: Kubernetes with FreeBSD - Part 7: k3s and first pod deployments](./2025-10-02-f3s-kubernetes-with-freebsd-part-7.md) [![f3s logo](./f3s-kubernetes-with-freebsd-part-1/f3slogo.png "f3s logo")](./f3s-kubernetes-with-freebsd-part-1/f3slogo.png) @@ -364,6 +365,7 @@ Read the next post of this series: Other BSD related posts are: +[2025-10-02 f3s: Kubernetes with FreeBSD - Part 7: k3s and first pod deployments](./2025-10-02-f3s-kubernetes-with-freebsd-part-7.md) [2025-07-14 f3s: Kubernetes with FreeBSD - Part 6: Storage](./2025-07-14-f3s-kubernetes-with-freebsd-part-6.md) [2025-05-11 f3s: Kubernetes with FreeBSD - Part 5: WireGuard mesh network](./2025-05-11-f3s-kubernetes-with-freebsd-part-5.md) [2025-04-05 f3s: Kubernetes with FreeBSD - Part 4: Rocky Linux Bhyve VMs](./2025-04-05-f3s-kubernetes-with-freebsd-part-4.md) diff --git a/gemfeed/2025-04-05-f3s-kubernetes-with-freebsd-part-4.md b/gemfeed/2025-04-05-f3s-kubernetes-with-freebsd-part-4.md index 9a80f5fe..96f4bc16 100644 --- a/gemfeed/2025-04-05-f3s-kubernetes-with-freebsd-part-4.md +++ b/gemfeed/2025-04-05-f3s-kubernetes-with-freebsd-part-4.md @@ -10,6 +10,7 @@ This is the fourth blog post about the f3s series for self-hosting demands in a [2025-04-05 f3s: Kubernetes with FreeBSD - Part 4: Rocky Linux Bhyve VMs (You are currently reading this)](./2025-04-05-f3s-kubernetes-with-freebsd-part-4.md) [2025-05-11 f3s: Kubernetes with FreeBSD - Part 5: WireGuard mesh network](./2025-05-11-f3s-kubernetes-with-freebsd-part-5.md) [2025-07-14 f3s: Kubernetes with FreeBSD - Part 6: Storage](./2025-07-14-f3s-kubernetes-with-freebsd-part-6.md) +[2025-10-02 f3s: Kubernetes with FreeBSD - Part 7: k3s and first pod deployments](./2025-10-02-f3s-kubernetes-with-freebsd-part-7.md) [![f3s logo](./f3s-kubernetes-with-freebsd-part-1/f3slogo.png "f3s logo")](./f3s-kubernetes-with-freebsd-part-1/f3slogo.png) @@ -510,6 +511,7 @@ Read the next post of this series: Other *BSD-related posts: +[2025-10-02 f3s: Kubernetes with FreeBSD - Part 7: k3s and first pod deployments](./2025-10-02-f3s-kubernetes-with-freebsd-part-7.md) [2025-07-14 f3s: Kubernetes with FreeBSD - Part 6: Storage](./2025-07-14-f3s-kubernetes-with-freebsd-part-6.md) [2025-05-11 f3s: Kubernetes with FreeBSD - Part 5: WireGuard mesh network](./2025-05-11-f3s-kubernetes-with-freebsd-part-5.md) [2025-04-05 f3s: Kubernetes with FreeBSD - Part 4: Rocky Linux Bhyve VMs (You are currently reading this)](./2025-04-05-f3s-kubernetes-with-freebsd-part-4.md) diff --git a/gemfeed/2025-05-11-f3s-kubernetes-with-freebsd-part-5.md b/gemfeed/2025-05-11-f3s-kubernetes-with-freebsd-part-5.md index 1dca3454..f1e5d288 100644 --- a/gemfeed/2025-05-11-f3s-kubernetes-with-freebsd-part-5.md +++ b/gemfeed/2025-05-11-f3s-kubernetes-with-freebsd-part-5.md @@ -14,6 +14,7 @@ These are all the posts so far: [2025-04-05 f3s: Kubernetes with FreeBSD - Part 4: Rocky Linux Bhyve VMs](./2025-04-05-f3s-kubernetes-with-freebsd-part-4.md) [2025-05-11 f3s: Kubernetes with FreeBSD - Part 5: WireGuard mesh network (You are currently reading this)](./2025-05-11-f3s-kubernetes-with-freebsd-part-5.md) [2025-07-14 f3s: Kubernetes with FreeBSD - Part 6: Storage](./2025-07-14-f3s-kubernetes-with-freebsd-part-6.md) +[2025-10-02 f3s: Kubernetes with FreeBSD - Part 7: k3s and first pod deployments](./2025-10-02-f3s-kubernetes-with-freebsd-part-7.md) [![f3s logo](./f3s-kubernetes-with-freebsd-part-1/f3slogo.png "f3s logo")](./f3s-kubernetes-with-freebsd-part-1/f3slogo.png) @@ -931,6 +932,7 @@ Read the next post of this series: Other *BSD-related posts: +[2025-10-02 f3s: Kubernetes with FreeBSD - Part 7: k3s and first pod deployments](./2025-10-02-f3s-kubernetes-with-freebsd-part-7.md) [2025-07-14 f3s: Kubernetes with FreeBSD - Part 6: Storage](./2025-07-14-f3s-kubernetes-with-freebsd-part-6.md) [2025-05-11 f3s: Kubernetes with FreeBSD - Part 5: WireGuard mesh network (You are currently reading this)](./2025-05-11-f3s-kubernetes-with-freebsd-part-5.md) [2025-04-05 f3s: Kubernetes with FreeBSD - Part 4: Rocky Linux Bhyve VMs](./2025-04-05-f3s-kubernetes-with-freebsd-part-4.md) diff --git a/gemfeed/2025-07-14-f3s-kubernetes-with-freebsd-part-6.md b/gemfeed/2025-07-14-f3s-kubernetes-with-freebsd-part-6.md index 490ae012..4e060a6d 100644 --- a/gemfeed/2025-07-14-f3s-kubernetes-with-freebsd-part-6.md +++ b/gemfeed/2025-07-14-f3s-kubernetes-with-freebsd-part-6.md @@ -10,6 +10,7 @@ This is the sixth blog post about the f3s series for self-hosting demands in a h [2025-04-05 f3s: Kubernetes with FreeBSD - Part 4: Rocky Linux Bhyve VMs](./2025-04-05-f3s-kubernetes-with-freebsd-part-4.md) [2025-05-11 f3s: Kubernetes with FreeBSD - Part 5: WireGuard mesh network](./2025-05-11-f3s-kubernetes-with-freebsd-part-5.md) [2025-07-14 f3s: Kubernetes with FreeBSD - Part 6: Storage (You are currently reading this)](./2025-07-14-f3s-kubernetes-with-freebsd-part-6.md) +[2025-10-02 f3s: Kubernetes with FreeBSD - Part 7: k3s and first pod deployments](./2025-10-02-f3s-kubernetes-with-freebsd-part-7.md) [![f3s logo](./f3s-kubernetes-with-freebsd-part-1/f3slogo.png "f3s logo")](./f3s-kubernetes-with-freebsd-part-1/f3slogo.png) @@ -719,7 +720,7 @@ Whereas: Next, update `/etc/hosts` on all nodes (`f0`, `f1`, `f2`, `r0`, `r1`, `r2`) to resolve the VIP hostname: ``` -192.168.1.138 f3s-storage-ha f3s-storage-ha.lan f3s-storage-ha.lan.buetow.org +192.168.2.138 f3s-storage-ha f3s-storage-ha.wg0 f3s-storage-ha.wg0.wan.buetow.org ``` This allows clients to connect to `f3s-storage-ha` regardless of which physical server is currently the MASTER. @@ -1400,7 +1401,7 @@ To mount NFS through the stunnel encrypted tunnel, we run: clientaddr=127.0.0.1,local_lock=none,addr=127.0.0.1) # For persistent mount, add to /etc/fstab: -127.0.0.1:/data/nfs/k3svolumes /data/nfs/k3svolumes nfs4 port=2323,_netdev 0 0 +127.0.0.1:/k3svolumes /data/nfs/k3svolumes nfs4 port=2323,_netdev,soft,timeo=10,retrans=2,intr 0 0 ``` Note: The mount uses localhost (`127.0.0.1`) because stunnel is listening locally and forwarding the encrypted traffic to the remote server. @@ -1650,10 +1651,13 @@ MooseFS is a fault-tolerant, distributed file system that could provide proper h Both technologies could run on top of our encrypted ZFS volumes, combining ZFS's data integrity and encryption features with distributed storage capabilities. This would be particularly interesting for workloads that need either S3-compatible APIs (MinIO) or transparent distributed POSIX storage (MooseFS). What about Ceph and GlusterFS? Unfortunately, there doesn't seem to be great native FreeBSD support for them. However, other alternatives also appear suitable for my use case. -I'm looking forward to the next post in this series, where we will set up k3s (Kubernetes) on the Linux VMs. +Read the next post of this series: + +[f3s: Kubernetes with FreeBSD - Part 7: k3s and first pod deployments](./2025-10-02-f3s-kubernetes-with-freebsd-part-7.md) Other *BSD-related posts: +[2025-10-02 f3s: Kubernetes with FreeBSD - Part 7: k3s and first pod deployments](./2025-10-02-f3s-kubernetes-with-freebsd-part-7.md) [2025-07-14 f3s: Kubernetes with FreeBSD - Part 6: Storage (You are currently reading this)](./2025-07-14-f3s-kubernetes-with-freebsd-part-6.md) [2025-05-11 f3s: Kubernetes with FreeBSD - Part 5: WireGuard mesh network](./2025-05-11-f3s-kubernetes-with-freebsd-part-5.md) [2025-04-05 f3s: Kubernetes with FreeBSD - Part 4: Rocky Linux Bhyve VMs](./2025-04-05-f3s-kubernetes-with-freebsd-part-4.md) diff --git a/gemfeed/2025-10-02-f3s-kubernetes-with-freebsd-part-7.md b/gemfeed/2025-10-02-f3s-kubernetes-with-freebsd-part-7.md new file mode 100644 index 00000000..190bab41 --- /dev/null +++ b/gemfeed/2025-10-02-f3s-kubernetes-with-freebsd-part-7.md @@ -0,0 +1,960 @@ +# f3s: Kubernetes with FreeBSD - Part 7: k3s and first pod deployments + +> Published at 2025-10-02T11:27:19+03:00 + +This is the seventh blog post about the f3s series for my self-hosting demands in a home lab. f3s? The "f" stands for FreeBSD, and the "3s" stands for k3s, the Kubernetes distribution I use on FreeBSD-based physical machines. + +[2024-11-17 f3s: Kubernetes with FreeBSD - Part 1: Setting the stage](./2024-11-17-f3s-kubernetes-with-freebsd-part-1.md) +[2024-12-03 f3s: Kubernetes with FreeBSD - Part 2: Hardware and base installation](./2024-12-03-f3s-kubernetes-with-freebsd-part-2.md) +[2025-02-01 f3s: Kubernetes with FreeBSD - Part 3: Protecting from power cuts](./2025-02-01-f3s-kubernetes-with-freebsd-part-3.md) +[2025-04-05 f3s: Kubernetes with FreeBSD - Part 4: Rocky Linux Bhyve VMs](./2025-04-05-f3s-kubernetes-with-freebsd-part-4.md) +[2025-05-11 f3s: Kubernetes with FreeBSD - Part 5: WireGuard mesh network](./2025-05-11-f3s-kubernetes-with-freebsd-part-5.md) +[2025-07-14 f3s: Kubernetes with FreeBSD - Part 6: Storage](./2025-07-14-f3s-kubernetes-with-freebsd-part-6.md) +[2025-10-02 f3s: Kubernetes with FreeBSD - Part 7: k3s and first pod deployments (You are currently reading this)](./2025-10-02-f3s-kubernetes-with-freebsd-part-7.md) + +[![f3s logo](./f3s-kubernetes-with-freebsd-part-1/f3slogo.png "f3s logo")](./f3s-kubernetes-with-freebsd-part-1/f3slogo.png) + +## Table of Contents + +* [⇢ f3s: Kubernetes with FreeBSD - Part 7: k3s and first pod deployments](#f3s-kubernetes-with-freebsd---part-7-k3s-and-first-pod-deployments) +* [⇢ ⇢ Introduction](#introduction) +* [⇢ ⇢ Updating](#updating) +* [⇢ ⇢ Installing k3s](#installing-k3s) +* [⇢ ⇢ ⇢ Generating `K3S_TOKEN` and starting the first k3s node](#generating-k3stoken-and-starting-the-first-k3s-node) +* [⇢ ⇢ ⇢ Adding the remaining nodes to the cluster](#adding-the-remaining-nodes-to-the-cluster) +* [⇢ ⇢ Test deployments](#test-deployments) +* [⇢ ⇢ ⇢ Test deployment to Kubernetes](#test-deployment-to-kubernetes) +* [⇢ ⇢ ⇢ Test deployment with persistent volume claim](#test-deployment-with-persistent-volume-claim) +* [⇢ ⇢ ⇢ Scaling Traefik for faster failover](#scaling-traefik-for-faster-failover) +* [⇢ ⇢ Make it accessible from the public internet](#make-it-accessible-from-the-public-internet) +* [⇢ ⇢ ⇢ OpenBSD relayd configuration](#openbsd-relayd-configuration) +* [⇢ ⇢ Deploying the private Docker image registry](#deploying-the-private-docker-image-registry) +* [⇢ ⇢ ⇢ Prepare the NFS-backed storage](#prepare-the-nfs-backed-storage) +* [⇢ ⇢ ⇢ Install (or upgrade) the chart](#install-or-upgrade-the-chart) +* [⇢ ⇢ ⇢ Allow nodes and workstations to trust the registry](#allow-nodes-and-workstations-to-trust-the-registry) +* [⇢ ⇢ ⇢ Pushing and pulling images](#pushing-and-pulling-images) +* [⇢ ⇢ Example: Anki Sync Server from the private registry](#example-anki-sync-server-from-the-private-registry) +* [⇢ ⇢ ⇢ Build and push the image](#build-and-push-the-image) +* [⇢ ⇢ ⇢ Create the Anki secret and storage on the cluster](#create-the-anki-secret-and-storage-on-the-cluster) +* [⇢ ⇢ ⇢ Deploy the chart](#deploy-the-chart) +* [⇢ ⇢ NFSv4 UID mapping for Postgres-backed (and other) apps](#nfsv4-uid-mapping-for-postgres-backed-and-other-apps) +* [⇢ ⇢ ⇢ Helm charts currently in service](#helm-charts-currently-in-service) + +## Introduction + +In this blog post, I am finally going to install k3s (the Kubernetes distribution I use) to the whole setup and deploy the first workloads (helm charts, and a private registry) to it. + +[https://k3s.io](https://k3s.io) + +## Updating + +Before proceeding, I bring all systems involved up-to-date. On all three Rocky Linux 9 boxes `r0`, `r1`, and `r2`: + +```sh +dnf update -y +reboot +``` + +On the FreeBSD hosts, I upgraded from FreeBSD 14.2 to 14.3-RELEASE, running this on all three hosts `f0`, `f1` and `f2`: + +```sh +paul@f0:~ % doas freebsd-update fetch +paul@f0:~ % doas freebsd-update install +paul@f0:~ % doas reboot +. +. +. +paul@f0:~ % doas freebsd-update -r 14.3-RELEASE upgrade +paul@f0:~ % doas freebsd-update install +paul@f0:~ % doas freebsd-update install +paul@f0:~ % doas reboot +. +. +. +paul@f0:~ % doas freebsd-update install +paul@f0:~ % doas pkg update +paul@f0:~ % doas pkg upgrade +paul@f0:~ % doas reboot +. +. +. +paul@f0:~ % uname -a +FreeBSD f0.lan.buetow.org 14.3-RELEASE FreeBSD 14.3-RELEASE + releng/14.3-n271432-8c9ce319fef7 GENERIC amd64 +``` + +## Installing k3s + +### Generating `K3S_TOKEN` and starting the first k3s node + +I generated the k3s token on my Fedora laptop with `pwgen -n 32` and selected one of the results. Then, on all three `r` hosts, I ran the following (replace SECRET_TOKEN with the actual secret): + +```sh +[root@r0 ~]# echo -n SECRET_TOKEN > ~/.k3s_token +``` + +The following steps are also documented on the k3s website: + +[https://docs.k3s.io/datastore/ha-embedded](https://docs.k3s.io/datastore/ha-embedded) + +To bootstrap k3s on the first node, I ran this on `r0`: + +```sh +[root@r0 ~]# curl -sfL https://get.k3s.io | K3S_TOKEN=$(cat ~/.k3s_token) \ + sh -s - server --cluster-init --tls-san=r0.wg0.wan.buetow.org +[INFO] Finding release for channel stable +[INFO] Using v1.32.6+k3s1 as release +. +. +. +[INFO] systemd: Starting k3s +``` + +### Adding the remaining nodes to the cluster + +Then I ran on the other two nodes `r1` and `r2`: + +```sh +[root@r1 ~]# curl -sfL https://get.k3s.io | K3S_TOKEN=$(cat ~/.k3s_token) \ + sh -s - server --server https://r0.wg0.wan.buetow.org:6443 \ + --tls-san=r1.wg0.wan.buetow.org + +[root@r2 ~]# curl -sfL https://get.k3s.io | K3S_TOKEN=$(cat ~/.k3s_token) \ + sh -s - server --server https://r0.wg0.wan.buetow.org:6443 \ + --tls-san=r2.wg0.wan.buetow.org +. +. +. + +``` + +Once done, I had a three-node Kubernetes cluster control plane: + +```sh +[root@r0 ~]# kubectl get nodes +NAME STATUS ROLES AGE VERSION +r0.lan.buetow.org Ready control-plane,etcd,master 4m44s v1.32.6+k3s1 +r1.lan.buetow.org Ready control-plane,etcd,master 3m13s v1.32.6+k3s1 +r2.lan.buetow.org Ready control-plane,etcd,master 30s v1.32.6+k3s1 + +[root@r0 ~]# kubectl get pods --all-namespaces +NAMESPACE NAME READY STATUS RESTARTS AGE +kube-system coredns-5688667fd4-fs2jj 1/1 Running 0 5m27s +kube-system helm-install-traefik-crd-f9hgd 0/1 Completed 0 5m27s +kube-system helm-install-traefik-zqqqk 0/1 Completed 2 5m27s +kube-system local-path-provisioner-774c6665dc-jqlnc 1/1 Running 0 5m27s +kube-system metrics-server-6f4c6675d5-5xpmp 1/1 Running 0 5m27s +kube-system svclb-traefik-411cec5b-cdp2l 2/2 Running 0 78s +kube-system svclb-traefik-411cec5b-f625r 2/2 Running 0 4m58s +kube-system svclb-traefik-411cec5b-twrd7 2/2 Running 0 4m2s +kube-system traefik-c98fdf6fb-lt6fx 1/1 Running 0 4m58s +``` + +In order to connect with `kubectl` from my Fedora laptop, I had to copy `/etc/rancher/k3s/k3s.yaml` from `r0` to `~/.kube/config` and then replace the value of the server field with `r0.lan.buetow.org`. kubectl can now manage the cluster. Note that this step has to be repeated when I want to connect to another node of the cluster (e.g. when `r0` is down). + +## Test deployments + +### Test deployment to Kubernetes + +Let's create a test namespace: + +```sh +> ~ kubectl create namespace test +namespace/test created + +> ~ kubectl get namespaces +NAME STATUS AGE +default Active 6h11m +kube-node-lease Active 6h11m +kube-public Active 6h11m +kube-system Active 6h11m +test Active 5s + +> ~ kubectl config set-context --current --namespace=test +Context "default" modified. +``` + +And let's also create an Apache test pod: + +```sh +> ~ cat < apache-deployment.yaml +# Apache HTTP Server Deployment +apiVersion: apps/v1 +kind: Deployment +metadata: + name: apache-deployment +spec: + replicas: 1 + selector: + matchLabels: + app: apache + template: + metadata: + labels: + app: apache + spec: + containers: + - name: apache + image: httpd:latest + ports: + # Container port where Apache listens + - containerPort: 80 +END + +> ~ kubectl apply -f apache-deployment.yaml +deployment.apps/apache-deployment created + +> ~ kubectl get all +NAME READY STATUS RESTARTS AGE +pod/apache-deployment-5fd955856f-4pjmf 1/1 Running 0 7s + +NAME READY UP-TO-DATE AVAILABLE AGE +deployment.apps/apache-deployment 1/1 1 1 7s + +NAME DESIRED CURRENT READY AGE +replicaset.apps/apache-deployment-5fd955856f 1 1 1 7s +``` + +Let's also create a service: + +```sh +> ~ cat < apache-service.yaml +apiVersion: v1 +kind: Service +metadata: + labels: + app: apache + name: apache-service +spec: + ports: + - name: web + port: 80 + protocol: TCP + # Expose port 80 on the service + targetPort: 80 + selector: + # Link this service to pods with the label app=apache + app: apache +END + +> ~ kubectl apply -f apache-service.yaml +service/apache-service created + +> ~ kubectl get service +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +apache-service ClusterIP 10.43.249.165 80/TCP 4s +``` + +Now let's create an ingress: + +> Note: I've modified the hosts listed in this example after I published this blog post to ensure that there aren't any bots scraping it. + +```sh +> ~ cat < apache-ingress.yaml + +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: apache-ingress + namespace: test + annotations: + spec.ingressClassName: traefik + traefik.ingress.kubernetes.io/router.entrypoints: web +spec: + rules: + - host: f3s.foo.zone + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: apache-service + port: + number: 80 + - host: standby.f3s.foo.zone + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: apache-service + port: + number: 80 + - host: www.f3s.foo.zone + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: apache-service + port: + number: 80 +END + +> ~ kubectl apply -f apache-ingress.yaml +ingress.networking.k8s.io/apache-ingress created + +> ~ kubectl describe ingress +Name: apache-ingress +Labels: +Namespace: test +Address: 192.168.1.120,192.168.1.121,192.168.1.122 +Ingress Class: traefik +Default backend: +Rules: + Host Path Backends + ---- ---- -------- + f3s.foo.zone + / apache-service:80 (10.42.1.11:80) + standby.f3s.foo.zone + / apache-service:80 (10.42.1.11:80) + www.f3s.foo.zone + / apache-service:80 (10.42.1.11:80) +Annotations: spec.ingressClassName: traefik + traefik.ingress.kubernetes.io/router.entrypoints: web +Events: +``` + +Notes: + +* In the ingress, I use plain HTTP (web) for the Traefik rule, as all the "production" traffic will be routed through a WireGuard tunnel anyway, as I will show later. + +So I tested the Apache web server through the ingress rule: + +```sh +> ~ curl -H "Host: www.f3s.foo.zone" http://r0.lan.buetow.org:80 +

It works!

+``` + +### Test deployment with persistent volume claim + +Next, I modified the Apache example to serve the `htdocs` directory from the NFS share I created in the previous blog post. I used the following manifests. Most of them are the same as before, except for the persistent volume claim and the volume mount in the Apache deployment. + +```sh +> ~ cat < apache-deployment.yaml +# Apache HTTP Server Deployment +apiVersion: apps/v1 +kind: Deployment +metadata: + name: apache-deployment + namespace: test +spec: + replicas: 2 + selector: + matchLabels: + app: apache + template: + metadata: + labels: + app: apache + spec: + containers: + - name: apache + image: httpd:latest + ports: + # Container port where Apache listens + - containerPort: 80 + readinessProbe: + httpGet: + path: / + port: 80 + initialDelaySeconds: 5 + periodSeconds: 10 + livenessProbe: + httpGet: + path: / + port: 80 + initialDelaySeconds: 15 + periodSeconds: 10 + volumeMounts: + - name: apache-htdocs + mountPath: /usr/local/apache2/htdocs/ + volumes: + - name: apache-htdocs + persistentVolumeClaim: + claimName: example-apache-pvc +END + +> ~ cat < apache-ingress.yaml +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: apache-ingress + namespace: test + annotations: + spec.ingressClassName: traefik + traefik.ingress.kubernetes.io/router.entrypoints: web +spec: + rules: + - host: f3s.foo.zone + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: apache-service + port: + number: 80 + - host: standby.f3s.foo.zone + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: apache-service + port: + number: 80 + - host: www.f3s.foo.zone + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: apache-service + port: + number: 80 +END + +> ~ cat < apache-persistent-volume.yaml +apiVersion: v1 +kind: PersistentVolume +metadata: + name: example-apache-pv +spec: + capacity: + storage: 1Gi + volumeMode: Filesystem + accessModes: + - ReadWriteOnce + persistentVolumeReclaimPolicy: Retain + hostPath: + path: /data/nfs/k3svolumes/example-apache-volume-claim + type: Directory +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: example-apache-pvc + namespace: test +spec: + storageClassName: "" + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi +END + +> ~ cat < apache-service.yaml +apiVersion: v1 +kind: Service +metadata: + labels: + app: apache + name: apache-service + namespace: test +spec: + ports: + - name: web + port: 80 + protocol: TCP + # Expose port 80 on the service + targetPort: 80 + selector: + # Link this service to pods with the label app=apache + app: apache +END +``` + +I applied the manifests: + +```sh +> ~ kubectl apply -f apache-persistent-volume.yaml +> ~ kubectl apply -f apache-service.yaml +> ~ kubectl apply -f apache-deployment.yaml +> ~ kubectl apply -f apache-ingress.yaml +``` + +Looking at the deployment, I could see it failed because the directory didn't exist yet on the NFS share (note that I also increased the replica count to 2 so if one node goes down there's already a replica running on another node for faster failover): + +```sh +> ~ kubectl get pods +NAME READY STATUS RESTARTS AGE +apache-deployment-5b96bd6b6b-fv2jx 0/1 ContainerCreating 0 9m15s +apache-deployment-5b96bd6b6b-ax2ji 0/1 ContainerCreating 0 9m15s + +> ~ kubectl describe pod apache-deployment-5b96bd6b6b-fv2jx | tail -n 5 +Events: + Type Reason Age From Message + ---- ------ ---- ---- ------- + Normal Scheduled 9m34s default-scheduler Successfully + assigned test/apache-deployment-5b96bd6b6b-fv2jx to r2.lan.buetow.org + Warning FailedMount 80s (x12 over 9m34s) kubelet MountVolume.SetUp + failed for volume "example-apache-pv" : hostPath type check failed: + /data/nfs/k3svolumes/example-apache is not a directory +``` + +That's intentional—I needed to create the directory on the NFS share first, so I did that (e.g. on `r0`): + +```sh +[root@r0 ~]# mkdir /data/nfs/k3svolumes/example-apache-volume-claim/ + +[root@r0 ~]# cat < /data/nfs/k3svolumes/example-apache-volume-claim/index.html + + + + Hello, it works + + +

Hello, it works!

+

This site is served via a PVC!

+ + +END +``` + +The `index.html` file gives us some actual content to serve. After deleting the pod, it recreates itself and the volume mounts correctly: + +```sh +> ~ kubectl delete pod apache-deployment-5b96bd6b6b-fv2jx + +> ~ curl -H "Host: www.f3s.foo.zone" http://r0.lan.buetow.org:80 + + + + Hello, it works + + +

Hello, it works!

+

This site is served via a PVC!

+ + +``` + +### Scaling Traefik for faster failover + +Traefik (used for ingress on k3s) ships with a single replica by default, but for faster failover I bumped it to two replicas so each worker node runs one pod. That way, if a node disappears, the service stays up while Kubernetes schedules a replacement. Here's the command I used: + +```sh +> ~ kubectl -n kube-system scale deployment traefik --replicas=2 +``` + +And the result: + +```sh +> ~ kubectl -n kube-system get pods -l app.kubernetes.io/name=traefik +kube-system traefik-c98fdf6fb-97kqk 1/1 Running 19 (53d ago) 64d +kube-system traefik-c98fdf6fb-9npg2 1/1 Running 11 (53d ago) 61d +``` + +## Make it accessible from the public internet + +Next, I made this accessible through the public internet via the `www.f3s.foo.zone` hosts. As a reminder from part 1 of this series, I reviewed the section titled "OpenBSD/relayd to the rescue for external connectivity": + +[f3s: Kubernetes with FreeBSD - Part 1: Setting the stage](./2024-11-17-f3s-kubernetes-with-freebsd-part-1.md) + +> All apps should be reachable through the internet (e.g., from my phone or computer when travelling). For external connectivity and TLS management, I've got two OpenBSD VMs (one hosted by OpenBSD Amsterdam and another hosted by Hetzner) handling public-facing services like DNS, relaying traffic, and automating Let's Encrypt certificates. + +> All of this (every Linux VM to every OpenBSD box) will be connected via WireGuard tunnels, keeping everything private and secure. There will be 6 WireGuard tunnels (3 k3s nodes times two OpenBSD VMs). + +> So, when I want to access a service running in k3s, I will hit an external DNS endpoint (with the authoritative DNS servers being the OpenBSD boxes). The DNS will resolve to the master OpenBSD VM (see my KISS highly-available with OpenBSD blog post), and from there, the relayd process (with a Let's Encrypt certificate—see my Let's Encrypt with OpenBSD and Rex blog post) will accept the TCP connection and forward it through the WireGuard tunnel to a reachable node port of one of the k3s nodes, thus serving the traffic. + +```sh +> ~ curl https://f3s.foo.zone +

It works!

+ +> ~ curl https://www.f3s.foo.zone +

It works!

+ +> ~ curl https://standby.f3s.foo.zone +

It works!

+``` + +This is how it works in `relayd.conf` on OpenBSD: + +### OpenBSD relayd configuration + +The OpenBSD edge relays keep the Kubernetes-facing addresses for the f3s ingress endpoints in a shared backend table so TLS traffic for every `f3s` hostname lands on the same pool of k3s nodes (pointing to the WireGuard IP addresses of those nodes - remember, they are running locally in my LAN, wheras the OpenBSD edge relays operate in the public internet): + +``` +table { + 192.168.2.120 + 192.168.2.121 + 192.168.2.122 +} +``` + +Inside the `http protocol "https"` block each public hostname gets its Let's Encrypt certificate and is matched to that backend table. Besides the primary trio, every service-specific hostname (`anki`, `bag`, `flux`, `audiobookshelf`, `gpodder`, `radicale`, `vault`, `syncthing`, `uprecords`) and their `www` / `standby` aliases reuse the same pool so new apps can go live just by publishing an ingress rule, whereas they will all map to a service running in k3s: + +``` +http protocol "https" { + tls keypair f3s.foo.zone + tls keypair www.f3s.foo.zone + tls keypair standby.f3s.foo.zone + tls keypair anki.f3s.foo.zone + tls keypair www.anki.f3s.foo.zone + tls keypair standby.anki.f3s.foo.zone + tls keypair bag.f3s.foo.zone + tls keypair www.bag.f3s.foo.zone + tls keypair standby.bag.f3s.foo.zone + tls keypair flux.f3s.foo.zone + tls keypair www.flux.f3s.foo.zone + tls keypair standby.flux.f3s.foo.zone + tls keypair audiobookshelf.f3s.foo.zone + tls keypair www.audiobookshelf.f3s.foo.zone + tls keypair standby.audiobookshelf.f3s.foo.zone + tls keypair gpodder.f3s.foo.zone + tls keypair www.gpodder.f3s.foo.zone + tls keypair standby.gpodder.f3s.foo.zone + tls keypair radicale.f3s.foo.zone + tls keypair www.radicale.f3s.foo.zone + tls keypair standby.radicale.f3s.foo.zone + tls keypair vault.f3s.foo.zone + tls keypair www.vault.f3s.foo.zone + tls keypair standby.vault.f3s.foo.zone + tls keypair syncthing.f3s.foo.zone + tls keypair www.syncthing.f3s.foo.zone + tls keypair standby.syncthing.f3s.foo.zone + tls keypair uprecords.f3s.foo.zone + tls keypair www.uprecords.f3s.foo.zone + tls keypair standby.uprecords.f3s.foo.zone + + match request quick header "Host" value "f3s.foo.zone" forward to + match request quick header "Host" value "www.f3s.foo.zone" forward to + match request quick header "Host" value "standby.f3s.foo.zone" forward to + match request quick header "Host" value "anki.f3s.foo.zone" forward to + match request quick header "Host" value "www.anki.f3s.foo.zone" forward to + match request quick header "Host" value "standby.anki.f3s.foo.zone" forward to + match request quick header "Host" value "bag.f3s.foo.zone" forward to + match request quick header "Host" value "www.bag.f3s.foo.zone" forward to + match request quick header "Host" value "standby.bag.f3s.foo.zone" forward to + match request quick header "Host" value "flux.f3s.foo.zone" forward to + match request quick header "Host" value "www.flux.f3s.foo.zone" forward to + match request quick header "Host" value "standby.flux.f3s.foo.zone" forward to + match request quick header "Host" value "audiobookshelf.f3s.foo.zone" forward to + match request quick header "Host" value "www.audiobookshelf.f3s.foo.zone" forward to + match request quick header "Host" value "standby.audiobookshelf.f3s.foo.zone" forward to + match request quick header "Host" value "gpodder.f3s.foo.zone" forward to + match request quick header "Host" value "www.gpodder.f3s.foo.zone" forward to + match request quick header "Host" value "standby.gpodder.f3s.foo.zone" forward to + match request quick header "Host" value "radicale.f3s.foo.zone" forward to + match request quick header "Host" value "www.radicale.f3s.foo.zone" forward to + match request quick header "Host" value "standby.radicale.f3s.foo.zone" forward to + match request quick header "Host" value "vault.f3s.foo.zone" forward to + match request quick header "Host" value "www.vault.f3s.foo.zone" forward to + match request quick header "Host" value "standby.vault.f3s.foo.zone" forward to + match request quick header "Host" value "syncthing.f3s.foo.zone