jamo

stellar-fighter

간단하게 keybase를 이용해 PGP 키 생성 및 비밀키를 백업할 수 있다


spring-boot-integration-test-for-library

https://stackoverflow.com/questions/40967162/what-is-the-meaning-of-0-somefunction-in-javascript


js-comma-operator


inheritance와 generics간의 적절한 사용. 를 쓰느냐 그냥 A만을 멤버변수 / 파라미터로 쓰느냐에 대한 고민
API서버 request / response 에서의 다형성.. 써보면 편할 것 같지만 생각보다 코드가 더 복잡해진다, API 서버에서의 다형성이 바람직한가? 만약 그렇다면 항상 바람직한가? 이로 인해 생기게되는 switch/case를 최소화 하거나 피할 방법은?
ID의 데이터 타입으로써 Long vs Int (개인적으로는 Long 선호)



thoughts

Generate private/public key pair for master and worker nodes
$ umask 077
$ wg genkey > privatekey
$ wg pubkey < privatekey > publickey

Master node /etc/wireguard/wg0.conf
[Interface]
#SaveConfig = true
Address = 192.168.1.1/24
PrivateKey = <MASTER NODE PRIVATE KEY>
DNS = 8.8.8.8
ListenPort = 55555
PostUp = /etc/wireguard/helpers/add-nat-routing.sh
PostDown = /etc/wireguard/helpers/remove-nat-routing.sh

[Peer]
PublicKey = <WORKER1 NODE PUBLIC KEY>
AllowedIPs = 192.168.1.2/32

[Peer]
PublicKey = <WORKER2 NODE PUBLIC KEY>
AllowedIPs = 192.168.1.3/32

Master node add-nat-routing.sh
#!/bin/bash
IPT="/sbin/iptables"
#IPT6="/sbin/ip6tables"

IN_FACE="enp0s3"                   # NIC connected to the internet
WG_FACE="wg0"                    # WG NIC
SUB_NET="192.168.1.0/24"          # WG IPv4 sub/net aka CIDR
WG_PORT="55555"                  # WG udp port
#SUB_NET_6="fd42:42:42::/64"      # WG IPv6 sub/net

## IPv4 ##
$IPT -t nat -I POSTROUTING 1 -s $SUB_NET -o $IN_FACE -j MASQUERADE
$IPT -I INPUT 1 -i $WG_FACE -j ACCEPT
$IPT -I FORWARD 1 -i $IN_FACE -o $WG_FACE -j ACCEPT
$IPT -I FORWARD 1 -i $WG_FACE -o $IN_FACE -j ACCEPT
$IPT -I INPUT 1 -i $IN_FACE -p udp --dport $WG_PORT -j ACCEPT

## IPv6 (Uncomment) ##
#$IPT6 -t nat -I POSTROUTING 1 -s $SUB_NET_6 -o $IN_FACE -j MASQUERADE
#$IPT6 -I INPUT 1 -i $WG_FACE -j ACCEPT
#$IPT6 -I FORWARD 1 -i $IN_FACE -o $WG_FACE -j ACCEPT
#$IPT6 -I FORWARD 1 -i $WG_FACE -o $IN_FACE -j ACCEPT

Master node remove-nat-routing.sh
#!/bin/bash
IPT="/sbin/iptables"
#IPT6="/sbin/ip6tables"

IN_FACE="enp0s3"                   # NIC connected to the internet
WG_FACE="wg0"                    # WG NIC
SUB_NET="192.168.1.0/24"          # WG IPv4 sub/net aka CIDR
WG_PORT="55555"                  # WG udp port
#SUB_NET_6="fd42:42:42::/64"      # WG IPv6 sub/net

# IPv4 rules #
$IPT -t nat -D POSTROUTING -s $SUB_NET -o $IN_FACE -j MASQUERADE
$IPT -D INPUT -i $WG_FACE -j ACCEPT
$IPT -D FORWARD -i $IN_FACE -o $WG_FACE -j ACCEPT
$IPT -D FORWARD -i $WG_FACE -o $IN_FACE -j ACCEPT
$IPT -D INPUT -i $IN_FACE -p udp --dport $WG_PORT -j ACCEPT

# IPv6 rules (uncomment) #
#$IPT6 -t nat -D POSTROUTING -s $SUB_NET_6 -o $IN_FACE -j MASQUERADE
#$IPT6 -D INPUT -i $WG_FACE -j ACCEPT
#$IPT6 -D FORWARD -i $IN_FACE -o $WG_FACE -j ACCEPT
#$IPT6 -D FORWARD -i $WG_FACE -o $IN_FACE -j ACCEPT

Worker1 node /etc/wireguard/wg0.conf
[Interface]
PrivateKey = <WORKER1 NODE PRIVATE KEY>
Address = 192.168.1.2/24
ListenPort = 51822
DNS = 8.8.8.8

[Peer]
PublicKey = <MASTER NODE PUBLIC KEY>
EndPoint = master-1.gonnux.com:55555 # You can also use ip address instead of domain address
# AllowedIps = 192.168.1.0/24 # This allows the worker to access to 192.168.1.* addresses through VPN, The worker still can connect to the public internet, but not through VPN
AllowedIps = 0.0.0.0/0, ::/0 # This allows the worker to access to the public internet through VPN

Activate wireguard from both side using this command
wg-quick up wg0

https://prog.world/free-oracle-cloud-servers-mikrotik-site-to-site-vpn/
https://learnoci.cloud/how-to-create-a-site-to-site-vpn-between-oracle-cloud-infrastructure-and-ubiquity-dream-machine-908353a51bd3
https://serverfault.com/questions/1076995/routing-only-the-private-network-in-wireguard-vpn
https://www.reddit.com/r/WireGuard/comments/lsccq8/link_2_separate_networks_using_wireguard_and_linux/
https://github.com/mjtechguy/wireguard-site-to-site
https://www.procustodibus.com/blog/2020/12/wireguard-site-to-site-config/
https://ziwon.github.io/post/wireguard/
https://www.reddit.com/r/WireGuard/comments/fo6czc/wireguard_service_wont_start_on_ubuntu_after/


oracle-cloud-vpn

https://marmelab.com/blog/2022/02/27/mui-v5-rocks.html
https://velog.io/@dear/next.js%EC%97%90%EC%84%9C-material-ui-%EC%82%AC%EC%9A%A9%ED%95%98%EA%B8%B0


migrate-to-mui-v5

test

Disclaimer: This article is WIP
Goal & Problems

When pushing to the blog repo, the docker image should be built automatically
When pushing to the blog repo, the k8s deployment should be updated automatically

Build

There are two repos: gonnux/gonnux.com-blog and gonnux/gonnux.com-site
First one is a collection of blog post markdown files.
Second one is NextJS project and this is built statically from markdown files from first repo.

blog 레포 에서 site 레포를 submodule로 사용하고 docker image 도 이쪽에서만 빌드한다면?
blog 레포는 더이상 블로그 포스트로써만 사용하는 것이 아니라 site레포가 필요로 하는 데이터를 제공하도록 한다면?
gonnux.com-site 레포(nextjs app)는 도커 이미지로 사용하기에 부적합하다고 판단
뭐어쨌든 결국은 gonnux.com-site 와 gonnux.com-site-data로 레포 분리
전자는 순수한 nextjs 코드만
후자는 블로그 포스트들, config.yaml, Dockerfile, 도커 이미지 빌드를 위한git workflow file이 있다
여기까지해서 이미지 자동 빌드 및 docker hub 업로드는 성공
이제 docker hub에 업로드 되는 최신 이미지를 k8s 클러스터에서 deployment를 업데이트 해줘야함
생각해본 방법들
git workflow 에서 ssh 접속후 kubectl 로 직접 배포 -> 보안상으로 매우 부적절한 방법인듯
jenkins -> 한국어로 검색하면 jenkins를 많이 이용하는 것을 알 수 있다.
다만 대부분 docker image 빌드부터 deployment 배포까지 jenkins에서 해결하고 있다
docker registry를 체크하고 deployment만 배포하는데 jenkins는 너무 과한거 아닌가 생각중
argocd -> argocd는 기본적으로 k8s yml 파일의 변경만을 감지하는 것 같다.. 따라서 이번 목적이랑 잘 안맞는것 같은데 확실하지 않음
gitkube:
이 경우 push 시 gitkube쪽에서 빌드 및 배포를 다 해버리기 때문에 이미지 빌드가 따로 분리되어있는 현 상황과 맞지 않는다
webhook: docker hub에서 webhook을 설정하고
https://github.com/adnanh/webhook 과 같은 webhook callback server 를 이용하여 webhook 요청을 받아 kubectl 커맨드 실행하여 재배포
tekton:?
keel: poll 방식과 webhook 방식 지원, docker image 변경시 자동 배포에 초첨이 맞춰져있다
현재 설치 시 sunstone.dev 를 접속해야하는데 접속이 안됨
helm으로 설치 시도했는데 arm64 이미지가 없는듯 함 (exec format error)
fluxcd:
fluxcd도 이미지 업데이트 기능을 지원하는데 설정방법이 꽤 복잡해보임

결국은 일단 webhook server를 이용
스크립트는 단순하게 이렇게 작성
kubectl rollout restart deployment <deployment name>

별다른 인증 과정이 없기 때문에 webhook의 -urlprefix 옵션을 이용해 url prefix를 토큰처럼 사용..
따라서 url을 노출시키지 않는 것이 중요하기도 함
그리고 docker hub에서 webhook 설정하면 됨
References

https://www.suse.com/c/rancher_blog/continuous-delivery-pipeline-with-webhooks/
https://keel.sh/docs/
https://fluxcd.io/docs/guides/image-update/
https://k3s.rocks/



blog-cd

Oracle cloud always-free plan

Two AMD Compute VMs (1/8 Core and 1 Gigabyte of RAM)
Up to 4 instances of Arm Ampere A1 Compute (4 cores and 24 Gigabytes of RAM in total)
200 GB of Always Free block volume
0 NAT gateways

Limitations

Because NAT gateways are not free, you can't access public internet when your instance is in private VCN
Minimum boot volume size is 50GB, so you can only create 4 instances regardless of the shape
OKE(Oracle Kubernetes Engine) is not free, so you can't use oracle's load balancer in free-tier (alternatively, you can use metallb instead)

The easiest way

create only one instance with maximum resources
use k3s for simplicity and performance (it also has it's own loadbalancer and ingress)

instances
master-1:

Shape: VM.Standard.A1.Flex
OCPU: 4 
RAM: 24GB
Boot Storage: 200GB
In-transit encryption: Enabled
OS: Ubuntu

k3s setup
curl -sfL https://get.k3s.io | sh -

k3s ingress setup
https://www.virtualizationhowto.com/2022/05/traefik-ingress-example-yaml-and-setup-in-k3s/
https setup
https://k3s.rocks/https-cert-manager-letsencrypt/
helm setup (optional)
curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
helm repo add stable https://charts.helm.sh/stable
helm repo update

Add new worker node to the cluster
https://pet2cattle.com/2021/04/k3s-join-nodes
Multi-master cluster
https://sysadmins.co.za/3-node-multimaster-k3s-kubernetes-cluster-with-mysql/
Troubleshootings

Q: Unable to access public internet from private network instances
A: No solution as long as you are in free tier
https://docs.oracle.com/en/learn/nat_gateway_private_compute_instance/index.html#configure-the-nat-gateway
https://community.oracle.com/tech/apps-infra/discussion/4493649/unable-to-create-a-nat-gateway

References

https://medium.com/geekculture/how-to-create-an-always-free-k8s-cluster-in-oracle-cloud-60be3b107c44
https://docs.oracle.com/en-us/iaas/Content/FreeTier/freetier_topic-Always_Free_Resources.htm
https://loganmarchione.com/2022/03/k3s-single-node-cluster-for-noobs/
https://si.mpli.st/dev/2020-01-01-easy-k8s-with-k3s/
https://gruuuuu.github.io/cloud/l-helm-basic/
https://pet2cattle.com/2022/07/install-helm-k3s
https://pgillich.medium.com/setup-lightweight-kubernetes-with-k3s-6a1c57d62217



oracle-cloud-k8s-setup

Architectures of DDD
layered architecture
hexagonal architecture
clean architecture
https://cqrs.nu/Faq
https://www.baeldung.com/hexagonal-architecture-ddd-spring
https://www.baeldung.com/spring-boot-clean-architecture


gonnux.com

Apps

Projects

Articles