From 4d2e2a870fbf5e3ba60fc88f6c7a394baf8ae6db Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Tue, 30 Dec 2025 10:17:31 +0200 Subject: Update content for html --- about/resources.html | 202 ++-- ...5-10-02-f3s-kubernetes-with-freebsd-part-7.html | 171 ++- .../DRAFT-f3s-kubernetes-with-freebsd-part-8b.html | 1132 ++++++++++++++++++++ gemfeed/atom.xml | 175 ++- index.html | 2 +- tags/style-override.css | 0 test-tags.html.tmp | 38 + test-template-tags.html.tmp | 38 + uptime-stats.html | 90 +- 9 files changed, 1635 insertions(+), 213 deletions(-) create mode 100644 gemfeed/DRAFT-f3s-kubernetes-with-freebsd-part-8b.html create mode 100644 tags/style-override.css create mode 100644 test-tags.html.tmp create mode 100644 test-template-tags.html.tmp diff --git a/about/resources.html b/about/resources.html index 417c5142..ec883081 100644 --- a/about/resources.html +++ b/about/resources.html @@ -50,67 +50,67 @@ In random order:


Technical references



I didn't read them from the beginning to the end, but I am using them to look up things. The books are in random order:


Self-development and soft-skills books


@@ -118,44 +118,44 @@ In random order:


Here are notes of mine for some of the books

@@ -165,30 +165,30 @@

Technical guides



These are not whole books, but guides (smaller or larger) which I found very useful. in random order:


Podcasts



@@ -197,32 +197,32 @@ In random order:


Podcasts I liked



I liked them but am not listening to them anymore. The podcasts have either "finished" (no more episodes) or I stopped listening to them due to time constraints or a shift in my interests.


Newsletters I like


@@ -230,26 +230,26 @@ This is a mix of tech and non-tech newsletters I am subscribed to. In random order:


Magazines I like(d)



This is a mix of tech I like(d). I may not be a current subscriber, but now and then, I buy an issue. In random order:


diff --git a/gemfeed/2025-10-02-f3s-kubernetes-with-freebsd-part-7.html b/gemfeed/2025-10-02-f3s-kubernetes-with-freebsd-part-7.html index 25d807c2..b4ae12dd 100644 --- a/gemfeed/2025-10-02-f3s-kubernetes-with-freebsd-part-7.html +++ b/gemfeed/2025-10-02-f3s-kubernetes-with-freebsd-part-7.html @@ -13,7 +13,7 @@

f3s: Kubernetes with FreeBSD - Part 7: k3s and first pod deployments



-Published at 2025-10-02T11:27:19+03:00
+Published at 2025-10-02T11:27:19+03:00, last updated Tue 30 Dec 10:11:58 EET 2025

This is the seventh blog post about the f3s series for my self-hosting demands in a home lab. f3s? The "f" stands for FreeBSD, and the "3s" stands for k3s, the Kubernetes distribution I use on FreeBSD-based physical machines.

@@ -43,6 +43,8 @@
  • ⇢ ⇢ Scaling Traefik for faster failover
  • ⇢ Make it accessible from the public internet
  • ⇢ ⇢ OpenBSD relayd configuration
    • +
  • ⇢ ⇢ Automatic failover when f3s cluster is down
    • +
  • ⇢ ⇢ OpenBSD httpd fallback configuration
  • ⇢ Deploying the private Docker image registry
  • ⇢ ⇢ Prepare the NFS-backed storage
  • ⇢ ⇢ Install (or upgrade) the chart
    • @@ -672,10 +674,11 @@ table <f3s> { }
    -Inside the http protocol "https" block each public hostname gets its Let's Encrypt certificate and is matched to that backend table. Besides the primary trio, every service-specific hostname (anki, bag, flux, audiobookshelf, gpodder, radicale, vault, syncthing, uprecords) and their www / standby aliases reuse the same pool so new apps can go live just by publishing an ingress rule, whereas they will all map to a service running in k3s:
    +Inside the http protocol "https" block each public hostname gets its Let's Encrypt certificate. The protocol configures TLS keypairs for all f3s services and other public endpoints. For f3s hosts specifically, there are no explicit forward to rules in the protocol—they use the relay-level failover mechanism described later. Non-f3s hosts get explicit localhost routing to prevent them from trying the f3s backends:

     http protocol "https" {
+    # TLS certificates for all f3s services
     tls keypair f3s.foo.zone
     tls keypair www.f3s.foo.zone
     tls keypair standby.f3s.foo.zone
@@ -707,36 +710,15 @@ http protocol "https" {
     tls keypair www.uprecords.f3s.foo.zone
     tls keypair standby.uprecords.f3s.foo.zone
 
-    match request quick header "Host" value "f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "www.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "standby.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "anki.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "www.anki.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "standby.anki.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "bag.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "www.bag.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "standby.bag.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "flux.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "www.flux.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "standby.flux.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "audiobookshelf.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "www.audiobookshelf.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "standby.audiobookshelf.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "gpodder.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "www.gpodder.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "standby.gpodder.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "radicale.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "www.radicale.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "standby.radicale.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "vault.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "www.vault.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "standby.vault.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "syncthing.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "www.syncthing.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "standby.syncthing.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "uprecords.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "www.uprecords.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "standby.uprecords.f3s.foo.zone" forward to <f3s>
+    # Explicitly route non-f3s hosts to localhost
+    match request header "Host" value "foo.zone" forward to <localhost>
+    match request header "Host" value "www.foo.zone" forward to <localhost>
+    match request header "Host" value "dtail.dev" forward to <localhost>
+    # ... other non-f3s hosts ...
+
+    # NOTE: f3s hosts have NO match rules here!
+    # They use relay-level failover (f3s -> localhost backup)
+    # See the relay configuration below for automatic failover details
 }

    @@ -746,18 +728,143 @@ http protocol "https" { relay "https4" { listen on 46.23.94.99 port 443 tls protocol "https" + # Primary: f3s cluster (with health checks) - Falls back to localhost when all hosts down forward to <f3s> port 80 check tcp + forward to <localhost> port 8080 } relay "https6" { listen on 2a03:6000:6f67:624::99 port 443 tls protocol "https" + # Primary: f3s cluster (with health checks) - Falls back to localhost when all hosts down forward to <f3s> port 80 check tcp + forward to <localhost> port 8080 }
    In practice, that means relayd terminates TLS with the correct certificate, keeps the three WireGuard-connected backends in rotation, and ships each request to whichever bhyve VM answers first.

    +

    Automatic failover when f3s cluster is down


    +
    +Update: This section was added at Tue 30 Dec 10:11:44 EET 2025
    +
    +One important aspect of this setup is graceful degradation: when all three f3s nodes are unreachable (e.g., during maintenance or a power outage in my LAN), users should see a friendly status page instead of an error message.
    +
    +OpenBSD's relayd supports automatic failover through its health check mechanism. According to the relayd.conf manual:
    +
    +This directive can be specified multiple times - subsequent entries will be used as the backup table if all hosts in the previous table are down.
    +
    +The key is the order of forward to statements in the relay configuration. By placing the f3s table first with check tcp health checks, followed by localhost as a backup, relayd automatically routes traffic based on backend availability:
    +
    +When f3s cluster is UP:
    +
    +
    +When f3s cluster is DOWN:
    +
    +
    +
    +# NEW configuration - supports automatic failover
+http protocol "https" {
+    # Explicitly route non-f3s hosts to localhost
+    match request header "Host" value "foo.zone" forward to <localhost>
+    match request header "Host" value "dtail.dev" forward to <localhost>
+    # ... other non-f3s hosts ...
+
+    # f3s hosts have NO protocol rules - they use relay-level failover
+    # (no match rules for f3s.foo.zone, anki.f3s.foo.zone, etc.)
+}
+
+relay "https4" {
+    # f3s FIRST (with health checks), localhost as BACKUP
+    forward to <f3s> port 80 check tcp
+    forward to <localhost> port 8080
+}
+
    +
    +This way, f3s traffic uses the relay's default behavior: try the first table, fall back to the second when health checks fail.
    +
    +

    OpenBSD httpd fallback configuration


    +
    +The localhost httpd service on port 8080 serves the fallback content from /var/www/htdocs/f3s_fallback/. This directory contains a simple HTML page explaining the situation:
    +
    +
    +# OpenBSD httpd.conf
+# Fallback for f3s hosts
+server "f3s.foo.zone" {
+  listen on * port 8080
+  log style forwarded
+  location * {
+    root "/htdocs/f3s_fallback"
+    directory auto index
+  }
+}
+
+server "anki.f3s.foo.zone" {
+  listen on * port 8080
+  log style forwarded
+  location * {
+    root "/htdocs/f3s_fallback"
+    directory auto index
+  }
+}
+
+# ... similar blocks for all f3s hostnames ...
+
    +
    +The fallback page itself is straightforward:
    +
    + +
    <!DOCTYPE html>
+<html>
+<head>
+    <title>Server turned off</title>
+    <style>
+        body {
+            font-family: sans-serif;
+            text-align: center;
+            padding-top: 50px;
+        }
+        .container {
+            max-width: 600px;
+            margin: 0 auto;
+        }
+    </style>
+</head>
+<body>
+    <div class="container">
+        <h1>Server turned off</h1>
+        <p>The servers are all currently turned off.</p>
+        <p>Please try again later.</p>
+        <p>Or email <a href="mailto:paul@nospam.buetow.org">paul@nospam.buetow.org</a>
+           - so I can turn them back on for you!</p>
+    </div>
+</body>
+</html>
+
    +
    +This approach provides several benefits:
    +
    +
    +This fallback mechanism has proven invaluable during maintenance windows and unexpected outages, ensuring that users always get a response even when the home lab is offline.
    +

    Deploying the private Docker image registry



    As not all Docker images I want to deploy are available on public Docker registries and as I also build some of them by myself, there is the need of a private registry.
    diff --git a/gemfeed/DRAFT-f3s-kubernetes-with-freebsd-part-8b.html b/gemfeed/DRAFT-f3s-kubernetes-with-freebsd-part-8b.html new file mode 100644 index 00000000..d598c631 --- /dev/null +++ b/gemfeed/DRAFT-f3s-kubernetes-with-freebsd-part-8b.html @@ -0,0 +1,1132 @@ + + + + +f3s: Kubernetes with FreeBSD - Part 9: Enabling etcd Metrics + + + + + +

    +Home | Markdown | Gemini +

    +

    f3s: Kubernetes with FreeBSD - Part 9: Enabling etcd Metrics


    +
    +

    Introduction


    +
    +This post covers enabling etcd metrics monitoring for the k3s cluster. The etcd dashboard in Grafana initially showed no data because k3s uses an embedded etcd that doesn't expose metrics by default.
    +
    +Part 8: Observability
    +
    +

    Enabling etcd metrics in k3s


    +
    +On each control-plane node (r0, r1, r2), create /etc/rancher/k3s/config.yaml:
    +
    +
    +etcd-expose-metrics: true
+
    +
    +Then restart k3s on each node:
    +
    +
    +systemctl restart k3s
+
    +
    +After restarting, etcd metrics are available on port 2381:
    +
    +
    +curl http://127.0.0.1:2381/metrics | grep etcd
+
    +
    +

    Configuring Prometheus to scrape etcd


    +
    +In persistence-values.yaml, enable kubeEtcd with the node IP addresses:
    +
    +
    +kubeEtcd:
+  enabled: true
+  endpoints:
+    - 192.168.1.120
+    - 192.168.1.121
+    - 192.168.1.122
+  service:
+    enabled: true
+    port: 2381
+    targetPort: 2381
+
    +
    +Apply the changes:
    +
    +
    +just upgrade
+
    +
    +

    Verifying etcd metrics


    +
    +After the changes, all etcd targets are being scraped:
    +
    +
    +kubectl exec -n monitoring prometheus-prometheus-kube-prometheus-prometheus-0 \
+  -c prometheus -- wget -qO- 'http://localhost:9090/api/v1/query?query=etcd_server_has_leader' | \
+  jq -r '.data.result[] | "\(.metric.instance): \(.value[1])"'
+
    +
    +Output:
    +
    +
    +192.168.1.120:2381: 1
+192.168.1.121:2381: 1
+192.168.1.122:2381: 1
+
    +
    +The etcd dashboard in Grafana now displays metrics including Raft proposals, leader elections, and peer round trip times.
    +
    +

    Complete persistence-values.yaml


    +
    +The complete updated persistence-values.yaml:
    +
    +
    +kubeEtcd:
+  enabled: true
+  endpoints:
+    - 192.168.1.120
+    - 192.168.1.121
+    - 192.168.1.122
+  service:
+    enabled: true
+    port: 2381
+    targetPort: 2381
+
+prometheus:
+  prometheusSpec:
+    additionalScrapeConfigsSecret:
+      enabled: true
+      name: additional-scrape-configs
+      key: additional-scrape-configs.yaml
+    storageSpec:
+      volumeClaimTemplate:
+        spec:
+          storageClassName: ""
+          accessModes: ["ReadWriteOnce"]
+          resources:
+            requests:
+              storage: 10Gi
+          selector:
+            matchLabels:
+              type: local
+              app: prometheus
+
+grafana:
+  persistence:
+    enabled: true
+    type: pvc
+    existingClaim: "grafana-data-pvc"
+
+  initChownData:
+    enabled: false
+
+  podSecurityContext:
+    fsGroup: 911
+    runAsUser: 911
+    runAsGroup: 911
+
    +
    +

    ZFS Monitoring for FreeBSD Servers


    +
    +The FreeBSD servers (f0, f1, f2) that provide NFS storage to the k3s cluster have ZFS filesystems. Monitoring ZFS performance is crucial for understanding storage performance and cache efficiency.
    +
    +

    Node Exporter ZFS Collector


    +
    +The node_exporter running on each FreeBSD server (v1.9.1) includes a built-in ZFS collector that exposes metrics via sysctls. The ZFS collector is enabled by default and provides:
    +
    +
    +

    Verifying ZFS Metrics


    +
    +On any FreeBSD server, check that ZFS metrics are being exposed:
    +
    +
    +paul@f0:~ % curl -s http://localhost:9100/metrics | grep node_zfs_arcstats | wc -l
+      69
+
    +
    +The metrics are automatically scraped by Prometheus through the existing static configuration in additional-scrape-configs.yaml which targets all FreeBSD servers on port 9100 with the os: freebsd label.
    +
    +

    ZFS Recording Rules


    +
    +Created recording rules for easier dashboard consumption in zfs-recording-rules.yaml:
    +
    +
    +apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: freebsd-zfs-rules
+  namespace: monitoring
+  labels:
+    release: prometheus
+spec:
+  groups:
+    - name: freebsd-zfs-arc
+      interval: 30s
+      rules:
+        - record: node_zfs_arc_hit_rate_percent
+          expr: |
+            100 * (
+              rate(node_zfs_arcstats_hits_total{os="freebsd"}[5m]) /
+              (rate(node_zfs_arcstats_hits_total{os="freebsd"}[5m]) +
+               rate(node_zfs_arcstats_misses_total{os="freebsd"}[5m]))
+            )
+          labels:
+            os: freebsd
+        - record: node_zfs_arc_memory_usage_percent
+          expr: |
+            100 * (
+              node_zfs_arcstats_size_bytes{os="freebsd"} /
+              node_zfs_arcstats_c_max_bytes{os="freebsd"}
+            )
+          labels:
+            os: freebsd
+        # Additional rules for metadata %, target %, MRU/MFU %, etc.
+
    +
    +These recording rules calculate:
    +
    +
    +

    Grafana Dashboards


    +
    +Created two comprehensive ZFS monitoring dashboards (zfs-dashboards.yaml):
    +
    +**Dashboard 1: FreeBSD ZFS (per-host detailed view)**
    +
    +Includes variables to select:
    +
    +**Pool Overview Row:**
    +
    +**Dataset Statistics Row:**
    +
    +**ARC Cache Statistics Row:**
    +
    +**Dashboard 2: FreeBSD ZFS Summary (cluster-wide overview)**
    +
    +**Cluster-Wide Pool Statistics Row:**
    +
    +**Per-Host Pool Breakdown Row:**
    +
    +**Cluster-Wide ARC Statistics Row:**
    +
    +**Dashboard Visualization:**
    +
    +ZFS monitoring dashboard in Grafana showing pool statistics and ARC cache metrics
    +
    +

    Deployment


    +
    +Applied the resources to the cluster:
    +
    +
    +cd /home/paul/git/conf/f3s/prometheus
+kubectl apply -f zfs-recording-rules.yaml
+kubectl apply -f zfs-dashboards.yaml
+
    +
    +Updated Justfile to include ZFS recording rules in install and upgrade targets:
    +
    +
    +install:
+    kubectl apply -f persistent-volumes.yaml
+    kubectl create secret generic additional-scrape-configs --from-file=additional-scrape-configs.yaml -n monitoring --dry-run=client -o yaml | kubectl apply -f -
+    helm install prometheus prometheus-community/kube-prometheus-stack --namespace monitoring -f persistence-values.yaml
+    kubectl apply -f freebsd-recording-rules.yaml
+    kubectl apply -f openbsd-recording-rules.yaml
+    kubectl apply -f zfs-recording-rules.yaml
+    just -f grafana-ingress/Justfile install
+
    +
    +

    Verifying ZFS Metrics in Prometheus


    +
    +Check that ZFS metrics are being collected:
    +
    +
    +kubectl exec -n monitoring prometheus-prometheus-kube-prometheus-prometheus-0 -c prometheus -- \
+  wget -qO- 'http://localhost:9090/api/v1/query?query=node_zfs_arcstats_size_bytes'
+
    +
    +Check recording rules are calculating correctly:
    +
    +
    +kubectl exec -n monitoring prometheus-prometheus-kube-prometheus-prometheus-0 -c prometheus -- \
+  wget -qO- 'http://localhost:9090/api/v1/query?query=node_zfs_arc_memory_usage_percent'
+
    +
    +Example output shows memory usage percentage for each FreeBSD server:
    +
    +
    +"result":[
+  {"metric":{"instance":"192.168.2.130:9100","os":"freebsd"},"value":[...,"37.58"]},
+  {"metric":{"instance":"192.168.2.131:9100","os":"freebsd"},"value":[...,"12.85"]},
+  {"metric":{"instance":"192.168.2.132:9100","os":"freebsd"},"value":[...,"13.44"]}
+]
+
    +
    +

    Accessing the Dashboards


    +
    +The dashboards are automatically imported by the Grafana sidecar and accessible at:
    +
    +https://grafana.f3s.buetow.org
    +
    +Navigate to Dashboards and search for:
    +
    +

    Key Metrics to Monitor


    +
    +**ARC Hit Rate:** Should typically be above 90% for optimal performance. Lower hit rates indicate the ARC cache is too small or workload has poor locality.
    +
    +**ARC Memory Usage:** Shows how much of the maximum ARC size is being used. If consistently at or near maximum, the ARC is effectively utilizing available memory.
    +
    +**Data vs Metadata:** Typically data should dominate, but workloads with many small files will show higher metadata percentages.
    +
    +**MRU vs MFU:** Most Recently Used vs Most Frequently Used cache. The ratio depends on workload characteristics.
    +
    +**Pool Capacity:** Monitor pool usage to ensure adequate free space. ZFS performance degrades when pools exceed 80% capacity.
    +
    +**Pool Health:** Should always show ONLINE (green). DEGRADED (yellow) indicates a disk issue requiring attention. FAULTED (red) requires immediate action.
    +
    +**Dataset Usage:** Track which datasets are consuming the most space to identify growth trends and plan capacity.
    +
    +

    ZFS Pool and Dataset Metrics via Textfile Collector


    +
    +To complement the ARC statistics from node_exporter's built-in ZFS collector, I added pool capacity and dataset metrics using the textfile collector feature.
    +
    +Created a script at /usr/local/bin/zfs_pool_metrics.sh on each FreeBSD server:
    +
    +
    +#!/bin/sh
+# ZFS Pool and Dataset Metrics Collector for Prometheus
+
+OUTPUT_FILE="/var/tmp/node_exporter/zfs_pools.prom.$$"
+FINAL_FILE="/var/tmp/node_exporter/zfs_pools.prom"
+
+mkdir -p /var/tmp/node_exporter
+
+{
+    # Pool metrics
+    echo "# HELP zfs_pool_size_bytes Total size of ZFS pool"
+    echo "# TYPE zfs_pool_size_bytes gauge"
+    echo "# HELP zfs_pool_allocated_bytes Allocated space in ZFS pool"
+    echo "# TYPE zfs_pool_allocated_bytes gauge"
+    echo "# HELP zfs_pool_free_bytes Free space in ZFS pool"
+    echo "# TYPE zfs_pool_free_bytes gauge"
+    echo "# HELP zfs_pool_capacity_percent Capacity percentage"
+    echo "# TYPE zfs_pool_capacity_percent gauge"
+    echo "# HELP zfs_pool_health Pool health (0=ONLINE, 1=DEGRADED, 2=FAULTED)"
+    echo "# TYPE zfs_pool_health gauge"
+
+    zpool list -Hp -o name,size,allocated,free,capacity,health | \
+    while IFS=$'\t' read name size alloc free cap health; do
+        case "$health" in
+            ONLINE)   health_val=0 ;;
+            DEGRADED) health_val=1 ;;
+            FAULTED)  health_val=2 ;;
+            *)        health_val=6 ;;
+        esac
+        cap_num=$(echo "$cap" | sed 's/%//')
+
+        echo "zfs_pool_size_bytes{pool=\"$name\"} $size"
+        echo "zfs_pool_allocated_bytes{pool=\"$name\"} $alloc"
+        echo "zfs_pool_free_bytes{pool=\"$name\"} $free"
+        echo "zfs_pool_capacity_percent{pool=\"$name\"} $cap_num"
+        echo "zfs_pool_health{pool=\"$name\"} $health_val"
+    done
+
+    # Dataset metrics
+    echo "# HELP zfs_dataset_used_bytes Used space in dataset"
+    echo "# TYPE zfs_dataset_used_bytes gauge"
+    echo "# HELP zfs_dataset_available_bytes Available space"
+    echo "# TYPE zfs_dataset_available_bytes gauge"
+    echo "# HELP zfs_dataset_referenced_bytes Referenced space"
+    echo "# TYPE zfs_dataset_referenced_bytes gauge"
+
+    zfs list -Hp -t filesystem -o name,used,available,referenced | \
+    while IFS=$'\t' read name used avail ref; do
+        pool=$(echo "$name" | cut -d/ -f1)
+        echo "zfs_dataset_used_bytes{pool=\"$pool\",dataset=\"$name\"} $used"
+        echo "zfs_dataset_available_bytes{pool=\"$pool\",dataset=\"$name\"} $avail"
+        echo "zfs_dataset_referenced_bytes{pool=\"$pool\",dataset=\"$name\"} $ref"
+    done
+} > "$OUTPUT_FILE"
+
+mv "$OUTPUT_FILE" "$FINAL_FILE"
+
    +
    +Deployed to all FreeBSD servers:
    +
    +
    +for host in f0 f1 f2; do
+    scp /tmp/zfs_pool_metrics.sh paul@$host:/tmp/
+    ssh paul@$host 'doas mv /tmp/zfs_pool_metrics.sh /usr/local/bin/ && \
+                    doas chmod +x /usr/local/bin/zfs_pool_metrics.sh'
+done
+
    +
    +Set up cron jobs to run every minute:
    +
    +
    +for host in f0 f1 f2; do
+    ssh paul@$host 'echo "* * * * * /usr/local/bin/zfs_pool_metrics.sh >/dev/null 2>&1" | \
+                    doas crontab -'
+done
+
    +
    +The textfile collector (already configured with --collector.textfile.directory=/var/tmp/node_exporter) automatically picks up the metrics.
    +
    +Verify metrics are being exposed:
    +
    +
    +paul@f0:~ % curl -s http://localhost:9100/metrics | grep "^zfs_pool" | head -5
+zfs_pool_allocated_bytes{pool="zdata"} 6.47622733824e+11
+zfs_pool_allocated_bytes{pool="zroot"} 5.3338578944e+10
+zfs_pool_capacity_percent{pool="zdata"} 64
+zfs_pool_capacity_percent{pool="zroot"} 10
+zfs_pool_free_bytes{pool="zdata"} 3.48809678848e+11
+
    +
    +

    Summary


    +
    +Enhanced the f3s cluster observability by:
    +
    +
    +The monitoring stack now provides visibility into both cluster control plane health (etcd) and storage performance (ZFS).
    +
    +prometheus configuration on Codeberg
    +
    +

    Distributed Tracing with Grafana Tempo


    +
    +After implementing logs (Loki) and metrics (Prometheus), the final pillar of observability is distributed tracing. Grafana Tempo provides distributed tracing capabilities that help understand request flows across microservices.
    +
    +

    Why Distributed Tracing?


    +
    +In a microservices architecture, a single user request may traverse multiple services. Distributed tracing:
    +
    +
    +

    Deploying Grafana Tempo


    +
    +Tempo is deployed in monolithic mode, following the same pattern as Loki's SingleBinary deployment.
    +
    +#### Configuration Strategy
    +
    +**Deployment Mode:** Monolithic (all components in one process)
    +
    +**Storage:** Filesystem backend using hostPath
    +
    +**OTLP Receivers:** Standard OpenTelemetry Protocol ports
    +
    +#### Tempo Deployment Files
    +
    +Created in /home/paul/git/conf/f3s/tempo/:
    +
    +**values.yaml** - Helm chart configuration:
    +
    +
    +tempo:
+  retention: 168h
+  storage:
+    trace:
+      backend: local
+      local:
+        path: /var/tempo/traces
+      wal:
+        path: /var/tempo/wal
+  receivers:
+    otlp:
+      protocols:
+        grpc:
+          endpoint: 0.0.0.0:4317
+        http:
+          endpoint: 0.0.0.0:4318
+
+persistence:
+  enabled: true
+  size: 10Gi
+  storageClassName: ""
+
+resources:
+  limits:
+    cpu: 1000m
+    memory: 2Gi
+  requests:
+    cpu: 500m
+    memory: 1Gi
+
    +
    +**persistent-volumes.yaml** - Storage configuration:
    +
    +
    +apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: tempo-data-pv
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  hostPath:
+    path: /data/nfs/k3svolumes/tempo/data
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: tempo-data-pvc
+  namespace: monitoring
+spec:
+  storageClassName: ""
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+
    +
    +**Grafana Datasource Provisioning**
    +
    +All Grafana datasources (Prometheus, Alertmanager, Loki, Tempo) are provisioned via a unified ConfigMap that is directly mounted to the Grafana pod. This approach ensures datasources are loaded on startup without requiring sidecar-based discovery.
    +
    +In /home/paul/git/conf/f3s/prometheus/grafana-datasources-all.yaml:
    +
    +
    +apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: grafana-datasources-all
+  namespace: monitoring
+data:
+  datasources.yaml: |
+    apiVersion: 1
+    datasources:
+      - name: Prometheus
+        type: prometheus
+        uid: prometheus
+        url: http://prometheus-kube-prometheus-prometheus.monitoring:9090/
+        access: proxy
+        isDefault: true
+      - name: Alertmanager
+        type: alertmanager
+        uid: alertmanager
+        url: http://prometheus-kube-prometheus-alertmanager.monitoring:9093/
+      - name: Loki
+        type: loki
+        uid: loki
+        url: http://loki.monitoring.svc.cluster.local:3100
+      - name: Tempo
+        type: tempo
+        uid: tempo
+        url: http://tempo.monitoring.svc.cluster.local:3200
+        jsonData:
+          tracesToLogsV2:
+            datasourceUid: loki
+            spanStartTimeShift: -1h
+            spanEndTimeShift: 1h
+          tracesToMetrics:
+            datasourceUid: prometheus
+          serviceMap:
+            datasourceUid: prometheus
+          nodeGraph:
+            enabled: true
+
    +
    +The kube-prometheus-stack Helm values (persistence-values.yaml) are configured to:
    +
    +This direct mounting approach is simpler and more reliable than sidecar-based discovery.
    +
    +#### Installation
    +
    +
    +cd /home/paul/git/conf/f3s/tempo
+just install
+
    +
    +Verify Tempo is running:
    +
    +
    +kubectl get pods -n monitoring -l app.kubernetes.io/name=tempo
+kubectl exec -n monitoring <tempo-pod> -- wget -qO- http://localhost:3200/ready
+
    +
    +

    Configuring Grafana Alloy for Trace Collection


    +
    +Updated /home/paul/git/conf/f3s/loki/alloy-values.yaml to add OTLP receivers for traces while maintaining existing log collection.
    +
    +#### OTLP Receiver Configuration
    +
    +Added to Alloy configuration after the log collection pipeline:
    +
    +
    +// OTLP receiver for traces via gRPC and HTTP
+otelcol.receiver.otlp "default" {
+  grpc {
+    endpoint = "0.0.0.0:4317"
+  }
+  http {
+    endpoint = "0.0.0.0:4318"
+  }
+  output {
+    traces = [otelcol.processor.batch.default.input]
+  }
+}
+
+// Batch processor for efficient trace forwarding
+otelcol.processor.batch "default" {
+  timeout = "5s"
+  send_batch_size = 100
+  send_batch_max_size = 200
+  output {
+    traces = [otelcol.exporter.otlp.tempo.input]
+  }
+}
+
+// OTLP exporter to send traces to Tempo
+otelcol.exporter.otlp "tempo" {
+  client {
+    endpoint = "tempo.monitoring.svc.cluster.local:4317"
+    tls {
+      insecure = true
+    }
+    compression = "gzip"
+  }
+}
+
    +
    +The batch processor reduces network overhead by accumulating spans before forwarding to Tempo.
    +
    +#### Upgrade Alloy
    +
    +
    +cd /home/paul/git/conf/f3s/loki
+just upgrade
+
    +
    +Verify OTLP receivers are listening:
    +
    +
    +kubectl logs -n monitoring -l app.kubernetes.io/name=alloy | grep -i "otlp.*receiver"
+kubectl exec -n monitoring <alloy-pod> -- netstat -ln | grep -E ':(4317|4318)'
+
    +
    +

    Demo Tracing Application


    +
    +Created a three-tier Python application to demonstrate distributed tracing in action.
    +
    +#### Application Architecture
    +
    +
    +User → Frontend (Flask:5000) → Middleware (Flask:5001) → Backend (Flask:5002)
+           ↓                          ↓                        ↓
+                    Alloy (OTLP:4317) → Tempo → Grafana
+
    +
    +**Frontend Service:**
    +
    +**Middleware Service:**
    +
    +**Backend Service:**
    +
    +#### OpenTelemetry Instrumentation
    +
    +All services use Python OpenTelemetry libraries:
    +
    +**Dependencies:**
    +
    +flask==3.0.0
+requests==2.31.0
+opentelemetry-distro==0.49b0
+opentelemetry-exporter-otlp==1.28.0
+opentelemetry-instrumentation-flask==0.49b0
+opentelemetry-instrumentation-requests==0.49b0
+
    +
    +**Auto-instrumentation pattern** (used in all services):
    +
    + +
    from opentelemetry import trace
+from opentelemetry.sdk.trace import TracerProvider
+from opentelemetry.exporter.otlp.proto.grpc.trace_exporter import OTLPSpanExporter
+from opentelemetry.instrumentation.flask import FlaskInstrumentor
+from opentelemetry.instrumentation.requests import RequestsInstrumentor
+from opentelemetry.sdk.resources import Resource
+
+# Define service identity
+resource = Resource(attributes={
+    "service.name": "frontend",
+    "service.namespace": "tracing-demo",
+    "service.version": "1.0.0"
+})
+
+provider = TracerProvider(resource=resource)
+
+# Export to Alloy
+otlp_exporter = OTLPSpanExporter(
+    endpoint="http://alloy.monitoring.svc.cluster.local:4317",
+    insecure=True
+)
+
+processor = BatchSpanProcessor(otlp_exporter)
+provider.add_span_processor(processor)
+trace.set_tracer_provider(provider)
+
+# Auto-instrument Flask and requests
+FlaskInstrumentor().instrument_app(app)
+RequestsInstrumentor().instrument()
+
    +
    +The auto-instrumentation automatically:
    +
    +#### Deployment
    +
    +Created Helm chart in /home/paul/git/conf/f3s/tracing-demo/ with three separate deployments, services, and an ingress.
    +
    +Build and deploy:
    +
    +
    +cd /home/paul/git/conf/f3s/tracing-demo
+just build
+just import
+just install
+
    +
    +Verify deployment:
    +
    +
    +kubectl get pods -n services | grep tracing-demo
+kubectl get ingress -n services tracing-demo-ingress
+
    +
    +Access the application at:
    +
    +http://tracing-demo.f3s.buetow.org
    +
    +

    Visualizing Traces in Grafana


    +
    +The Tempo datasource is automatically discovered by Grafana through the ConfigMap label.
    +
    +#### Accessing Traces
    +
    +Navigate to Grafana → Explore → Select "Tempo" datasource
    +
    +**Search Interface:**
    +
    +**TraceQL Queries:**
    +
    +Find all traces from demo app:
    +
    +{ resource.service.namespace = "tracing-demo" }
+
    +
    +Find slow requests (>200ms):
    +
    +{ duration > 200ms }
+
    +
    +Find traces from specific service:
    +
    +{ resource.service.name = "frontend" }
+
    +
    +Find errors:
    +
    +{ status = error }
+
    +
    +Complex query - frontend traces calling middleware:
    +
    +{ resource.service.namespace = "tracing-demo" } && { span.http.status_code >= 500 }
+
    +
    +#### Service Graph Visualization
    +
    +The service graph shows visual connections between services:
    +
    +1. Navigate to Explore → Tempo
    +2. Enable "Service Graph" view
    +3. Shows: Frontend → Middleware → Backend with request rates
    +
    +The service graph uses Prometheus metrics generated from trace data.
    +
    +

    Correlation Between Observability Signals


    +
    +Tempo integrates with Loki and Prometheus to provide unified observability.
    +
    +#### Traces-to-Logs
    +
    +Click on any span in a trace to see related logs:
    +
    +1. View trace in Grafana
    +2. Click on a span
    +3. Select "Logs for this span"
    +4. Loki shows logs filtered by:
    + * Time range (span duration ± 1 hour)
    + * Service name
    + * Namespace
    + * Pod
    +
    +This helps correlate what the service was doing when the span was created.
    +
    +#### Traces-to-Metrics
    +
    +View Prometheus metrics for services in the trace:
    +
    +1. View trace in Grafana
    +2. Select "Metrics" tab
    +3. Shows metrics like:
    + * Request rate
    + * Error rate
    + * Duration percentiles
    +
    +#### Logs-to-Traces
    +
    +From logs, you can jump to related traces:
    +
    +1. In Loki, logs that contain trace IDs are automatically linked
    +2. Click the trace ID to view the full trace
    +3. See the complete request flow
    +
    +

    Generating Traces for Testing


    +
    +Test the demo application:
    +
    +
    +curl http://tracing-demo.f3s.buetow.org/api/process
+
    +
    +Load test (generates 50 traces):
    +
    +
    +cd /home/paul/git/conf/f3s/tracing-demo
+just load-test
+
    +
    +Each request creates a distributed trace spanning all three services.
    +
    +

    Verifying the Complete Pipeline


    +
    +Check the trace flow end-to-end:
    +
    +**1. Application generates traces:**
    +
    +kubectl logs -n services -l app=tracing-demo-frontend | grep -i trace
+
    +
    +**2. Alloy receives traces:**
    +
    +kubectl logs -n monitoring -l app.kubernetes.io/name=alloy | grep -i otlp
+
    +
    +**3. Tempo stores traces:**
    +
    +kubectl logs -n monitoring -l app.kubernetes.io/name=tempo | grep -i trace
+
    +
    +**4. Grafana displays traces:**
    +Navigate to Explore → Tempo → Search for traces
    +
    +

    Practical Example: Viewing a Distributed Trace


    +
    +Let's generate a trace and examine it in Grafana.
    +
    +**1. Generate a trace by calling the demo application:**
    +
    +
    +curl -H "Host: tracing-demo.f3s.buetow.org" http://r0/api/process
+
    +
    +**Response (HTTP 200):**
    +
    + +
    {
+  "middleware_response": {
+    "backend_data": {
+      "data": {
+        "id": 12345,
+        "query_time_ms": 100.0,
+        "timestamp": "2025-12-28T18:35:01.064538",
+        "value": "Sample data from backend service"
+      },
+      "service": "backend"
+    },
+    "middleware_processed": true,
+    "original_data": {
+      "source": "GET request"
+    },
+    "transformation_time_ms": 50
+  },
+  "request_data": {
+    "source": "GET request"
+  },
+  "service": "frontend",
+  "status": "success"
+}
+
    +
    +**2. Find the trace in Tempo via API:**
    +
    +After a few seconds (for batch export), search for recent traces:
    +
    +
    +kubectl exec -n monitoring tempo-0 -- wget -qO- \
+  'http://localhost:3200/api/search?tags=service.namespace%3Dtracing-demo&limit=5' 2>/dev/null | \
+  python3 -m json.tool
+
    +
    +Returns traces including:
    +
    + +
    {
+  "traceID": "4be1151c0bdcd5625ac7e02b98d95bd5",
+  "rootServiceName": "frontend",
+  "rootTraceName": "GET /api/process",
+  "durationMs": 221
+}
+
    +
    +**3. Fetch complete trace details:**
    +
    +
    +kubectl exec -n monitoring tempo-0 -- wget -qO- \
+  'http://localhost:3200/api/traces/4be1151c0bdcd5625ac7e02b98d95bd5' 2>/dev/null | \
+  python3 -m json.tool
+
    +
    +**Trace structure (8 spans across 3 services):**
    +
    +
    +Trace ID: 4be1151c0bdcd5625ac7e02b98d95bd5
+Services: 3 (frontend, middleware, backend)
+
+Service: frontend
+  └─ GET /api/process                 221.10ms  (HTTP server span)
+  └─ frontend-process                 216.23ms  (custom business logic span)
+  └─ POST                             209.97ms  (HTTP client span to middleware)
+
+Service: middleware
+  └─ POST /api/transform              186.02ms  (HTTP server span)
+  └─ middleware-transform             180.96ms  (custom business logic span)
+  └─ GET                              127.52ms  (HTTP client span to backend)
+
+Service: backend
+  └─ GET /api/data                    103.93ms  (HTTP server span)
+  └─ backend-get-data                 102.11ms  (custom business logic span with 100ms sleep)
+
    +
    +**4. View the trace in Grafana UI:**
    +
    +Navigate to: Grafana → Explore → Tempo datasource
    +
    +Search using TraceQL:
    +
    +{ resource.service.namespace = "tracing-demo" }
+
    +
    +Or directly open the trace by pasting the trace ID in the search box:
    +
    +4be1151c0bdcd5625ac7e02b98d95bd5
+
    +
    +**5. Trace visualization:**
    +
    +The trace waterfall view in Grafana shows the complete request flow with timing:
    +
    +Distributed trace visualization in Grafana Tempo showing Frontend → Middleware → Backend spans
    +
    +For additional examples of Tempo trace visualization, see also:
    +
    +X-RAG Observability Hackathon (more Grafana Tempo screenshots)
    +
    +The trace reveals the distributed request flow:
    +
    +**6. Service graph visualization:**
    +
    +The service graph is automatically generated from traces and shows service dependencies. For examples of service graph visualization in Grafana, see the screenshots in the X-RAG Observability Hackathon blog post.
    +
    +X-RAG Observability Hackathon (includes service graph screenshots)
    +
    +This visualization helps identify:
    +
    +

    Storage and Retention


    +
    +Monitor Tempo storage usage:
    +
    +
    +kubectl exec -n monitoring <tempo-pod> -- df -h /var/tempo
+
    +
    +With 10Gi storage and 7-day retention, the system handles moderate trace volumes. If storage fills up:
    +
    +
    +

    Complete Observability Stack


    +
    +The f3s cluster now has complete observability:
    +
    +**Metrics** (Prometheus):
    +
    +**Logs** (Loki):
    +
    +**Traces** (Tempo):
    +
    +**Visualization** (Grafana):
    +
    +

    Configuration Files


    +
    +All configuration files are available on Codeberg:
    +
    +Tempo configuration
    +Alloy configuration (updated for traces)
    +Demo tracing application
    +

    + Generated with Gemtexter 3.0.1-develop | + served by OpenBSD/relayd(8)+httpd(8) | + Site Mirrors +
    + Webring: previous | shring | next +

    + + diff --git a/gemfeed/atom.xml b/gemfeed/atom.xml index 7e7f3733..09efca2f 100644 --- a/gemfeed/atom.xml +++ b/gemfeed/atom.xml @@ -1,6 +1,6 @@ - 2025-12-26T23:33:35+02:00 + 2025-12-30T10:15:58+02:00 foo.zone feed To be in the .zone! @@ -2579,7 +2579,7 @@ p hash.values_at(:a, :c) f3s: Kubernetes with FreeBSD - Part 7: k3s and first pod deployments https://foo.zone/gemfeed/2025-10-02-f3s-kubernetes-with-freebsd-part-7.html - 2025-10-02T11:27:19+03:00 + 2025-10-02T11:27:19+03:00, last updated Tue 30 Dec 10:11:58 EET 2025 Paul Buetow aka snonux paul@dev.buetow.org @@ -2589,7 +2589,7 @@ p hash.values_at(:a, :c)

    f3s: Kubernetes with FreeBSD - Part 7: k3s and first pod deployments



    -Published at 2025-10-02T11:27:19+03:00
    +Published at 2025-10-02T11:27:19+03:00, last updated Tue 30 Dec 10:11:58 EET 2025

    This is the seventh blog post about the f3s series for my self-hosting demands in a home lab. f3s? The "f" stands for FreeBSD, and the "3s" stands for k3s, the Kubernetes distribution I use on FreeBSD-based physical machines.

    @@ -2619,6 +2619,8 @@ p hash.values_at(:a, :c)
  • ⇢ ⇢ Scaling Traefik for faster failover
  • ⇢ Make it accessible from the public internet
  • ⇢ ⇢ OpenBSD relayd configuration
    • +
  • ⇢ ⇢ Automatic failover when f3s cluster is down
    • +
  • ⇢ ⇢ OpenBSD httpd fallback configuration
  • ⇢ Deploying the private Docker image registry
  • ⇢ ⇢ Prepare the NFS-backed storage
  • ⇢ ⇢ Install (or upgrade) the chart
    • @@ -3248,10 +3250,11 @@ table <f3s> { }
    -Inside the http protocol "https" block each public hostname gets its Let's Encrypt certificate and is matched to that backend table. Besides the primary trio, every service-specific hostname (anki, bag, flux, audiobookshelf, gpodder, radicale, vault, syncthing, uprecords) and their www / standby aliases reuse the same pool so new apps can go live just by publishing an ingress rule, whereas they will all map to a service running in k3s:
    +Inside the http protocol "https" block each public hostname gets its Let's Encrypt certificate. The protocol configures TLS keypairs for all f3s services and other public endpoints. For f3s hosts specifically, there are no explicit forward to rules in the protocol—they use the relay-level failover mechanism described later. Non-f3s hosts get explicit localhost routing to prevent them from trying the f3s backends:

     http protocol "https" {
+    # TLS certificates for all f3s services
     tls keypair f3s.foo.zone
     tls keypair www.f3s.foo.zone
     tls keypair standby.f3s.foo.zone
@@ -3283,36 +3286,15 @@ http protocol "https" {
     tls keypair www.uprecords.f3s.foo.zone
     tls keypair standby.uprecords.f3s.foo.zone
 
-    match request quick header "Host" value "f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "www.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "standby.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "anki.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "www.anki.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "standby.anki.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "bag.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "www.bag.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "standby.bag.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "flux.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "www.flux.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "standby.flux.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "audiobookshelf.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "www.audiobookshelf.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "standby.audiobookshelf.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "gpodder.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "www.gpodder.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "standby.gpodder.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "radicale.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "www.radicale.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "standby.radicale.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "vault.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "www.vault.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "standby.vault.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "syncthing.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "www.syncthing.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "standby.syncthing.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "uprecords.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "www.uprecords.f3s.foo.zone" forward to <f3s>
-    match request quick header "Host" value "standby.uprecords.f3s.foo.zone" forward to <f3s>
+    # Explicitly route non-f3s hosts to localhost
+    match request header "Host" value "foo.zone" forward to <localhost>
+    match request header "Host" value "www.foo.zone" forward to <localhost>
+    match request header "Host" value "dtail.dev" forward to <localhost>
+    # ... other non-f3s hosts ...
+
+    # NOTE: f3s hosts have NO match rules here!
+    # They use relay-level failover (f3s -> localhost backup)
+    # See the relay configuration below for automatic failover details
 }

    @@ -3322,18 +3304,143 @@ http protocol "https" { relay "https4" { listen on 46.23.94.99 port 443 tls protocol "https" + # Primary: f3s cluster (with health checks) - Falls back to localhost when all hosts down forward to <f3s> port 80 check tcp + forward to <localhost> port 8080 } relay "https6" { listen on 2a03:6000:6f67:624::99 port 443 tls protocol "https" + # Primary: f3s cluster (with health checks) - Falls back to localhost when all hosts down forward to <f3s> port 80 check tcp + forward to <localhost> port 8080 }
    In practice, that means relayd terminates TLS with the correct certificate, keeps the three WireGuard-connected backends in rotation, and ships each request to whichever bhyve VM answers first.

    +

    Automatic failover when f3s cluster is down


    +
    +Update: This section was added at Tue 30 Dec 10:11:44 EET 2025
    +
    +One important aspect of this setup is graceful degradation: when all three f3s nodes are unreachable (e.g., during maintenance or a power outage in my LAN), users should see a friendly status page instead of an error message.
    +
    +OpenBSD's relayd supports automatic failover through its health check mechanism. According to the relayd.conf manual:
    +
    +This directive can be specified multiple times - subsequent entries will be used as the backup table if all hosts in the previous table are down.
    +
    +The key is the order of forward to statements in the relay configuration. By placing the f3s table first with check tcp health checks, followed by localhost as a backup, relayd automatically routes traffic based on backend availability:
    +
    +When f3s cluster is UP:
    +
    +
      +
    • Health checks on port 80 succeed for f3s nodes
      • +
    • All f3s traffic routes to the Kubernetes cluster
      • +
    • Localhost backup remains idle
      • +

    +When f3s cluster is DOWN:
    +
    +
      +
    • All health checks fail (nodes unreachable)
      • +
    • The <f3s> table becomes unavailable
      • +
    • Traffic automatically falls back to <localhost> on port 8080
      • +
    • OpenBSD's httpd serves a static fallback page
      • +

    +
    +# NEW configuration - supports automatic failover
+http protocol "https" {
+    # Explicitly route non-f3s hosts to localhost
+    match request header "Host" value "foo.zone" forward to <localhost>
+    match request header "Host" value "dtail.dev" forward to <localhost>
+    # ... other non-f3s hosts ...
+
+    # f3s hosts have NO protocol rules - they use relay-level failover
+    # (no match rules for f3s.foo.zone, anki.f3s.foo.zone, etc.)
+}
+
+relay "https4" {
+    # f3s FIRST (with health checks), localhost as BACKUP
+    forward to <f3s> port 80 check tcp
+    forward to <localhost> port 8080
+}
+
    +
    +This way, f3s traffic uses the relay's default behavior: try the first table, fall back to the second when health checks fail.
    +
    +

    OpenBSD httpd fallback configuration


    +
    +The localhost httpd service on port 8080 serves the fallback content from /var/www/htdocs/f3s_fallback/. This directory contains a simple HTML page explaining the situation:
    +
    +
    +# OpenBSD httpd.conf
+# Fallback for f3s hosts
+server "f3s.foo.zone" {
+  listen on * port 8080
+  log style forwarded
+  location * {
+    root "/htdocs/f3s_fallback"
+    directory auto index
+  }
+}
+
+server "anki.f3s.foo.zone" {
+  listen on * port 8080
+  log style forwarded
+  location * {
+    root "/htdocs/f3s_fallback"
+    directory auto index
+  }
+}
+
+# ... similar blocks for all f3s hostnames ...
+
    +
    +The fallback page itself is straightforward:
    +
    + +
    <!DOCTYPE html>
+<html>
+<head>
+    <title>Server turned off</title>
+    <style>
+        body {
+            font-family: sans-serif;
+            text-align: center;
+            padding-top: 50px;
+        }
+        .container {
+            max-width: 600px;
+            margin: 0 auto;
+        }
+    </style>
+</head>
+<body>
+    <div class="container">
+        <h1>Server turned off</h1>
+        <p>The servers are all currently turned off.</p>
+        <p>Please try again later.</p>
+        <p>Or email <a href="mailto:paul@nospam.buetow.org">paul@nospam.buetow.org</a>
+           - so I can turn them back on for you!</p>
+    </div>
+</body>
+</html>
+
    +
    +This approach provides several benefits:
    +
    +
      +
    • Automatic detection: Health checks run continuously; no manual intervention needed
      • +
    • Instant fallback: When all f3s nodes go down, the next request automatically routes to localhost
      • +
    • Transparent recovery: When f3s comes back online, health checks pass and traffic resumes automatically
      • +
    • User experience: Visitors see a helpful message instead of connection errors
      • +
    • No DNS changes: The same hostnames work whether f3s is up or down
      • +

    +This fallback mechanism has proven invaluable during maintenance windows and unexpected outages, ensuring that users always get a response even when the home lab is offline.
    +

    Deploying the private Docker image registry



    As not all Docker images I want to deploy are available on public Docker registries and as I also build some of them by myself, there is the need of a private registry.
    diff --git a/index.html b/index.html index 8ba12792..5393fb25 100644 --- a/index.html +++ b/index.html @@ -13,7 +13,7 @@

    Hello!



    -This site was generated at 2025-12-27T14:56:36+02:00 by Gemtexter
    +This site was generated at 2025-12-30T10:15:58+02:00 by Gemtexter

    Welcome to the foo.zone!

    diff --git a/tags/style-override.css b/tags/style-override.css new file mode 100644 index 00000000..e69de29b diff --git a/test-tags.html.tmp b/test-tags.html.tmp new file mode 100644 index 00000000..cd05ebd2 --- /dev/null +++ b/test-tags.html.tmp @@ -0,0 +1,38 @@ + + + + +%%TITLE%% + + + + + +

    +Home | Markdown | Gemini +

    +

    Test Tags Page


    +
    +This is a test page to demonstrate the tags feature.
    +
    +This page is about #bash, #linux, and #programming.
    +
    +We also talk about #golang and #devops here.
    +
    +

    Code Example


    +
    +
    +# This #tag-in-code-block should be ignored
+echo "Hello World"
+
    +
    +Back to regular content with #testing tag.
    +

    + Generated with %%GEMTEXTER%% | + served by OpenBSD/relayd(8)+httpd(8) | + Site Mirrors +
    + Webring: previous | shring | next +

    + + diff --git a/test-template-tags.html.tmp b/test-template-tags.html.tmp new file mode 100644 index 00000000..fec41ad4 --- /dev/null +++ b/test-template-tags.html.tmp @@ -0,0 +1,38 @@ + + + + +%%TITLE%% + + + + + +

    +Home | Markdown | Gemini +

    +

    Template Tags Test


    +
    +This file demonstrates the template::inline::tags feature.
    +
    +
    +

    Tags


    +
    +#golang
    +#programming
    +#testing
    +
    +This page is about #golang and #testing.
    +
    +

    Content


    +
    +Some content here about #programming.
    +

    + Generated with %%GEMTEXTER%% | + served by OpenBSD/relayd(8)+httpd(8) | + Site Mirrors +
    + Webring: previous | shring | next +

    + + diff --git a/uptime-stats.html b/uptime-stats.html index 693fb928..e46abc74 100644 --- a/uptime-stats.html +++ b/uptime-stats.html @@ -13,7 +13,7 @@

    My machine uptime stats



    -This site was last updated at 2025-12-27T14:56:36+02:00
    +This site was last updated at 2025-12-30T10:15:58+02:00

    The following stats were collected via uptimed on all of my personal computers over many years and the output was generated by guprecords, the global uptime records stats analyser of mine.

    @@ -35,24 +35,24 @@ | Pos | Host | Boots | Last Kernel | +-----+----------------+-------+-------------------------------+ | 1. | alphacentauri | 671 | FreeBSD 11.4-RELEASE-p7 | -| 2. | *earth | 218 | Linux 6.17.12-300.fc43.x86_64 | +| 2. | *earth | 220 | Linux 6.17.12-300.fc43.x86_64 | | 3. | mars | 207 | Linux 3.2.0-4-amd64 | | 4. | callisto | 153 | Linux 4.0.4-303.fc22.x86_64 | | 5. | dionysus | 136 | FreeBSD 13.0-RELEASE-p11 | | 6. | tauceti-e | 120 | Linux 3.2.0-4-amd64 | | 7. | *makemake | 81 | Linux 6.9.9-200.fc40.x86_64 | -| 8. | *f2 | 70 | FreeBSD 14.3-RELEASE | -| 9. | *f1 | 65 | FreeBSD 14.3-RELEASE | -| 10. | *f0 | 62 | FreeBSD 14.3-RELEASE | +| 8. | f2 | 70 | FreeBSD 14.3-RELEASE | +| 9. | f1 | 65 | FreeBSD 14.3-RELEASE | +| 10. | f0 | 62 | FreeBSD 14.3-RELEASE | | 11. | uranus | 59 | NetBSD 10.1 | | 12. | pluto | 51 | Linux 3.2.0-4-amd64 | -| 13. | *mega-m3-pro | 50 | Darwin 24.6.0 | -| 14. | mega15289 | 50 | Darwin 23.4.0 | -| 15. | *fishfinger | 46 | OpenBSD 7.7 | +| 13. | mega15289 | 50 | Darwin 23.4.0 | +| 14. | *mega-m3-pro | 50 | Darwin 24.6.0 | +| 15. | fishfinger | 46 | OpenBSD 7.7 | | 16. | t450 | 44 | FreeBSD 14.2-RELEASE | -| 17. | *blowfish | 43 | OpenBSD 7.7 | -| 18. | phobos | 40 | Linux 3.4.0-CM-g1dd7cdf | -| 19. | mega8477 | 40 | Darwin 13.4.0 | +| 17. | blowfish | 43 | OpenBSD 7.7 | +| 18. | mega8477 | 40 | Darwin 13.4.0 | +| 19. | phobos | 40 | Linux 3.4.0-CM-g1dd7cdf | | 20. | sun | 33 | FreeBSD 10.3-RELEASE-p24 | +-----+----------------+-------+-------------------------------+ @@ -66,12 +66,12 @@ | Pos | Host | Uptime | Last Kernel | +-----+----------------+-----------------------------+-----------------------------------+ | 1. | vulcan | 4 years, 5 months, 6 days | Linux 3.10.0-1160.81.1.el7.x86_64 | -| 2. | *earth | 3 years, 12 months, 3 days | Linux 6.17.12-300.fc43.x86_64 | -| 3. | *blowfish | 3 years, 10 months, 2 days | OpenBSD 7.7 | +| 2. | *earth | 3 years, 12 months, 6 days | Linux 6.17.12-300.fc43.x86_64 | +| 3. | blowfish | 3 years, 10 months, 2 days | OpenBSD 7.7 | | 4. | sun | 3 years, 9 months, 26 days | FreeBSD 10.3-RELEASE-p24 | | 5. | uranus | 3 years, 9 months, 5 days | NetBSD 10.1 | | 6. | uugrn | 3 years, 5 months, 5 days | FreeBSD 11.2-RELEASE-p4 | -| 7. | *fishfinger | 3 years, 1 months, 28 days | OpenBSD 7.7 | +| 7. | fishfinger | 3 years, 1 months, 28 days | OpenBSD 7.7 | | 8. | deltavega | 3 years, 1 months, 21 days | Linux 3.10.0-1160.11.1.el7.x86_64 | | 9. | pluto | 2 years, 10 months, 29 days | Linux 3.2.0-4-amd64 | | 10. | tauceti | 2 years, 3 months, 19 days | Linux 3.2.0-4-amd64 | @@ -97,13 +97,13 @@ | Pos | Host | Score | Last Kernel | +-----+----------------+-------+-----------------------------------+ | 1. | uranus | 340 | NetBSD 10.1 | -| 2. | vulcan | 275 | Linux 3.10.0-1160.81.1.el7.x86_64 | -| 3. | *earth | 275 | Linux 6.17.12-300.fc43.x86_64 | -| 4. | *blowfish | 243 | OpenBSD 7.7 | +| 2. | *earth | 276 | Linux 6.17.12-300.fc43.x86_64 | +| 3. | vulcan | 275 | Linux 3.10.0-1160.81.1.el7.x86_64 | +| 4. | blowfish | 240 | OpenBSD 7.7 | | 5. | sun | 238 | FreeBSD 10.3-RELEASE-p24 | | 6. | uugrn | 211 | FreeBSD 11.2-RELEASE-p4 | | 7. | alphacentauri | 201 | FreeBSD 11.4-RELEASE-p7 | -| 8. | *fishfinger | 200 | OpenBSD 7.7 | +| 8. | fishfinger | 198 | OpenBSD 7.7 | | 9. | deltavega | 193 | Linux 3.10.0-1160.11.1.el7.x86_64 | | 10. | pluto | 182 | Linux 3.2.0-4-amd64 | | 11. | dionysus | 156 | FreeBSD 13.0-RELEASE-p11 | @@ -138,9 +138,9 @@ | 9. | mars | 1 years, 2 months, 10 days | Linux 3.2.0-4-amd64 | | 10. | tauceti-e | 0 years, 12 months, 9 days | Linux 3.2.0-4-amd64 | | 11. | sirius | 0 years, 8 months, 20 days | Linux 2.6.32-042stab111.12 | -| 12. | *f0 | 0 years, 8 months, 3 days | FreeBSD 14.3-RELEASE | -| 13. | *f2 | 0 years, 8 months, 2 days | FreeBSD 14.3-RELEASE | -| 14. | *f1 | 0 years, 8 months, 1 days | FreeBSD 14.3-RELEASE | +| 12. | f0 | 0 years, 8 months, 3 days | FreeBSD 14.3-RELEASE | +| 13. | f2 | 0 years, 8 months, 2 days | FreeBSD 14.3-RELEASE | +| 14. | f1 | 0 years, 8 months, 1 days | FreeBSD 14.3-RELEASE | | 15. | *earth | 0 years, 6 months, 29 days | Linux 6.17.12-300.fc43.x86_64 | | 16. | deimos | 0 years, 5 months, 15 days | Linux 4.4.5-300.fc23.x86_64 | | 17. | joghurt | 0 years, 2 months, 9 days | FreeBSD 7.0-PRERELEASE | @@ -162,13 +162,13 @@ | 2. | dionysus | 8 years, 6 months, 17 days | FreeBSD 13.0-RELEASE-p11 | | 3. | alphacentauri | 6 years, 9 months, 13 days | FreeBSD 11.4-RELEASE-p7 | | 4. | *makemake | 4 years, 10 months, 16 days | Linux 6.9.9-200.fc40.x86_64 | -| 5. | *earth | 4 years, 6 months, 1 days | Linux 6.17.12-300.fc43.x86_64 | +| 5. | *earth | 4 years, 6 months, 4 days | Linux 6.17.12-300.fc43.x86_64 | | 6. | vulcan | 4 years, 5 months, 6 days | Linux 3.10.0-1160.81.1.el7.x86_64 | -| 7. | *blowfish | 3 years, 10 months, 3 days | OpenBSD 7.7 | +| 7. | blowfish | 3 years, 10 months, 3 days | OpenBSD 7.7 | | 8. | sun | 3 years, 10 months, 2 days | FreeBSD 10.3-RELEASE-p24 | | 9. | uugrn | 3 years, 5 months, 5 days | FreeBSD 11.2-RELEASE-p4 | | 10. | mega15289 | 3 years, 4 months, 9 days | Darwin 23.4.0 | -| 11. | *fishfinger | 3 years, 1 months, 30 days | OpenBSD 7.7 | +| 11. | fishfinger | 3 years, 1 months, 30 days | OpenBSD 7.7 | | 12. | deltavega | 3 years, 1 months, 21 days | Linux 3.10.0-1160.11.1.el7.x86_64 | | 13. | pluto | 2 years, 10 months, 30 days | Linux 3.2.0-4-amd64 | | 14. | t450 | 2 years, 9 months, 6 days | FreeBSD 14.2-RELEASE | @@ -191,13 +191,13 @@ +-----+----------------+-------+ | 1. | FreeBSD 10... | 551 | | 2. | Linux 3... | 550 | -| 3. | *FreeBSD 14... | 215 | -| 4. | *Linux 6... | 203 | +| 3. | FreeBSD 14... | 215 | +| 4. | *Linux 6... | 205 | | 5. | Linux 5... | 162 | | 6. | Linux 4... | 161 | | 7. | FreeBSD 11... | 153 | | 8. | FreeBSD 13... | 116 | -| 9. | *OpenBSD 7... | 99 | +| 9. | OpenBSD 7... | 99 | | 10. | Darwin 13... | 40 | | 11. | Darwin 23... | 29 | | 12. | *Darwin 24... | 26 | @@ -207,8 +207,8 @@ | 16. | Darwin 15... | 15 | | 17. | Darwin 22... | 12 | | 18. | Darwin 18... | 11 | -| 19. | OpenBSD 4... | 10 | -| 20. | FreeBSD 7... | 10 | +| 19. | FreeBSD 6... | 10 | +| 20. | OpenBSD 4... | 10 | +-----+----------------+-------+
    @@ -221,13 +221,13 @@ | Pos | KernelMajor | Uptime | +-----+----------------+------------------------------+ | 1. | Linux 3... | 15 years, 10 months, 25 days | -| 2. | *OpenBSD 7... | 7 years, 6 months, 29 days | +| 2. | OpenBSD 7... | 7 years, 6 months, 29 days | | 3. | FreeBSD 10... | 5 years, 9 months, 9 days | | 4. | Linux 5... | 4 years, 10 months, 21 days | -| 5. | *Linux 6... | 3 years, 3 months, 3 days | +| 5. | *Linux 6... | 3 years, 3 months, 7 days | | 6. | Linux 4... | 2 years, 7 months, 22 days | | 7. | FreeBSD 11... | 2 years, 4 months, 28 days | -| 8. | *FreeBSD 14... | 2 years, 3 months, 24 days | +| 8. | FreeBSD 14... | 2 years, 3 months, 24 days | | 9. | Linux 2... | 1 years, 11 months, 21 days | | 10. | Darwin 13... | 1 years, 3 months, 25 days | | 11. | FreeBSD 6... | 1 years, 3 months, 9 days | @@ -252,12 +252,12 @@ | Pos | KernelMajor | Score | +-----+----------------+-------+ | 1. | Linux 3... | 1045 | -| 2. | *OpenBSD 7... | 484 | +| 2. | OpenBSD 7... | 481 | | 3. | FreeBSD 10... | 406 | | 4. | Linux 5... | 317 | | 5. | *Linux 6... | 220 | | 6. | Linux 4... | 175 | -| 7. | *FreeBSD 14... | 161 | +| 7. | FreeBSD 14... | 159 | | 8. | FreeBSD 11... | 159 | | 9. | Linux 2... | 121 | | 10. | Darwin 13... | 80 | @@ -269,8 +269,8 @@ | 16. | Darwin 18... | 32 | | 17. | Darwin 22... | 30 | | 18. | Darwin 15... | 29 | -| 19. | FreeBSD 5... | 25 | -| 20. | FreeBSD 13... | 25 | +| 19. | FreeBSD 13... | 25 | +| 20. | FreeBSD 5... | 25 | +-----+----------------+-------+
    @@ -282,10 +282,10 @@ +-----+------------+-------+ | Pos | KernelName | Boots | +-----+------------+-------+ -| 1. | *Linux | 1098 | -| 2. | *FreeBSD | 1080 | +| 1. | *Linux | 1100 | +| 2. | FreeBSD | 1080 | | 3. | *Darwin | 155 | -| 4. | *OpenBSD | 109 | +| 4. | OpenBSD | 109 | | 5. | NetBSD | 1 | +-----+------------+-------+ @@ -298,9 +298,9 @@ +-----+------------+-----------------------------+ | Pos | KernelName | Uptime | +-----+------------+-----------------------------+ -| 1. | *Linux | 28 years, 3 months, 26 days | -| 2. | *FreeBSD | 12 years, 2 months, 24 days | -| 3. | *OpenBSD | 8 years, 2 months, 7 days | +| 1. | *Linux | 28 years, 3 months, 30 days | +| 2. | FreeBSD | 12 years, 2 months, 24 days | +| 3. | OpenBSD | 8 years, 2 months, 7 days | | 4. | *Darwin | 5 years, 2 months, 22 days | | 5. | NetBSD | 0 years, 1 months, 1 days | +-----+------------+-----------------------------+ @@ -314,9 +314,9 @@ +-----+------------+-------+ | Pos | KernelName | Score | +-----+------------+-------+ -| 1. | *Linux | 1879 | -| 2. | *FreeBSD | 862 | -| 3. | *OpenBSD | 523 | +| 1. | *Linux | 1880 | +| 2. | FreeBSD | 860 | +| 3. | OpenBSD | 520 | | 4. | *Darwin | 340 | | 5. | NetBSD | 0 | +-----+------------+-------+ -- cgit v1.2.3