spore
A Raspberry Pi 5 on NVMe that serves x86 netboot, forge's HTTP boot image, the Talos boot image and Tinkerbell, lab DNS and time, and the SPIRE server.
| vendor | Raspberry Pi |
|---|---|
| model | Raspberry Pi 5 Model B Rev 1.1 (8 GB) |
| serial | d860ec5f943fe335 |
| revision | d04171 |
| cpu | BCM2712, Cortex-A76 (4c) |
| ram | 8 GB LPDDR4X-4267 |
| gpu | Broadcom VideoCore VII |
| storage | 128 GB Patriot P300 NVMe (32 GB root, the rest at /nfs/data) |
| os | NixOS 26.05 (Yarara) |
spore is a Raspberry Pi 5 that serves x86 netboot, forge's boot image, and lab DNS and time. It is on the Anchor network, folly's network for lab hosts.
What it runs#
nix/hosts/spore.nix imports these modules from nix/services/. clusters/folly/monitoring/spore.yaml declares their alerts.
- The
/nfs/datafilesystem, which holds Garage, the rackpi5 boot images and an export to the Lab future network (nfs-server.nix). No Kubernetes volume lives on it. - Netboot for x86 PXE and rackpi5 (
pxe-netboot.nix,spore-native-boot.nix) - Tinkerbell, which reprovisions folly's Talos nodes (
tinkerbell.nix), with HookOS's syslog in the journal (hookos-syslog.nix) - Kea, the Kubernetes network's DHCP once the gateway relays it here (
kea.nix) - Lab DNS and time through
nix/profiles/anchor.nix, which importscoredns-sinkhole.nixandntp-server.nix - Talos boot and fleetd on the bootstrap VLAN (
talos-boot.nix,fleetd.nix), with the DevID CA on its YubiKey (devid-ca-yubikey.nix) - folly's backup Garage store, with data in
/nfs/data/garage-ha(garage.nix), as a node of the Garage cluster. The old standalone store in/nfs/data/garageis the rollback. - The SPIRE server that attests Talos nodes by TPM (
spire-server.nix)
Reach#
Reach it at spore.lolwtf.ca or spore.<tailnet>.
Quirks#
nix.gckeeps 7 days and the system profile keeps the current generation and 3 before it, because each generation adds a boot image to the 32 GB root. The rackpi5 publisher keeps the newest 4 releases.
Linked from 15
- Smiirl counterA Go service on the folly Kubernetes cluster that replaces Smiirl's cloud, so the owner sets what the Smiirl counter shows from a web page.
- capsuleA Raspberry Pi 5 on NVMe that is one of the three lab DNS and time anchors, and runs NetBox.
- HostsEvery host in the homelab, with its role, site, hardware, OS and status, and how to reach it.
- rackpi5The image-only NixOS config that spore signs and serves, and that forge boots over HTTP when its NVMe does not boot.
- BackupsHow Garage, Velero, CloudNativePG and etcd snapshots back up the lab's databases, volumes and etcd, and how each site copies them to GCS.
- IdentitySPIRE on spore gives each folly node with a TPM 2.0 an identity rooted in its TPM, by LDevID or EK hash, gives its pods SPIFFE IDs, and lets a pod reach GCP with no key file.
- NetworkThe two sites, their UniFi gateways and networks, and the tunnel, routes, ingress and tailnet that connect them.
- Ingress and DNSThe Gateways, DNS records, certificates, tunnels and lab resolvers that give cluster services a name and a path from the LAN, tailnet or internet.
- KeaThe DHCP server on spore for folly's Kubernetes network, which leases the netboot pool and names the signed iPXE, through the gateway's relay.
- NetbootThe network boot service on spore, with TFTP and HTTP for folly's boot files and a signed RAM-boot image that forge falls back to.
- Talos bootThe boot server on spore that serves folly's signed iPXE, HookOS and SecureBoot ISO on the bootstrap VLAN, beside fleetd's enrollment name.
- TinkerbellThe provisioning stack on spore that power-cycles, wipes and reinstalls folly's Talos nodes, driven by fleetd from NetBox, with its own Kubernetes API.
- Change the forge EEPROMChange the boot settings in the EEPROM of forge, and keep its HTTP boot fallback to the rackpi5 image.
- Install Windows monitoringAdd a Windows desktop to folly's Prometheus, install or update its monitoring agents, and find why it stopped reporting.
- Operate the Smiirl counterCheck the Smiirl counter, calibrate its drums, repair it when it does not show the value set on its page, and return it to Smiirl's cloud.