docs - reflect kubernetes/swarm changes into the doc

README.md

@@ -130,6 +130,7 @@ List of supported Linux distributions :
 - Ubuntu focal (20.04)
 - CentOS 7
 - Fedora 34
+- Arch Linux
 
 Unlike containers, Linux integration can be tedious because bunkerized-nginx has a bunch of dependencies that need to be installed before we can use it. Fortunately, we provide a [helper script](https://github.com/bunkerity/bunkerized-nginx/blob/master/helpers/install.sh) to make the process easier and automatic. Once installed, the configuration is really simple, all you have to do is to edit the `/opt/bunkerized-nginx/variables.env` configuration file and run the `bunkerized-nginx` command to apply it.
 

docs/integrations.md

@@ -245,21 +245,9 @@ The deployment and configuration is very similar to the "Docker autoconf" one bu
 
 <img src="https://github.com/bunkerity/bunkerized-nginx/blob/master/docs/img/swarm.png?raw=true" />
 
-TODO : without shared folder first then with shared folder (www, cache and letsencrypt)
-
-**We will assume that a shared directory is mounted at the /shared location on both your managers and workers. Keep in mind that bunkerized-nginx and autoconf are running as unprivileged users with UID and GID 101. You must set the rights and permissions of the subfolders in /shared accordingly.**
-
 In this setup we will deploy bunkerized-nginx in global mode on all workers and autoconf as a single replica on a manager.
 
-First of all, you will need to setup the shared folders :
+First of all, you will need to create 2 networks, one for the communication between bunkerized-nginx and autoconf and the other one for the communication between bunkerized-nginx and the web services :
-```shell
-$ cd /shared
-$ mkdir www confs letsencrypt acme-challenge
-$ chown root:101 www confs letsencrypt acme-challenge
-$ chmod 770 www confs letsencrypt acme-challenge
-```
-
-Then you will need to create 2 networks, one for the communication between bunkerized-nginx and autoconf and the other one for the communication between bunkerized-nginx and the web services :
 ```shell
 $ docker network create -d overlay --attachable bunkerized-net
 $ docker network create -d overlay --attachable services-net
@@ -275,10 +263,6 @@ $ docker service create \
          --network bunkerized-net \
          -p published=80,target=8080,mode=host \
          -p published=443,target=8443,mode=host \
-         --mount type=bind,source=/shared/confs,destination=/etc/nginx,ro \
-         --mount type=bind,source=/shared/www,destination=/www,ro \
-         --mount type=bind,source=/shared/letsencrypt,destination=/etc/letsencrypt,ro \
-         --mount type=bind,source=/shared/acme-challenge,destination=/acme-challenge,ro \
          -e SWARM_MODE=yes \
          -e USE_API=yes \
          -e API_URI=/ChangeMeToSomethingHardToGuess \
@@ -299,9 +283,8 @@ $ docker service create \
          --constraint node.role==manager \
          --network bunkerized-net \
          --mount type=bind,source=/var/run/docker.sock,destination=/var/run/docker.sock,ro \
-         --mount type=bind,source=/shared/confs,destination=/etc/nginx \
+         --mount type=volume,source=cache-vol,destination=/cache \
-         --mount type=bind,source=/shared/letsencrypt,destination=/etc/letsencrypt \
+         --mount type=volume,source=certs-vol,destination=/etc/letsencrypt \
-         --mount type=bind,source=/shared/acme-challenge,destination=/acme-challenge \
          -e SWARM_MODE=yes \
          -e API_URI=/ChangeMeToSomethingHardToGuess \
          bunkerity/bunkerized-nginx-autoconf
@@ -324,11 +307,6 @@ services:
         target: 8443
         mode: host
         protocol: tcp
-    volumes:
-      - /shared/confs:/etc/nginx:ro
-      - /shared/www:/www:ro
-      - /shared/letsencrypt:/etc/letsencrypt:ro
-      - /shared/acme-challenge:/acme-challenge:ro
     environment:
       - SWARM_MODE=yes
       - USE_API=yes
@@ -352,9 +330,8 @@ services:
     image: bunkerity/bunkerized-nginx-autoconf
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
-      - /shared/confs:/etc/nginx
+      - cache-vol:/cache
-      - /shared/letsencrypt:/etc/letsencrypt
+      - certs-vol:/etc/letsencrypt
-      - /shared/acme-challenge:/acme-challenge
     environment:
       - SWARM_MODE=yes
       - API_URI=/ChangeMeToSomethingHardToGuess # must match API_URI from nginx
@@ -376,6 +353,10 @@ networks:
     driver: overlay
     attachable: true
     name: services-net
+# And the volumes too
+volumes:
+  cache-vol:
+  certs-vol:
 ```
 
 Check the logs of both autoconf and bunkerized-nginx services to see if everything is working as expected.
@@ -433,18 +414,6 @@ The bunkerized-nginx-autoconf acts as an Ingress Controller and connects to the
 
 <img src="https://github.com/bunkerity/bunkerized-nginx/blob/master/docs/img/kubernetes.png?raw=true" />
 
-TODO : without shared folder first then with shared folder (www, cache and letsencrypt)
-
-**We will assume that a shared directory is mounted at the /shared location on your nodes. Keep in mind that bunkerized-nginx and autoconf are running as unprivileged users with UID and GID 101. You must set the rights and permissions of the subfolders in /shared accordingly.**
-
-First of all, you will need to setup the shared folders :
-```shell
-$ cd /shared
-$ mkdir www confs letsencrypt acme-challenge
-$ chown root:nginx www confs letsencrypt acme-challenge
-$ chmod 770 www confs letsencrypt acme-challenge
-```
-
 The first step to do is to declare the RBAC authorization that will be used by the Ingress Controller to access the Kubernetes API. A ready-to-use declaration is available here :
 ```yaml
 apiVersion: rbac.authorization.k8s.io/v1
@@ -510,7 +479,7 @@ spec:
         - name: KUBERNETES_MODE
           value: "yes"
         - name: DNS_RESOLVERS
-          value: "kube-dns.kube-system.svc.cluster.local"
+          value: "coredns.kube-system.svc.cluster.local"
         - name: USE_API
           value: "yes"
         - name: API_URI
@@ -519,36 +488,6 @@ spec:
           value: ""
         - name: MULTISITE
           value: "yes"
-        volumeMounts:
-        - name: confs
-          mountPath: /etc/nginx
-          readOnly: true
-        - name: letsencrypt
-          mountPath: /etc/letsencrypt
-          readOnly: true
-        - name: acme-challenge
-          mountPath: /acme-challenge
-          readOnly: true
-        - name: www
-          mountPath: /www
-          readOnly: true
-      volumes:
-      - name: confs
-        hostPath:
-          path: /shared/confs
-          type: Directory
-      - name: letsencrypt
-        hostPath:
-          path: /shared/letsencrypt
-          type: Directory
-      - name: acme-challenge
-        hostPath:
-          path: /shared/acme-challenge
-          type: Directory
-      - name: www
-        hostPath:
-          path: /shared/www
-          type: Directory
 ---
 apiVersion: v1
 kind: Service
@@ -566,10 +505,19 @@ spec:
     name: bunkerized-nginx
 ```
 
-Important thing to note, labels and annotations defined are mandatory for autoconf to work.
-
 You can now deploy the autoconf which will act as the ingress controller :
 ```yaml
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pvc-nginx
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -587,6 +535,30 @@ spec:
         app: bunkerized-nginx-autoconf
     spec:
       serviceAccountName: bunkerized-nginx-ingress-controller
+      volumes:
+      - name: vol-nginx
+        persistentVolumeClaim:
+          claimName: pvc-nginx
+      initContainers:
+      - name: change-data-dir-permissions
+        command:
+        - chown
+        - -R
+        - 101:101
+        - /etc/letsencrypt
+        - /cache
+        image: busybox
+        volumeMounts:
+        - name: vol-nginx
+          mountPath: /etc/letsencrypt
+          subPath: letsencrypt
+        - name: vol-nginx
+          mountPath: /cache
+          subPath: cache
+        securityContext:
+          runAsNonRoot: false
+          runAsUser: 0
+          runAsGroup: 0
       containers:
       - name: bunkerized-nginx-autoconf
         image: bunkerity/bunkerized-nginx-autoconf
@@ -596,25 +568,12 @@ spec:
         - name: API_URI
           value: "/ChangeMeToSomethingHardToGuess"
         volumeMounts:
-        - name: confs
+        - name: vol-nginx
-          mountPath: /etc/nginx
-        - name: letsencrypt
           mountPath: /etc/letsencrypt
-        - name: acme-challenge
+          subPath: letsencrypt
-          mountPath: /acme-challenge
+        - name: vol-nginx
-      volumes:
+          mountPath: /cache
-      - name: confs
+          subPath: cache
-        hostPath:
-          path: /shared/confs
-          type: Directory
-      - name: letsencrypt
-        hostPath:
-          path: /shared/letsencrypt
-          type: Directory
-      - name: acme-challenge
-        hostPath:
-          path: /shared/acme-challenge
-          type: Directory
 ```
 
 Check the logs of both bunkerized-nginx and autoconf deployments to see if everything is working as expected.
@@ -725,6 +684,7 @@ List of supported Linux distributions :
 - Ubuntu focal (20.04)
 - CentOS 7
 - Fedora 34
+- Arch Linux
 
 Unlike containers, Linux integration can be tedious because bunkerized-nginx has a bunch of dependencies that need to be installed before we can use it. Fortunately, we provide a helper script to make the process easier and automatic. Once installed, the configuration is really simple, all you have to do is to edit the `/opt/bunkerized-nginx/variables.env` configuration file and run the `bunkerized-nginx` command to apply it.
 

helpers/kubernetes-nginx.yml

@@ -27,7 +27,7 @@ spec:
         - name: KUBERNETES_MODE
           value: "yes"
         - name: DNS_RESOLVERS
-          value: "kube-dns.kube-system.svc.cluster.local"
+          value: "coredns.kube-system.svc.cluster.local"
         - name: USE_API
           value: "yes"
         - name: API_URI
@@ -36,15 +36,6 @@ spec:
           value: ""
         - name: MULTISITE
           value: "yes"
-        volumeMounts:
-        - name: www
-          mountPath: /www
-          readOnly: true
-      volumes:
-      - name: www
-        hostPath:
-          path: /shared/www
-          type: Directory
 ---
 apiVersion: v1
 kind: Service
@@ -61,6 +52,17 @@ spec:
   selector:
     name: bunkerized-nginx
 ---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pvc-nginx
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -78,6 +80,30 @@ spec:
         app: bunkerized-nginx-autoconf
     spec:
       serviceAccountName: bunkerized-nginx-ingress-controller
+      volumes:
+      - name: vol-nginx
+        persistentVolumeClaim:
+          claimName: pvc-nginx
+      initContainers:
+      - name: change-data-dir-permissions
+        command:
+        - chown
+        - -R
+        - 101:101
+        - /etc/letsencrypt
+        - /cache
+        image: busybox
+        volumeMounts:
+        - name: vol-nginx
+          mountPath: /etc/letsencrypt
+          subPath: letsencrypt
+        - name: vol-nginx
+          mountPath: /cache
+          subPath: cache
+        securityContext:
+          runAsNonRoot: false
+          runAsUser: 0
+          runAsGroup: 0
       containers:
       - name: bunkerized-nginx-autoconf
         image: bunkerity/bunkerized-nginx-autoconf
@@ -87,10 +113,9 @@ spec:
         - name: API_URI
           value: "/ChangeMeToSomethingHardToGuess"
         volumeMounts:
-        - name: letsencrypt
+        - name: vol-nginx
           mountPath: /etc/letsencrypt
-      volumes:
+          subPath: letsencrypt
-      - name: letsencrypt
+        - name: vol-nginx
-        hostPath:
+          mountPath: /cache
-          path: /shared/letsencrypt
+          subPath: cache
-          type: Directory

helpers/swarm.yml

@@ -13,8 +13,6 @@ services:
         target: 8443
         mode: host
         protocol: tcp
-    volumes:
-      - /shared/www:/www:ro
     environment:
       - SWARM_MODE=yes
       - USE_API=yes
@@ -38,7 +36,8 @@ services:
     image: bunkerity/bunkerized-nginx-autoconf
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
-      - /shared/letsencrypt:/etc/letsencrypt
+      - cache-vol:/cache
+      - certs-vol:/etc/letsencrypt
     environment:
       - SWARM_MODE=yes
       - API_URI=/ChangeMeToSomethingHardToGuess # must match API_URI from nginx
@@ -60,3 +59,7 @@ networks:
     driver: overlay
     attachable: true
     name: services-net
+# And the volumes too
+volumes:
+  cache-vol:
+  certs-vol: