k3s: RustDesk-Server (hbbs/hbbr) als Manifest und Playbook, parallel zu appsrv08

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-10-15 14:41:00 +02:00
parent eafebaab94
commit d11e2d90fc
2 changed files with 183 additions and 0 deletions
@@ -0,0 +1,112 @@
+# RustDesk-Server (ID-Server hbbs + Relay hbbr) in k3s, Umzug vom Portainer-Stack „rustdesk“ auf appsrv08
+# (Phase 6.0, 15.10.2026). Schlüsselpaar id_ed25519 kommt aus dem Secret rustdesk-keys (legt
+# playbooks/rustdesk-k3s.yml aus /root/.config/knaster/rustdesk/ auf ops an; nicht im Repo). Mit demselben
+# Schlüssel bleiben die in den Clients hinterlegten Public Keys gültig.
+#
+# Erreichbar über Service-Typ LoadBalancer (k3s ServiceLB): Ports 21115–21119/tcp und 21116/udp auf jeder
+# Knoten-Adresse. Die Clients tragen als ID-Server die Adresse ein, die das Playbook als Relay-Adresse setzt
+# (rustdesk_public_host, Standard: die k3s-VM). Erst mit fester Adresse/DNS-Namen für die Clients umstellen.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: rustdesk
+  labels:
+    knaster.app: rustdesk
+---
+# Datenbank (ID-Registrierungen) auf local-path: bindet den Pod an den Knoten, auf dem er zuerst lief.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: rustdesk-data
+  namespace: rustdesk
+spec:
+  accessModes: [ReadWriteOnce]
+  storageClassName: local-path
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: rustdesk
+  namespace: rustdesk
+  labels: {app: rustdesk}
+spec:
+  replicas: 1
+  strategy: {type: Recreate}   # ein Datenverzeichnis, ein Pod
+  selector:
+    matchLabels: {app: rustdesk}
+  template:
+    metadata:
+      labels: {app: rustdesk}
+    spec:
+      nodeSelector:
+        knaster.gpu: "true"     # nicht auf die kleine k3s-VM (2 Kerne, 3 GB)
+      containers:
+        - name: hbbs
+          image: rustdesk/rustdesk-server:1.1.14
+          # Relay-Adresse, die hbbs den Clients nennt; setzt das Playbook (RELAY_HOST) – muss von den Clients erreichbar sein
+          command: ["sh", "-c", "exec hbbs -r ${RELAY_HOST}:21117 -k _"]
+          env:
+            - {name: RELAY_HOST, value: "__RELAY_HOST__"}
+          workingDir: /root
+          ports:
+            - {name: nat-test, containerPort: 21115, protocol: TCP}
+            - {name: id-tcp, containerPort: 21116, protocol: TCP}
+            - {name: id-udp, containerPort: 21116, protocol: UDP}
+            - {name: web, containerPort: 21118, protocol: TCP}
+          resources:
+            requests: {cpu: 50m, memory: 64Mi}
+            limits: {memory: 256Mi}
+          volumeMounts:
+            - {name: data, mountPath: /root}
+            - {name: keys, mountPath: /root/id_ed25519, subPath: id_ed25519, readOnly: true}
+            - {name: keys, mountPath: /root/id_ed25519.pub, subPath: id_ed25519.pub, readOnly: true}
+          readinessProbe:
+            tcpSocket: {port: id-tcp}
+            periodSeconds: 10
+          livenessProbe:
+            tcpSocket: {port: id-tcp}
+            periodSeconds: 30
+            failureThreshold: 3
+        - name: hbbr
+          image: rustdesk/rustdesk-server:1.1.14
+          command: ["hbbr", "-k", "_"]
+          workingDir: /root
+          ports:
+            - {name: relay, containerPort: 21117, protocol: TCP}
+            - {name: relay-web, containerPort: 21119, protocol: TCP}
+          resources:
+            requests: {cpu: 50m, memory: 64Mi}
+            limits: {memory: 256Mi}
+          volumeMounts:
+            - {name: keys, mountPath: /root/id_ed25519, subPath: id_ed25519, readOnly: true}
+            - {name: keys, mountPath: /root/id_ed25519.pub, subPath: id_ed25519.pub, readOnly: true}
+          readinessProbe:
+            tcpSocket: {port: relay}
+            periodSeconds: 10
+      volumes:
+        - name: data
+          persistentVolumeClaim: {claimName: rustdesk-data}
+        - name: keys
+          secret:
+            secretName: rustdesk-keys
+            defaultMode: 0400
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: rustdesk
+  namespace: rustdesk
+  labels: {app: rustdesk}
+spec:
+  type: LoadBalancer
+  selector: {app: rustdesk}
+  ports:
+    - {name: nat-test, port: 21115, targetPort: 21115, protocol: TCP}
+    - {name: id-tcp, port: 21116, targetPort: 21116, protocol: TCP}
+    - {name: id-udp, port: 21116, targetPort: 21116, protocol: UDP}
+    - {name: relay, port: 21117, targetPort: 21117, protocol: TCP}
+    - {name: web, port: 21118, targetPort: 21118, protocol: TCP}
+    - {name: relay-web, port: 21119, targetPort: 21119, protocol: TCP}