51 lines
1.3 KiB
Nix
51 lines
1.3 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
{
|
|
config = {
|
|
clan.core.vars.generators = {
|
|
k3s = {
|
|
share = false;
|
|
files = {
|
|
ip_v6 = {
|
|
deploy = false;
|
|
secret = false;
|
|
};
|
|
ip_v4 = {
|
|
deploy = false;
|
|
secret = false;
|
|
};
|
|
token = {
|
|
deploy = false;
|
|
secret = true;
|
|
};
|
|
};
|
|
runtimeInputs = with pkgs; [ pwgen ];
|
|
script = ''
|
|
echo "::1" > "$out/ip_v6"
|
|
echo "127.0.0.1" > "$out/ip_v4"
|
|
pwgen 50 1 > "$out/token"
|
|
'';
|
|
};
|
|
};
|
|
|
|
networking.firewall = {
|
|
allowedTCPPorts = [
|
|
6443 # k3s: required so that pods can reach the API server (running on port 6443 by default)
|
|
2379 # k3s, etcd clients: required if using a "High Availability Embedded etcd" configuration
|
|
2380 # k3s, etcd peers: required if using a "High Availability Embedded etcd" configuration
|
|
];
|
|
|
|
allowedUDPPorts = [
|
|
8472 # k3s, flannel: required if using multi-node for inter-node networking
|
|
];
|
|
};
|
|
|
|
services = {
|
|
k3s = {
|
|
enable = true;
|
|
role = "server";
|
|
token = config.clan.core.vars.generators.k3s.token.value;
|
|
clusterInit = true;
|
|
};
|
|
};
|
|
};
|
|
}
|