{ lib, config, pkgs, ... }:

with lib;

let
  cfg = config.roles.k3s;
in
{
  options.roles.k3s = {
    enable = mkEnableOption "Enable the k3s role";
  };

  config =
    {
      networking.firewall.allowedTCPPorts = [
        6443 # k3s: required so that pods can reach the API server (running on port 6443 by default)
        2379 # k3s, etcd clients: required if using a "High Availability Embedded etcd" configuration
        2380 # k3s, etcd peers: required if using a "High Availability Embedded etcd" configuration
      ];
      networking.firewall.allowedUDPPorts = [
        8472 # k3s, flannel: required if using multi-node for inter-node networking
      ];
      services.k3s.enable = true;
      services.k3s.role = "server";
      services.k3s.tokenFile = "";
      services.k3s.serverAddr = "https://10.0.0.222:6443";
      services.k3s.extraFlags = toString [
        # "--debug" # Optionally add additional args to k3s
      ];
      services.k3s.gracefulNodeShutdown.enable = true;
    };
}