34 lines
1.1 KiB
Nix
34 lines
1.1 KiB
Nix
{ lib, config, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
cfg = config.roles.k3s;
|
|
in
|
|
{
|
|
options.roles.k3s = {
|
|
enable = mkEnableOption "Enable the k3s role";
|
|
};
|
|
|
|
config =
|
|
{
|
|
networking.firewall.allowedTCPPorts = [
|
|
6443 # k3s: required so that pods can reach the API server (running on port 6443 by default)
|
|
2379 # k3s, etcd clients: required if using a "High Availability Embedded etcd" configuration
|
|
2380 # k3s, etcd peers: required if using a "High Availability Embedded etcd" configuration
|
|
];
|
|
networking.firewall.allowedUDPPorts = [
|
|
8472 # k3s, flannel: required if using multi-node for inter-node networking
|
|
];
|
|
services.k3s.enable = true;
|
|
services.k3s.role = "server";
|
|
sops.secrets.k3s_cluster_token = {};
|
|
services.k3s.tokenFile = "/run/secrets/k3s_cluster_token";
|
|
services.k3s.serverAddr = "https://10.0.0.222:6443";
|
|
services.k3s.extraFlags = toString [
|
|
# "--debug" # Optionally add additional args to k3s
|
|
];
|
|
services.k3s.gracefulNodeShutdown.enable = true;
|
|
};
|
|
}
|