synchronous/nix-config
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

server-test

Browse Source
This commit is contained in:
JakeGinesin
2025-09-01 01:02:01 -04:00
parent 2e7a953f84
commit 7ded1d8176
5 changed files with 198 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
extras/k3s-node.nix
View File

@@ -1,8 +1,22 @@
{
config,
pkgs,
lib,
...
}: {
swapDevices = lib.mkForce [];
boot = {
kernel.sysctl = {
# Enable IP forwarding (required for pod networking)
"net.ipv4.ip_forward" = 1;
"net.ipv6.conf.all.forwarding" = 1;
# Enable bridge netfilter (required for iptables rules on bridge traffic)
"net.bridge.bridge-nf-call-iptables" = 1;
"net.bridge.bridge-nf-call-ip6tables" = 1;
};
};
networking.firewall.allowedTCPPorts = [
6443 # k3s: required so that pods can reach the API server (running on port 6443 by default)
# 2379 # k3s, etcd clients: required if using a "High Availability Embedded etcd" configuration

43
extras/k3s.nix
View File

@@ -1,21 +1,50 @@
{
config,
pkgs,
lib,
...
}: {
networking.firewall.allowedTCPPorts = [
6443 # k3s: required so that pods can reach the API server (running on port 6443 by default)
# 2379 # k3s, etcd clients: required if using a "High Availability Embedded etcd" configuration
# 2380 # k3s, etcd peers: required if using a "High Availability Embedded etcd" configuration
];
networking.firewall.allowedUDPPorts = [
# 8472 # k3s, flannel: required if using multi-node for inter-node networking
swapDevices = lib.mkForce [];
boot = {
kernel.sysctl = {
# Enable IP forwarding (required for pod networking)
"net.ipv4.ip_forward" = 1;
"net.ipv6.conf.all.forwarding" = 1;
# Enable bridge netfilter (required for iptables rules on bridge traffic)
"net.bridge.bridge-nf-call-iptables" = 1;
"net.bridge.bridge-nf-call-ip6tables" = 1;
};
};
environment.systemPackages = with pkgs; [
kubernetes-helm
];
networking.firewall.enable = false;
# networking.firewall.allowedTCPPorts = [
# 6443 # k3s: required so that pods can reach the API server
# ];
# networking.firewall.allowedUDPPorts = [
# ];
services.k3s = {
enable = true;
role = "server";
# token = "jakeginesin12345678910";
tokenFile = config.age.secrets.kube.path;
clusterInit = true;
extraFlags = toString [
# "--bind-address=0.0.0.0" # API server listens on all interfaces
# "--advertise-address=100.125.181.75" # Advertise this IP to cluster members
# "--node-ip=100.125.181.75" # Primary IP for this node
# "--node-external-ip=100.125.181.75" # External IP for services
# "--tls-san=100.125.181.75" # Add IP to TLS certificate
];
};
}