50 lines
1.2 KiB
Nix
50 lines
1.2 KiB
Nix
{ config, pkgs, ... }:
|
|
|
|
{
|
|
########################################
|
|
# k3s Single-Node (Traefik disabled)
|
|
########################################
|
|
services.k3s = {
|
|
enable = true;
|
|
role = "server";
|
|
# Initialize single-server cluster and disable bundled Traefik ingress.
|
|
extraFlags = toString [
|
|
"--cluster-init"
|
|
"--disable=traefik"
|
|
"--flannel-backend=vxlan"
|
|
"--tls-san=k8s.home.lindenfelser.de"
|
|
];
|
|
};
|
|
|
|
########################################
|
|
# Firewall for k3s
|
|
########################################
|
|
networking.firewall.enable = true;
|
|
networking.firewall.allowedTCPPorts = [
|
|
6443 # Kubernetes API
|
|
10250 # Kubelet metrics
|
|
5000 # Docker Registry
|
|
];
|
|
|
|
networking.firewall.allowedUDPPorts = [
|
|
8472 # flannel VXLAN
|
|
];
|
|
|
|
########################################
|
|
# Containerd registry configuration
|
|
########################################
|
|
environment.etc."rancher/k3s/registries.yaml" = {
|
|
text = ''
|
|
mirrors:
|
|
registry.home.lindenfelser.de:
|
|
endpoint:
|
|
- "https://10.202.82.7:5000"
|
|
configs:
|
|
"10.202.82.7:5000":
|
|
tls:
|
|
insecure_skip_verify: true
|
|
'';
|
|
mode = "0644";
|
|
};
|
|
}
|