poslop/rice-flakes
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects 3 Releases 1 Wiki Activity

k3s: bind-mount apps/ from separate poslop/k3s repo, add traefik firewall port

Browse Source
This commit is contained in:
poslop
2026-07-30 20:09:40 -05:00
parent 765be54fb5
commit dac900756c
1 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/k3s/k3s.nix
+18 -1
View File
@@ -1,9 +1,26 @@
{ {
networking.firewall.allowedTCPPorts = [ 6443 80 443 ]; networking.firewall.allowedTCPPorts = [ 6443 80 443 33073 ];
networking.firewall.allowedUDPPorts = [ 3479 ];
services.k3s = { services.k3s = {
enable = true; enable = true;
role = "server"; role = "server";
extraFlags = "--write-kubeconfig-mode 644"; extraFlags = "--write-kubeconfig-mode 644";
}; };
# k3s manifests live in a separate repo (git.archfox.org/poslop/k3s),
# cloned at /home/poslop/k3s. Bind-mounting (not symlinking!) into
# k3s's manifest dir lets k3s's native recursive directory watch pick
# up new/changed files automatically -- no nixos-rebuild, no kubectl
# apply needed for changes under apps/. Symlinked dirs are explicitly
# NOT picked up by k3s's watcher (see k3s-io/k3s#9288), hence bind mount.
#
# TODO: once Flux is set up, replace this bind mount with a Flux
# GitRepository/Kustomization pointing at the same repo, and remove
# this fileSystems entry.
fileSystems."/var/lib/rancher/k3s/server/manifests/apps" = {
device = "/home/poslop/k3s/apps";
fsType = "none";
options = [ "bind" "ro" ];
};
} }