51 lines
1.3 KiB
Nix
51 lines
1.3 KiB
Nix
{
|
|
# NFS client support: k3s mounts NFS volumes for media pods
|
|
boot.supportedFilesystems = [ "nfs" ];
|
|
networking.firewall.allowedTCPPorts = [
|
|
6443
|
|
80
|
|
443
|
|
8969
|
|
33073
|
|
];
|
|
networking.firewall.allowedUDPPorts = [ 3479 ];
|
|
|
|
services.k3s = {
|
|
enable = true;
|
|
role = "server";
|
|
extraFlags = "--write-kubeconfig-mode 644 --disable-network-policy";
|
|
};
|
|
|
|
fileSystems."/var/lib/rancher/k3s/server/manifests/apps" = {
|
|
device = "/home/poslop/k3s/apps";
|
|
fsType = "none";
|
|
options = [
|
|
"bind"
|
|
"ro"
|
|
];
|
|
};
|
|
|
|
# Weekly rolling refresh: restart all deployments so floating :latest images
|
|
# are re-pulled, then prune dangling images.
|
|
systemd.services.image-refresh = {
|
|
description = "Pull latest floating images by restarting all deployments, then prune";
|
|
path = [ "/run/current-system/sw/bin" ];
|
|
script = ''
|
|
/run/current-system/sw/bin/k3s kubectl rollout restart deployments -A
|
|
sleep 120
|
|
/run/current-system/sw/bin/k3s crictl rmi --prune || true
|
|
'';
|
|
serviceConfig.Type = "oneshot";
|
|
};
|
|
|
|
systemd.timers.image-refresh = {
|
|
description = "Weekly image refresh";
|
|
wantedBy = [ "timers.target" ];
|
|
timerConfig = {
|
|
OnCalendar = "Sun *-*-* 04:30:00";
|
|
Persistent = true;
|
|
RandomizedDelaySec = "10m";
|
|
};
|
|
};
|
|
}
|