27 lines
990 B
Nix
27 lines
990 B
Nix
{
|
|
networking.firewall.allowedTCPPorts = [ 6443 80 443 33073 ];
|
|
networking.firewall.allowedUDPPorts = [ 3479 ];
|
|
|
|
services.k3s = {
|
|
enable = true;
|
|
role = "server";
|
|
extraFlags = "--write-kubeconfig-mode 644";
|
|
};
|
|
|
|
# k3s manifests live in a separate repo (git.archfox.org/poslop/k3s),
|
|
# cloned at /home/poslop/k3s. Bind-mounting (not symlinking!) into
|
|
# k3s's manifest dir lets k3s's native recursive directory watch pick
|
|
# up new/changed files automatically -- no nixos-rebuild, no kubectl
|
|
# apply needed for changes under apps/. Symlinked dirs are explicitly
|
|
# NOT picked up by k3s's watcher (see k3s-io/k3s#9288), hence bind mount.
|
|
#
|
|
# TODO: once Flux is set up, replace this bind mount with a Flux
|
|
# GitRepository/Kustomization pointing at the same repo, and remove
|
|
# this fileSystems entry.
|
|
fileSystems."/var/lib/rancher/k3s/server/manifests/apps" = {
|
|
device = "/home/poslop/k3s/apps";
|
|
fsType = "none";
|
|
options = [ "bind" "ro" ];
|
|
};
|
|
}
|