preparing k3s bootstrapping

.envrc

@@ -0,0 +1 @@
+use flake

flake.nix

@@ -31,13 +31,31 @@
         bootstrap = kclib.mkHost {
           name = "bootstrap";
         };
-        etcd0 = kclib.mkHost {
-          name = "etcd0";
-        };
         hydra = kclib.mkHost {
           name = "hydra";
         };
+        node0 = kclib.mkHost {
+          name = "node0";
+        };
+        node1 = kclib.mkHost {
+          name = "node1";
+        };
+        node2 = kclib.mkHost {
+          name = "node2";
+        };
       };
       formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixfmt-rfc-style;
+      devShells.x86_64-linux.default =
+        let
+          pkgs = import nixpkgs {
+            system = "x86_64-linux";
+            allowUnfree = true;
+          };
+        in
+        pkgs.mkShellNoCC {
+          packages = with pkgs; [
+            cfssl
+          ];
+        };
     };
 }

hosts/node0/default.nix

@@ -0,0 +1,22 @@
+{ ... }:
+{
+  kropcloud =
+    let
+      serverIp = "192.168.1.170";
+    in
+    {
+      services = {
+        k3s = {
+          enable = true;
+          isMaster = true;
+        };
+      };
+      networking = {
+        ipv4 = {
+          address = serverIp;
+          prefixLength = 24;
+          defaultGateway = "192.168.1.1";
+        };
+      };
+    };
+}

hosts/node1/default.nix

@@ -0,0 +1,22 @@
+{ ... }:
+{
+  kropcloud =
+    let
+      serverIp = "192.168.1.171";
+    in
+    {
+      services = {
+        k3s = {
+          enable = true;
+          master = "node0";
+        };
+      };
+      networking = {
+        ipv4 = {
+          address = serverIp;
+          prefixLength = 24;
+          defaultGateway = "192.168.1.1";
+        };
+      };
+    };
+}

hosts/node2/default.nix

@@ -0,0 +1,22 @@
+{ ... }:
+{
+  kropcloud =
+    let
+      serverIp = "192.168.1.172";
+    in
+    {
+      services = {
+        k3s = {
+          enable = true;
+          master = "node0";
+        };
+      };
+      networking = {
+        ipv4 = {
+          address = serverIp;
+          prefixLength = 24;
+          defaultGateway = "192.168.1.1";
+        };
+      };
+    };
+}

lib.nix

@@ -6,12 +6,13 @@
     {
       name,
       arch ? "x86_64-linux",
+      config_name ? name,
     }:
     inputs.nixpkgs.lib.nixosSystem {
       system = arch;
       modules = [
         ./hosts/base
-        ./hosts/${name}
+        ./hosts/${config_name}
         ./nixosModules
         (
           { ... }:
@@ -28,4 +29,14 @@
         inherit inputs;
       };
     };
+  # TODO: this will actually be nice, so I can see IPs in main flake.nix,
+  # but also dont have three directories with only default.nix in it
+  # mkK3Snode = {
+  #   name_prefix,
+  #   id,
+  #   ip
+  # }: mkHost {
+  #   name = "${name_prefix}-${id}";
+  #   config_name = "k3snode";
+  # };
 }

nixosModules/networking/default.nix

@@ -49,6 +49,10 @@ in
       }
     ];
 
+    services.avahi = {
+      enable = true;
+    };
+
     networking = {
       nftables.enable = true;
       firewall = {

nixosModules/services/default.nix

@@ -4,5 +4,6 @@
     ./ssh
     ./tailscale
     ./hydra
+    ./k3s
   ];
 }

nixosModules/services/k3s/default.nix

@@ -0,0 +1,58 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.kropcloud.services.k3s;
+in
+{
+  options.kropcloud.services.k3s = {
+    enable = lib.mkEnableOption "Whence to enable k3s service.";
+    isMaster = lib.mkEnableOption "Whence to configure k3s as master.";
+    master = lib.mkOption {
+      type = with lib.types; nullOr str;
+      default = null;
+      example = "node0";
+      description = "The master node to connect to";
+    };
+  };
+  config = lib.mkIf cfg.enable {
+
+    assertions = [
+      {
+        assertion = (!cfg.isMaster && cfg.master == null);
+        message = ''
+          You need to provide a valid value for `master` in `kropcloud.services.k3s`
+          when `isMaster` is not set.
+        '';
+      }
+    ];
+
+    age.secrets.k3stoken.file = ../../../secrets/k3stoken.age;
+
+    services.k3s = {
+      enable = true;
+      role = "server";
+      tokenFile = config.age.secrets.k3stoken.path;
+      extraFlags = toString (
+        [
+          "--write-kubeconfig-mode \"0644\""
+          "--cluster-init"
+          "--disable servicelb"
+          "--disable traefik"
+          "--disable local-storage"
+        ]
+        ++ (
+          if cfg.isMaster && cfg.master != null then
+            [ ]
+          else
+            [
+              "--server https://${cfg.master}:6443"
+            ]
+        )
+      );
+      clusterInit = cfg.isMaster;
+    };
+  };
+}

secrets/k3stoken.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 5k28aQ wUKJk8gcxcCqbdXsfuod3dvEtj+pXRe8rLYVv/uyND4
+aHOXSUwP5+AJZ5etU+dj9ssVNQNcDuXSpq+wvIYsoyE
+-> ssh-ed25519 MhDGlw Ln5f8TTQFDlp+KGQpRRPNgn/+fzoY7Bnl7FlDg5ZSSs
+uJbxZFjjcSxhIPHvregG1tD8BKKfHHMlvfZ6itDIppY
+--- MGApTU7O6xSlpanV9LC22ZX2u7bwULpBMaTLg01SO/0
+šâYøï	ö¯J#<23>ž6/ó—6 ñwTF¯ìfŒÔ¶¡	x×<78>º™5·Îÿ¸^

secrets/keys.json

@@ -11,6 +11,10 @@
       "hosts:wenar-nix",
       "hosts:lenar",
       "servers:test-server"
+    ],
+    "k3stoken.age": [
+      "hosts:wenar-nix",
+      "hosts:lenar"
     ]
   }
 }

secrets/secrets.nix

@@ -9,4 +9,5 @@ let
 in
 {
   "mypassword.age".publicKeys = getKeys "mypassword.age";
+  "k3stoken.age".publicKeys = getKeys "k3stoken.age";
 }