add k3s services

2026-04-19 16:00:08 +00:00 · 2026-03-13 19:11:58 +01:00
parent 31c7ad6454
commit a1d1c767e3
3 changed files with 132 additions and 0 deletions
--- a/hosts/k3s-nixos-01/k3s.nix
+++ b/hosts/k3s-nixos-01/k3s.nix
@@ -0,0 +1,70 @@
+{ config, pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    k3s
+  ];
+
+  environment.sessionVariables = {
+    KUBECONFIG = "$HOME/.kube/config";
+  };
+
+  services.k3s = {
+    enable = true;
+    role = "server";
+  };
+
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = no;
+      PermitRootLogin = "no";
+    };
+  };
+
+  systemd.services.cloudflared-connector = {
+    description = "Cloudflare Tunnel Connector";
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      ExecStart = "${pkgs.cloudflared}/bin/cloudflared tunnel --no-autoupdate run --token XXXXXXXXXXXXXXXXXXXXXXXXXXXX";
+      Restart = "always";
+      User = "cloudflared";
+      Group = "cloudflared";
+    };
+  };
+
+  users.users.cloudflared = {
+    group = "cloudflared";
+    isSystemUser = true;
+  };
+  users.groups.cloudflared = { };
+
+  networking = {
+    useDHCP = false;
+    dhcpcd.enable = false;
+
+    defaultGateway = "192.168.1.254";
+    nameservers = [
+      "1.1.1.1"
+      "8.8.8.8"
+    ];
+
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [
+        6443
+        10250
+        22
+      ];
+      allowedUDPPorts = [ 8472 ];
+    };
+
+    interfaces.enp0s25.ipv4.addresses = [
+      {
+        address = "192.168.1.89";
+        prefixLength = 24;
+      }
+    ];
+  };
+}