180 lines
4 KiB
Nix
180 lines
4 KiB
Nix
{
|
|
pkgs,
|
|
config,
|
|
inputs,
|
|
...
|
|
}:
|
|
let
|
|
mkK3sNode = name: isServer: ipv4Address: ipv6Address: macAddress: {
|
|
config = {
|
|
imports = [
|
|
inputs.sops.nixosModules.sops
|
|
../../users/root
|
|
];
|
|
|
|
microvm = {
|
|
mem = 1024;
|
|
balloonMem = 1024;
|
|
vcpu = 2;
|
|
|
|
shares = [
|
|
{
|
|
source = "/nix/store";
|
|
mountPoint = "/nix/.ro-store";
|
|
tag = "ro-store";
|
|
proto = "virtiofs";
|
|
}
|
|
|
|
{
|
|
source = "/var/lib/microvms/${name}/etc";
|
|
mountPoint = "/etc";
|
|
proto = "virtiofs";
|
|
tag = "etc";
|
|
}
|
|
];
|
|
|
|
volumes = [
|
|
{
|
|
image = "var.img";
|
|
mountPoint = "/var";
|
|
size = 25 * 1024;
|
|
}
|
|
];
|
|
|
|
interfaces = [
|
|
{
|
|
type = "tap";
|
|
id = "vm-${name}";
|
|
mac = macAddress;
|
|
}
|
|
];
|
|
hypervisor = "cloud-hypervisor";
|
|
};
|
|
|
|
services = {
|
|
k3s = {
|
|
enable = true;
|
|
clusterInit = isServer;
|
|
serverAddr = if !isServer then "https://10.128.0.2:6443" else "";
|
|
role = "server";
|
|
tokenFile = config.sops.secrets.k3s-token.path;
|
|
extraFlags = "--tls-san=${builtins.elemAt (builtins.split "/" ipv4Address) 0}";
|
|
};
|
|
|
|
openssh = {
|
|
enable = true;
|
|
hostKeys = [
|
|
{
|
|
type = "ed25519";
|
|
path = "/etc/ssh/ssh_host_ed25519_key";
|
|
}
|
|
];
|
|
};
|
|
};
|
|
|
|
networking = {
|
|
hostName = name;
|
|
useNetworkd = true;
|
|
firewall.allowedTCPPorts = [
|
|
2379 # etcd
|
|
2380 # etcd
|
|
6443 # k3s supervisor / k8s API
|
|
];
|
|
};
|
|
|
|
systemd.network = {
|
|
networks."10-vm-${name}" = {
|
|
matchConfig.MACAddress = macAddress;
|
|
addresses = [
|
|
{ addressConfig.Address = ipv4Address; }
|
|
{ addressConfig.Address = ipv6Address; }
|
|
];
|
|
networkConfig = {
|
|
Gateway = "10.128.0.1";
|
|
DNS = [ "10.0.0.206" ];
|
|
};
|
|
};
|
|
};
|
|
|
|
sops = {
|
|
defaultSopsFile = ./secrets.yaml;
|
|
secrets.k3s-token = { };
|
|
};
|
|
|
|
system.stateVersion = "23.11";
|
|
};
|
|
};
|
|
in
|
|
{
|
|
microvm.vms = {
|
|
k3s-1 = mkK3sNode "k3s-1" true "10.128.0.2/24" "fd12:3456:789a::2/64" "0e:00:00:00:00:01";
|
|
k3s-2 = mkK3sNode "k3s-2" false "10.128.0.3/24" "fd12:3456:789a::3/64" "0e:00:00:00:00:02";
|
|
k3s-3 = mkK3sNode "k3s-3" false "10.128.0.4/24" "fd12:3456:789a::4/64" "0e:00:00:00:00:03";
|
|
};
|
|
|
|
systemd.network = {
|
|
netdevs."10-microvm".netdevConfig = {
|
|
Kind = "bridge";
|
|
Name = "microvm";
|
|
};
|
|
|
|
networks."10-microvm" = {
|
|
matchConfig.Name = "microvm";
|
|
addresses = [
|
|
{ addressConfig.Address = "10.128.0.1/24"; }
|
|
{ addressConfig.Address = "fd12:3456:789a::1/64"; }
|
|
];
|
|
ipv6Prefixes = [ { ipv6PrefixConfig.Prefix = "fd12:3456:789a::/64"; } ];
|
|
};
|
|
|
|
networks."11-microvm" = {
|
|
matchConfig.Name = "vm-*";
|
|
networkConfig.Bridge = "microvm";
|
|
};
|
|
};
|
|
|
|
networking.nat = {
|
|
enable = true;
|
|
enableIPv6 = true;
|
|
externalInterface = "enp4s0";
|
|
internalInterfaces = [ "microvm" ];
|
|
|
|
forwardPorts = [
|
|
{
|
|
proto = "tcp";
|
|
sourcePort = 6443;
|
|
destination = "10.128.0.2:6443";
|
|
}
|
|
{
|
|
proto = "tcp";
|
|
sourcePort = 6443;
|
|
destination = "10.128.0.3:6443";
|
|
}
|
|
{
|
|
proto = "tcp";
|
|
sourcePort = 6443;
|
|
destination = "10.128.0.4:6443";
|
|
}
|
|
{
|
|
proto = "tcp";
|
|
sourcePort = 6443;
|
|
destination = "fd12:3456:789a::2:6443";
|
|
}
|
|
{
|
|
proto = "tcp";
|
|
sourcePort = 6443;
|
|
destination = "fd12:3456:789a::3:6443";
|
|
}
|
|
{
|
|
proto = "tcp";
|
|
sourcePort = 6443;
|
|
destination = "fd12:3456:789a::4:6443";
|
|
}
|
|
];
|
|
};
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
kubectl
|
|
kubernetes-helm
|
|
];
|
|
}
|