sbc-deploys/modules/k3s/default.nix

{
  server = { pkgs, ... }: {
    networking.firewall.enable = false;

    boot.kernelModules = [ "ceph" ];

    environment.systemPackages = with pkgs; [
      k3s
      (writeShellScriptBin "kubectl" (builtins.readFile ./kubectl))
    ];

    services.k3s = {
      enable = true;
      extraFlags = "--disable traefik --disable servicelb";
      role = "server";
    };
  };

  agent = { serverIp }: { config, ... }: {
    networking.firewall.enable = false;

    boot.kernelModules = [ "ceph" ];

    sops.secrets.k3s_token = {
      format = "yaml";
      sopsFile = ../../secrets/k3s.yaml;
    };

    services.k3s = {
      enable = true;
      role = "agent";
      serverAddr = "https://${serverIp}:6443";
      tokenFile = config.sops.secrets.k3s_token.path;
    };
  };
}