nixos-servers/nixos-modules/k3s/default.nix

{ pkgs, lib, config, kubenix, ... }:
let cfg = config.lab.k3s;
in {
  options.lab.k3s.enable = lib.mkOption {
    default = false;
    type = lib.types.bool;
    description = ''
      Whether to start k3s with custom configuration.
    '';
  };

  config = lib.mkIf cfg.enable {
    environment.systemPackages = with pkgs; [ k3s ];

    networking = {
      nftables.enable = lib.mkForce false;
      firewall.enable = lib.mkForce false;
    };

    services.k3s = {
      enable = true;
      role = "server";
      extraFlags = "--tls-san ${config.networking.fqdn} --disable servicelb";
    };

    system.activationScripts.k3s-bootstrap.text =
      let
        k3sBootstrapFile = (kubenix.evalModules.x86_64-linux {
          module = import ./bootstrap.nix;
        }).config.kubernetes.result;
      in
      ''
        mkdir -p /var/lib/rancher/k3s/server/manifests
        ln -sf ${k3sBootstrapFile} /var/lib/rancher/k3s/server/manifests/k3s-bootstrap.json
      '';
  };
}