Merge branch 'kubernetes'

modules/custom/data-disk.nix

@@ -3,17 +3,35 @@ let cfg = config.custom.dataDisk;
 in {
   options = {
     custom = {
-      dataDisk.enable = lib.mkOption {
-        default = false;
-        type = lib.types.bool;
-        description = ''
-          Whether to automatically mount /dev/sda1 on /mnt/data
-        '';
+      dataDisk = {
+        enable = lib.mkOption {
+          default = false;
+          type = lib.types.bool;
+          description = ''
+            Whether to automatically mount a disk to be used as a data disk.
+          '';
+        };
+
+        mountPoint = lib.mkOption {
+          default = "/mnt/data";
+          type = lib.types.str;
+          description = ''
+            Mount point of the data disk (if enabled).
+          '';
+        };
+
+        devicePath = lib.mkOption {
+          default = "/dev/sda1";
+          type = lib.types.str;
+          description = ''
+            Path of the device to be used as a data disk.
+          '';
+        };
       };
     };
   };
 
   config = lib.mkIf cfg.enable {
-    fileSystems."/mnt/data" = { device = "/dev/sda1"; };
+    fileSystems.${cfg.mountPoint} = { device = cfg.devicePath; };
   };
 }

modules/custom/default.nix

@@ -1,3 +1,3 @@
 {
-  imports = [ ./terraform-database.nix ./data-disk.nix ./ssh-certificates.nix ];
+  imports = [ ./terraform-database.nix ./data-disk.nix ./ssh-certificates.nix ./k3s.nix ];
 }

modules/custom/k3s-bootstrap.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: pim-cluster-admin
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+- apiGroup: rbac.authorization.k8s.io
+  kind: User
+  name: pim

modules/custom/k3s.nix

@@ -0,0 +1,31 @@
+{ pkgs, lib, config, ... }:
+let cfg = config.custom.k3s;
+in {
+  options = {
+    custom = {
+      k3s.enable = lib.mkOption {
+        default = false;
+        type = lib.types.bool;
+        description = ''
+          Whether to start k3s with custom configuration.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.k3s ];
+    services.k3s.enable = true;
+    services.k3s.role = "server";
+    services.k3s.extraFlags = "--tls-san ${config.networking.fqdn} --data-dir ${config.custom.dataDisk.mountPoint}/k3s";
+
+    # TODO: use kubenix for this.
+    system.activationScripts.k3s-bootstrap.text =
+      let
+        k3sBootstrapFile = pkgs.writeText "k3s-bootstrap" (builtins.readFile ./k3s-bootstrap.yaml);
+      in
+      ''
+        ln -sf ${k3sBootstrapFile} ${config.custom.dataDisk.mountPoint}/k3s/server/manifests/k3s-bootstrap.yaml
+      '';
+  };
+}

modules/custom/terraform-database.nix

@@ -20,19 +20,21 @@ in {
       package = pkgs.postgresql_15;
       enableTCPIP = true;
       dataDir = lib.mkIf config.custom.dataDisk.enable
-        "/mnt/data/postgresql/${config.services.postgresql.package.psqlSchema}";
+        "${config.custom.dataDisk.mountPoint}/postgresql/${config.services.postgresql.package.psqlSchema}";
       authentication = ''
         hostssl terraformstates terraform all cert
       '';
-      settings = let
-        serverCert = builtins.toFile "postgresql_server.crt"
-          (builtins.readFile ../../postgresql_server.crt);
-      in {
-        ssl = true;
-        ssl_cert_file = serverCert;
-        ssl_key_file = config.age.secrets."postgresql_server.key".path;
-        ssl_ca_file = serverCert;
-      };
+      settings =
+        let
+          serverCert = builtins.toFile "postgresql_server.crt"
+            (builtins.readFile ../../postgresql_server.crt);
+        in
+        {
+          ssl = true;
+          ssl_cert_file = serverCert;
+          ssl_key_file = config.age.secrets."postgresql_server.key".path;
+          ssl_ca_file = serverCert;
+        };
       ensureUsers = [{
         name = "terraform";
         ensurePermissions = { "DATABASE terraformstates" = "ALL PRIVILEGES"; };