home/nixos-servers
home/nixos-servers
Archived
2
0
Fork 0
Code Issues 8 Pull requests Projects Releases Packages Wiki Activity Actions

Replace agenix with sops-nix

Browse source
This commit is contained in:
Pim Kunis 2024-06-15 22:27:07 +02:00
parent bb1f091fbb
commit 726beabb9c
33 changed files with 296 additions and 332 deletions
Download patch file Download diff file Expand all files Collapse all files

48
nixos-modules/k3s/default.nix
View file

@ -1,4 +1,4 @@
{ self, inputs, pkgs, lib, config, ... }:
{ inputs, pkgs, lib, config, ... }:
let cfg = config.lab.k3s;
in {
options.lab.k3s = {
@ -56,7 +56,7 @@ in {
{
enable = true;
role = cfg.role;
tokenFile = config.age.secrets.k3s-server-token.path;
tokenFile = config.sops.secrets."k3s/serverToken".path;
extraFlags = lib.mkIf (cfg.role == "server") serverFlags;
clusterInit = cfg.clusterInit;
serverAddr = lib.mkIf (! (cfg.serverAddr == null)) cfg.serverAddr;
@ -101,38 +101,18 @@ in {
};
};
age.secrets = {
k3s-server-token.file = "${self}/secrets/k3s-server-token.age";
k3s-server-ca-key = lib.mkIf (cfg.role == "server") {
file = "${self}/secrets/k3s-ca/server-ca.key.age";
path = "/var/lib/rancher/k3s/server/tls/server-ca.key";
sops.secrets =
let
keyPathBase = "/var/lib/rancher/k3s/server/tls";
in
{
"k3s/serverToken" = { };
"k3s/keys/clientCAKey".path = "${keyPathBase}/client-ca.key";
"k3s/keys/requestHeaderCAKey".path = "${keyPathBase}/request-header-ca.key";
"k3s/keys/serverCAKey".path = "${keyPathBase}/server-ca.key";
"k3s/keys/serviceKey".path = "${keyPathBase}/service.key";
"k3s/keys/etcd/peerCAKey".path = "${keyPathBase}/etcd/peer-ca.key";
"k3s/keys/etcd/serverCAKey".path = "${keyPathBase}/etcd/server-ca.key";
};
k3s-client-ca-key = lib.mkIf (cfg.role == "server") {
file = "${self}/secrets/k3s-ca/client-ca.key.age";
path = "/var/lib/rancher/k3s/server/tls/client-ca.key";
};
k3s-request-header-ca-key = lib.mkIf (cfg.role == "server") {
file = "${self}/secrets/k3s-ca/request-header-ca.key.age";
path = "/var/lib/rancher/k3s/server/tls/request-header-ca.key";
};
k3s-etcd-peer-ca-key = lib.mkIf (cfg.role == "server") {
file = "${self}/secrets/k3s-ca/etcd/peer-ca.key.age";
path = "/var/lib/rancher/k3s/server/tls/etcd/peer-ca.key";
};
k3s-etcd-server-ca-key = lib.mkIf (cfg.role == "server") {
file = "${self}/secrets/k3s-ca/etcd/server-ca.key.age";
path = "/var/lib/rancher/k3s/server/tls/etcd/server-ca.key";
};
k3s-service-key = lib.mkIf (cfg.role == "server") {
file = "${self}/secrets/k3s-ca/service.key.age";
path = "/var/lib/rancher/k3s/server/tls/service.key";
};
};
};
}