kubernauts/iac
Watch
0
0
Fork
You've already forked iac
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

🔥

Browse source
This commit is contained in:
XenGi 2026-08-27 23:35:11 +02:00
commit b2e7fde9ec
Signed by: xengi
SSH key fingerprint: SHA256:dM+fLZGsDvyv6kunjE8bGduL24VsCFB4LEOSdmRHdG0
14 changed files with 131 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

24
services/etcd.nix
View file

@ -1,9 +1,29 @@
{ pkgs, ... }:
{ config, pkgs, ... }:
let
ip = (builtins.head config.networking.interfaces.enp1s0.ipv6.addresses).address;
controlPlaneIps = ["fd00::1" "fd00::2" "fd00::3"];
controlPlaneIpSet = builtins.concatStringsSep ", " controlPlaneIps;
in
{
services.etcd = {
enable = true;
package = pkgs.etcd_3_6;
trustedCaFile = config.age.secrets.etcd_ca_crt.path;
peerTrustedCaFile = config.age.secrets.etcd_peer_ca_crt.path;
peerClientCertAuth = true;
listenPeerUrls = ["https://[${ip}]:2380"];
listenClientUrls = ["https://[${ip}]:2379"];
initialCluster = ["${config.services.etcd.name}=https://${ip}:2380"];
clientCertAuth = true;
#peerKeyFile = config.age.secrets.etcd_peer_key.path;
#peerCertFile = config.age.secrets.etcd_peer_crt.path;
#keyFile = config.age.secrets.etcd_server_key.path;
#certFile = config.age.secrets.etcd_server_key.path;
};
}
networking.firewall.extraInputRules = ''
ip6 saddr {${controlPlaneIpSet} ip6 daddr ${ip} tcp dport 2380 accept comment "Allow etcd peers"
ip6 saddr {${controlPlaneIpSet} ip6 daddr ${ip} tcp dport 2379 accept comment "Allow etcd clients"
'';
}