{ config, pkgs, ... }:

let
  ip = (builtins.head config.networking.interfaces.enp1s0.ipv6.addresses).address;
  controlPlaneIps = ["fd00::1" "fd00::2" "fd00::3"];
  controlPlaneIpSet = builtins.concatStringsSep ", " controlPlaneIps;
in
{
  services.etcd = {
    enable = true;
    package = pkgs.etcd_3_6;
    trustedCaFile = config.age.secrets.etcd_ca_crt.path;
    peerTrustedCaFile = config.age.secrets.etcd_peer_ca_crt.path;
    peerClientCertAuth = true;
    listenPeerUrls = ["https://[${ip}]:2380"];
    listenClientUrls = ["https://[${ip}]:2379"];
    initialCluster = ["${config.services.etcd.name}=https://${ip}:2380"];
    clientCertAuth = true;
    #peerKeyFile = config.age.secrets.etcd_peer_key.path;
    #peerCertFile = config.age.secrets.etcd_peer_crt.path;
    #keyFile = config.age.secrets.etcd_server_key.path;
    #certFile = config.age.secrets.etcd_server_key.path;
  };
<<<<<<< HEAD

  networking.firewall.extraInputRules = ''
    ip6 saddr {${controlPlaneIpSet} ip6 daddr ${ip} tcp dport 2380 accept comment "Allow etcd peers"
    ip6 saddr {${controlPlaneIpSet} ip6 daddr ${ip} tcp dport 2379 accept comment "Allow etcd clients"
  '';
=======
>>>>>>> b9de4f3c256492a785e296898739a5e4674025fc
}