32 lines
1.2 KiB
Nix
32 lines
1.2 KiB
Nix
{ config, pkgs, ... }:
|
|
|
|
let
|
|
ip = (builtins.head config.networking.interfaces.enp1s0.ipv6.addresses).address;
|
|
controlPlaneIps = ["fd00::1" "fd00::2" "fd00::3"];
|
|
controlPlaneIpSet = builtins.concatStringsSep ", " controlPlaneIps;
|
|
in
|
|
{
|
|
services.etcd = {
|
|
enable = true;
|
|
package = pkgs.etcd_3_6;
|
|
trustedCaFile = config.age.secrets.etcd_ca_crt.path;
|
|
peerTrustedCaFile = config.age.secrets.etcd_peer_ca_crt.path;
|
|
peerClientCertAuth = true;
|
|
listenPeerUrls = ["https://[${ip}]:2380"];
|
|
listenClientUrls = ["https://[${ip}]:2379"];
|
|
initialCluster = ["${config.services.etcd.name}=https://${ip}:2380"];
|
|
clientCertAuth = true;
|
|
#peerKeyFile = config.age.secrets.etcd_peer_key.path;
|
|
#peerCertFile = config.age.secrets.etcd_peer_crt.path;
|
|
#keyFile = config.age.secrets.etcd_server_key.path;
|
|
#certFile = config.age.secrets.etcd_server_key.path;
|
|
};
|
|
<<<<<<< HEAD
|
|
|
|
networking.firewall.extraInputRules = ''
|
|
ip6 saddr {${controlPlaneIpSet} ip6 daddr ${ip} tcp dport 2380 accept comment "Allow etcd peers"
|
|
ip6 saddr {${controlPlaneIpSet} ip6 daddr ${ip} tcp dport 2379 accept comment "Allow etcd clients"
|
|
'';
|
|
=======
|
|
>>>>>>> b9de4f3c256492a785e296898739a5e4674025fc
|
|
}
|