mikl
1f960a53a5
Migrated muscari from nix-config-legacy (preserved for reference per
garden.md) to new multi-host flake structure.
Includes:
- hosts/muscari/default.nix: hostname, GRUB (BIOS), firewall
(22/80/443), SSH keys via forgejo .keys endpoint with sha256 pinning,
stateVersion 25.11
- hosts/muscari/disk-config.nix: disko config — 512M ESP + ext4 root,
device = /dev/vda (YC standard-v3 single virtio disk)
- hosts/muscari/k3s.nix: k3s single-node with --flannel-backend=none
(Cilium to be installed separately via Helm)
Architecture decisions (unchanged from legacy):
- Bootloader: GRUB (VM is in Legacy BIOS mode — see PREREQUISITES.md
check 5+11 in projects/servers/muscari/)
- Filesystem: ext4 root + vfat ESP (ESP unused in BIOS but ready if
ever switched to UEFI)
- Build deps: nixpkgs/nixos-25.11
Verification (after commit):
- nix flake show: nixosConfigurations.{muscari,rosemary} OK
- muscari.networking.hostName = "muscari"
- muscari.boot.loader.grub.enable = true
- muscari.boot.loader.systemd-boot.enable = false
- muscari.services.k3s.enable = true
- fileSystems derived correctly from disko
- poppy (darwin) and rosemary (NixOS) configs untouched
Session: verify plan
36 lines
No EOL
1.3 KiB
Nix
36 lines
No EOL
1.3 KiB
Nix
# k3s daemon для muscari (single-node + Cilium CNI)
|
||
# Traefik и servicelb остаются включены (встроенные в k3s)
|
||
# Cilium ставится отдельно через Helm после старта k3s
|
||
|
||
{ config, pkgs, lib, ... }:
|
||
{
|
||
services.k3s = {
|
||
enable = true;
|
||
extraFlags = [
|
||
# CNI: отключаем встроенный flannel, ставим Cilium отдельно
|
||
"--flannel-backend=none"
|
||
"--disable-network-policy" # Cilium сам делает network policy
|
||
|
||
# CIDR для подов и сервисов (default для k3s, но фиксируем явно)
|
||
"--cluster-cidr=10.42.0.0/16"
|
||
"--service-cidr=10.43.0.0/16"
|
||
|
||
# TLS SANs для kubectl (если подключаемся не только по IP)
|
||
"--tls-san=muscari.iscg.dev"
|
||
];
|
||
};
|
||
|
||
# Firewall: доверяем Cilium veth интерфейсам
|
||
networking.firewall = {
|
||
trustedInterfaces = [ "cali+" ];
|
||
checkReversePath = lib.mkDefault "loose";
|
||
};
|
||
|
||
# k3s-specific пакеты (НЕ в common — только для хостов с k3s)
|
||
environment.systemPackages = with pkgs; [
|
||
kubectl
|
||
kubernetes-helm
|
||
kustomize
|
||
sops # для шифрования k8s secrets (если будем через SOPS)
|
||
];
|
||
} |