botalex/nixos-server
1
0
Fork 0
mirror of https://github.com/MagicBOTAlex/nixos-server.git synced 2026-05-06 10:02:30 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

sync before update

Browse source
This commit is contained in:
BOTAlex 2026-05-01 19:06:13 +02:00
parent 8e1dd6fbb1
commit c6f54cc96a
6 changed files with 96 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

33
vms/kube-daddy/kubernetes.nix
View file

@ -63,6 +63,20 @@ in
exemptions:
namespaces: [ "kube-system" ]
'';
authConfig = pkgs.writeTextFile {
name = "authentication-config.yaml";
text = ''
issuer:
url: https://auth.deprived.dev/application/o/kubernetes-cluster/
audiences: kubernetes-cluster
claimMappings:
username:
claim: email
groups:
claim: groups
prefix: "oidc:"
'';
};
in
"--admission-control-config-file=${admissionConfig}";
};
@ -73,11 +87,28 @@ in
addons.dns.enable = true;
# needed if you use swap
kubelet.extraOpts = "--fail-swap-on=false --allow-privileged=true --resolv-conf=/run/systemd/resolve/resolv.conf";
kubelet.extraOpts = "--fail-swap-on=false --resolv-conf=/run/systemd/resolve/resolv.conf";
};
services.flannel = {
iface = "br0";
publicIp = "10.0.0.2";
};
systemd.services."cert-provider" = {
description = "serves the cert for control plane on wireguard interface";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStart = "${pkgs.python3}/bin/python3 -m http.server 33333 --bind 10.0.0.2";
# Restart settings
Restart = "always";
RestartSec = "5s";
WorkingDirectory = "/var/lib/kubernetes/secrets";
};
};
}