From fa302301af9539ee0f26c5f6dd7437338fd362dc Mon Sep 17 00:00:00 2001
From: Greg Hellings <greg.hellings@gmail.com>
Date: Mon, 19 May 2025 20:10:21 -0500
Subject: [PATCH] Isaiah spin up

Bring Isaiah back into commission, this time as the core of my k3s
cluster. Standing up the basic serverInit, and also creating the core
server components that are needed.
---
 hosts/isaiah/default.nix               |  50 +------------------------
 hosts/jude/default.nix                 |   2 -
 modules/nix-conf.nix                   |   2 +-
 modules/nixos/default.nix              |   1 +
 modules/nixos/kubernetes.nix           |  32 ++++++++++++++++
 secrets/kubernetes/kubernetesToken.age | Bin 0 -> 509 bytes
 secrets/secrets.nix                    |   6 +++
 7 files changed, 42 insertions(+), 51 deletions(-)
 create mode 100644 modules/nixos/kubernetes.nix
 create mode 100644 secrets/kubernetes/kubernetesToken.age

diff --git a/hosts/isaiah/default.nix b/hosts/isaiah/default.nix
index 7ed661e..817eaa2 100644
--- a/hosts/isaiah/default.nix
+++ b/hosts/isaiah/default.nix
@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  pkgs,
   top,
   ...
 }:
@@ -38,16 +37,8 @@
     supportedFilesystems = [ "ntfs" ];
   };
 
-  environment.systemPackages = with pkgs; [
-    curl
-    gawk
-    git
-    unzip
-    wget
-    zstd
-  ];
-
   greg = {
+    kubernetes.enable = true;
     tailscale.enable = true;
     remote-builder.enable = true;
   };
@@ -93,13 +84,6 @@
     useDHCP = false;
   };
 
-  nixpkgs = {
-    config = {
-      allowUnfree = true;
-      permittedInsecurePackages = [ "nodejs-16.20.2" ];
-    };
-  };
-
   services = {
     gitlab-runner = {
       enable = true;
@@ -133,50 +117,21 @@
             "/cache"
           ];
         };
-        # qemu = {
-        #   executor = "shell";
-        #   limit = 5;
-        #   authenticationTokenConfigFile = config.age.secrets.runner-qemu.path;
-        #   environmentVariables = {
-        #     EFI_DIR = "${pkgs.OVMF.fd}/FV/";
-        #     STORAGE_URL = "s3.thehellings.lan:9000";
-        #   };
-        # };
       };
     };
+    k3s.clusterInit = true; # This is the first node in the cluster
     openssh = {
       enable = true;
       settings.PermitRootLogin = "yes";
     };
-    proxmox-ve = {
-      enable = true;
-      ipAddress = (builtins.elemAt config.networking.interfaces.br0.ipv4.addresses 0).address;
-    };
   };
 
-  system.stateVersion = lib.mkForce "24.05";
-
   systemd.services.gitlab-runner = {
     after = [ "network-online.target" ];
     requires = [ "network-online.target" ];
   };
 
-  users = {
-    users = {
-      greg = {
-        extraGroups = [
-          "kvm"
-          "libvirtd"
-          "sudo"
-          "wheel"
-        ];
-        isNormalUser = true;
-      };
-    };
-  };
-
   virtualisation = {
-    podman.enable = true;
     libvirtd = {
       enable = true;
       allowedBridges = [
@@ -186,6 +141,5 @@
       onBoot = "ignore"; # only restart VMs labeled 'autostart'
       qemu.ovmf.enable = true;
     };
-    oci-containers.backend = "podman";
   };
 }
diff --git a/hosts/jude/default.nix b/hosts/jude/default.nix
index a28c35a..78cbdf7 100644
--- a/hosts/jude/default.nix
+++ b/hosts/jude/default.nix
@@ -103,8 +103,6 @@
     };
   };
 
-  nixpkgs.config.permittedInsecurePackages = [ "ventoy-1.1.05" ];
-
   programs = {
     adb.enable = true;
     steam.enable = true;
diff --git a/modules/nix-conf.nix b/modules/nix-conf.nix
index ec1dd2f..c94c061 100644
--- a/modules/nix-conf.nix
+++ b/modules/nix-conf.nix
@@ -55,6 +55,6 @@
   nixpkgs.config = {
     allowUnfree = true;
     allowUnfreePredicate = _: true;
-    permittedInsecurePackages = [ "jitsi-meet-1.0.8043" ];
+    permittedInsecurePackages = [ "ventoy-1.1.05" ];
   };
 }
diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix
index ba67899..5a26223 100644
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@@ -16,6 +16,7 @@
     ./home.nix
     ./kde.nix
     ./kiwix-serve.nix
+    ./kubernetes.nix
     ./linode.nix
     ./podman.nix
     ./print.nix
diff --git a/modules/nixos/kubernetes.nix b/modules/nixos/kubernetes.nix
new file mode 100644
index 0000000..f566ce8
--- /dev/null
+++ b/modules/nixos/kubernetes.nix
@@ -0,0 +1,32 @@
+{ config, lib, ... }:
+let
+  cfg = config.greg.kubernetes;
+in
+{
+  options.greg = {
+    kubernetes = {
+      enable = lib.mkEnableOption "kubernetes";
+      agentOnly = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to run the Kubernetes agent only";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    age.secrets.kubernetesToken.file = ../../secrets/kubernetes/kubernetesToken.age;
+
+    networking.firewall = {
+      allowedTCPPorts = [ 6443 ];
+      allowedUDPPorts = [ 8472 ];
+    };
+
+    services.k3s = {
+      enable = true;
+      role = if cfg.agentOnly then "agent" else "server";
+      tokenFile = config.age.secrets.kubernetesToken.path;
+      serverAddr = lib.mkIf (config.networking.hostName != "isaiah") "https://isaiah.home:6443";
+    };
+  };
+}
diff --git a/secrets/kubernetes/kubernetesToken.age b/secrets/kubernetes/kubernetesToken.age
new file mode 100644
index 0000000000000000000000000000000000000000..bc610c8dd48451988ef29f689fefd70d16b772e9
GIT binary patch
literal 509
zcmZ9_yNlCs003Y)Z!wOdgNG1xjIm9dm>#H*rg^pI*)(ZyOY>}AziZm2Y1TV#I?%y_
z9GnO`INl@(&Q@<wTpS!lbURPwcK7@KfzR??)J^Sdu{|Au^e)K!N{&J3LwGU?P}ivu
z1hxrVgBsPR;O?+bJE3O}NkdMJW)^b<A2xiQMvS6R5^~Vd(wV7jWq}H@nKMhrWw#9y
zK3^y?i4__mxV(jtb;TM1Tp$xC59(uPetwG_B`;Oj(==XYExVpj!PN9Lep`GL_9PDJ
zdd<WXio5_CUDxuMo<mg=Ga{kQR^^T{6C!fX6-2+jsq{E{tA~s@eOT@10n@5>!1-+|
z^A%o&Z7MUYPE62Yd%{T*j@8nIQ$|UD+6?Y#f{#~%u$5QwvL!-28w(js=XA5-Pjyo@
zC9y_j-3210+@dCzqK#udplVc)flw5M$B9fzCLnZ*Rh99Ovs4?`krL#9D+!#5Rm_S5
zm!3r}0JVM&-ZR&h>xb;?U-r$_&d$3BAJz>Sy81);Du~OCw<ljdJ-&SMq_`x-XL~om
z@!Huuda--|pmFimZ}HCa=01OWiS0)#<JFbDl{dcreeKx+?SA~@{`-75dAc#&{dRiv
M_rlSe<I|Vkf4gV3TL1t6

literal 0
HcmV?d00001

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index c2f8077..6e94e1c 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -105,4 +105,10 @@ in
 
   "minio_secret_access_key.age".publicKeys = everyone;
   "minio_access_key_id.age".publicKeys = everyone;
+
+  "kubernetes/kubernetesToken.age".publicKeys = [
+    isaiah
+    user_isaiah
+    user_jude
+  ];
 }