wip

nixos/common/k3s.nix

@@ -0,0 +1,17 @@
+{
+  config,
+  meta,
+  ...
+}: {
+  services.k3s = {
+    enable = true;
+    role = meta.role;
+    tokenFile = config.age.secrets.k3s.path;
+    clusterInit = config.networking.hostName == "premhome-gc1";
+    serverAddr =
+      if config.networking.hostName == "premhome-gc1"
+      then ""
+      else "https://${meta.server-addr}:6443";
+    extraFlags = ["--disable=servicelb" "--disable=traefik" "--node-ip ${meta.zt-ip}" "--flannel-iface ztxh6lvd6t" "--flannel-backend=host-gw" "--tls-san ${meta.zt-ip}"];
+  };
+}

nixos/common/zerotier.nix

@@ -1,24 +1,11 @@
 {config, ...}: {
-  age.secrets.zerotier.file = ../secrets/zerotier-network.age;
-
   services.zerotierone = {
     enable = true;
   };
 
   networking = {
     firewall = {
-      interfaces."zts23oi5io".allowedTCPPortRanges = [
-        {
-          from = 0;
-          to = 65535;
-        }
-      ];
-      interfaces."zts23oi5io".allowedUDPPortRanges = [
-        {
-          from = 0;
-          to = 65535;
-        }
-      ];
+      trustedInterfaces = ["ztxh6lvd6t"];
     };
   };
 }