cluster/nix/defs-cluster-k0.nix

machineName:

let
  machines = (import ./defs-machines.nix);
in rec {
  domain = ".hswaw.net";
  k8sapi = "k0.hswaw.net";
  acmeEmail = "q3k@hackerspace.pl";

  fqdn = machineName + domain;
  machine = (builtins.head (builtins.filter (n: n.fqdn == fqdn) machines));
  otherMachines = (builtins.filter (n: n.fqdn != fqdn) machines);
  machinesByName = builtins.listToAttrs (map (m: { name = m.name; value = m; }) machines);
  inherit machines;

  # Ceph cluster to run systemd modules for.
  cephCluster = {
    fsid = "74592dc2-31b7-4dbe-88cf-40459dfeb354";
    name = "k0";

    # Map from node name to mon configuration (currently always empty).
    #
    # Each mon also runs a mgr daemon (which is a leader-elected kitchen
    # sink^W^Whousekeeping service hanging off of a mon cluster).
    #
    # Consult the Ceph documentation
    # (https://docs.ceph.com/en/pacific/rados/operations/add-or-rm-mons/) on
    # how to actually carry out mon-related maintenance operations.
    mons = {
      bc01n02 = {};
    };

    # Map from node name to list of disks on node.
    # Each disk is:
    #  id:   OSD numerical ID, eg. 0 for osd.0. You get this after running
    #        ceph-lvm volume create.
    #  path: Filesystem path for disk backing drive. This should be something
    #        in /dev/disk/by-id for safety. This is only used to gate OSD
    #        daemon startup by disk presence.
    #  uuid: OSD uuid/fsid. You get this after running ceph-lvm volume create.
    #
    # Quick guide how to set up a new OSD (but please refer to the Ceph manual):
    # 0. Copy /var/lib/ceph/bootstrap-osd/k0.keyring from another OSD node to
    #    the new OSD node, if this is a new node. Remember to chown ceph:ceph
    #    chmod 0600!
    # 1. nix-shell -p ceph lvm2 cryptsetup (if on a node that's not yet an OSD)
    # 2. ceph-volume --cluster k0 lvm create --bluestore --data /dev/sdX --no-systemd --dmcrypt
    # 3. The above will mount a tmpfs on /var/lib/ceph/osd/k0-X. X is the new
    #    osd id. A file named fsid inside this directory is the new OSD fsid/uuid.
    # 4. Configure osds below with the above information, redeploy node from nix.
    osds = {
      dcr01s22 = [
        { id = 0; path = "/dev/disk/by-id/scsi-35000c500850293e3"; uuid = "314034c5-474c-4d0d-ba41-36a881c52560";}
        { id = 1; path = "/dev/disk/by-id/scsi-35000c500850312cb"; uuid = "a7f1baa0-0fc3-4ab1-9895-67abdc29de03";}
        { id = 2; path = "/dev/disk/by-id/scsi-35000c5008508e3ef"; uuid = "11ac8316-6a87-48a7-a0c7-74c3cef6c2fa";}
        { id = 3; path = "/dev/disk/by-id/scsi-35000c5008508e23f"; uuid = "c6b838d1-b08c-4788-936c-293041ed2d4d";}
      ];
      dcr01s24 = [
        { id = 4; path = "/dev/disk/by-id/scsi-35000c5008509199b"; uuid = "a2b4663d-bd8f-49b3-b0b0-195c56ba252f";}
        { id = 5; path = "/dev/disk/by-id/scsi-35000c50085046abf"; uuid = "a2242989-ccce-4367-8813-519b64b5afdb";}
        { id = 6; path = "/dev/disk/by-id/scsi-35000c5008502929b"; uuid = "7deac89c-22dd-4c2b-b3cc-43ff7f990fd6";}
        { id = 7; path = "/dev/disk/by-id/scsi-35000c5008502a323"; uuid = "e305ebb3-9cac-44d2-9f1d-bbb72c8ab51f";}
      ];
    };
  };

  pki = rec {
    make = (radix: name: rec {
      ca = ./../certs + "/ca-${radix}.crt";
      cert = ./../certs + "/${radix}-${name}.cert";
      key = ./../secrets/plain + "/${radix}-${name}.key";

      json = (builtins.toJSON {
        ca = (builtins.toString ca);
        cert = (builtins.toString cert);
        key = (builtins.toString key);
      });
    });

    etcdPeer = (make "etcdpeer" fqdn);

    etcd = {
        server = (make "etcd" fqdn);
        kube = (make "etcd" "kube");
    };

    makeKube = (name: (make "kube" name) // {
      config = {
        server = "https://${k8sapi}:${toString ports.k8sAPIServerSecure}";
        certFile = (make "kube" name).cert;
        keyFile = (make "kube" name).key;
      };
    });

    kube = rec {
      ca = apiserver.ca;
      
      # Used to identify apiserver.
      apiserver = (makeKube "apiserver");

      # Used to identify controller-manager.
      controllermanager = (makeKube "controllermanager");

      # Used to identify scheduler.
      scheduler = (makeKube "scheduler");

      # Used to identify kube-proxy.
      proxy = (makeKube "proxy");

      # Used to identify kubelet.
      kubelet = (makeKube "kubelet-${fqdn}");

      # Used to encrypt service accounts.
      serviceaccounts = (makeKube "serviceaccounts");
    };

    kubeFront = {
      apiserver = (make "kubefront" "apiserver");
    };
  };

  ports = {
    k8sAPIServerPlain = 4000;
    k8sAPIServerSecure = 4001;
    k8sControllerManagerPlain = 0; # would be 4002; do not serve plain http
    k8sControllerManagerSecure = 4003;
    k8sSchedulerPlain = 0; # would be 4004; do not serve plain http
    k8sSchedulerSecure = 4005;
  };
}