---
#
# Bootstrap configuration - config.yaml is gitignored
#

# Distribution can either be 'k3s', 'k0s', or 'talos'
bootstrap_distribution: k3s

# Github username (e.g. onedr0p)
bootstrap_github_username:
# Github repository (e.g. flux-cluster-template)
bootstrap_github_repository_name:
# Age Public Key (e.g. age15uzrw396e67z9wdzsxzdk7ka0g2gr3l460e0slaea563zll3hdfqwqxdta)
bootstrap_age_public_key:
# Choose your timezone (e.g. America/New_York)
bootstrap_timezone: Etc/UTC
# Email you want to be associated with the ACME account (used for TLS certs via letsencrypt.org)
bootstrap_acme_email:
# Use the ACME production env when requesting the wildcard certificate.
#   By default the ACME staging server is used. This is to prevent being rate-limited.
#   Update this option to `true` when you have verified the staging certificate
#   works and then re-run `task configure` and push your changes to Github.
bootstrap_acme_production_enabled: false

# Flux github webhook token (openssl rand -hex 12)
bootstrap_flux_github_webhook_token:

# Cloudflare domain
bootstrap_cloudflare_domain:
# Cloudflare API Token (NOT API Key)
bootstrap_cloudflare_token:
# Cloudflared Account Tag (cat ~/.cloudflared/*.json | jq -r .AccountTag)
bootstrap_cloudflare_account_tag:
# Cloudflared Tunnel Secret (cat ~/.cloudflared/*.json | jq -r .TunnelSecret)
bootstrap_cloudflare_tunnel_secret:
# Cloudflared Tunnel ID (cat ~/.cloudflared/*.json | jq -r .TunnelID)
bootstrap_cloudflare_tunnel_id:

# CIDR your nodes are on (e.g. 192.168.1.0/24)
bootstrap_node_cidr:

# The IP address of the Kube API, choose an available IP in your nodes
#   network that is NOT being used. This is announced over L2.
bootstrap_kube_api_addr:
# The Load balancer IP for k8s_gateway, choose an available IP in your nodes
#   network that is NOT being used. This is announced over L2.
bootstrap_k8s_gateway_addr:
# The Load balancer IP for external ingress, choose an available IP in your nodes
#   network that is NOT being used. This is announced over L2.
bootstrap_external_ingress_addr:
# The Load balancer IP for internal ingress, choose an available IP in your nodes
#   network that is NOT being used. This is announced over L2.
bootstrap_internal_ingress_addr:

# Add additional SANs to the Kube API cert, this is useful if you want
#   to call the Kube API by hostname rather than IP
bootstrap_kube_additional_tls_sans: []

# The DNS server to use for the cluster, this can be an existing local DNS server or a public one
# If using a local DNS server make sure it meets the following requirements:
#   1. your nodes can reach it
#   2. it is configured to forward requests to a public DNS server
#   3. you are not force redirecting DNS requests to it - this will break cert generation over DNS01
bootstrap_dns_server: 1.1.1.1

# The pod CIDR for the cluster, this must NOT overlap with any existing networks
#   If you want to use IPv6 check the advanced flags below
bootstrap_cluster_cidr: 10.42.0.0/16
# The service CIDR for the cluster, this must NOT overlap with any existing networks
#   If you want to use IPv6 check the advanced flags below
bootstrap_service_cidr: 10.43.0.0/16

# Node information
bootstrap_nodes:
  # Use only 1, 3 or more odd master nodes, recommended is 3
  master:
    # - name:       # name or hostname of the master node (must match [a-z0-9-\.]+)
    #   address:    # ip address of the master node
    #   username:   # ssh username of the master node
    #   diskSerial: # (Required: Talos) Serial number of Disk for this master node
    # ...
  worker:           # set to [] or omit if no workers are needed
    # - name:       # name or hostname of the worker node (must match [a-z0-9-\.]+)
    #   address:    # ip address of the worker node
    #   username:   # ssh username of the worker node
    #   diskSerial: # (Required: Talos) Serial number of Disk for this worker node
    # ...

#
# Do not make changes below this line unless you know what you are doing
# These options are not validated and may break your cluster
#

# bootstrap_advanced_flags:
#   # Change the default Github repository branch
#   github_repository_branch: main
#
#   # Disable to prevent changes to nodes /etc/resolv.conf
#   update_resolv_conf: true
#
#   # Cilium load balancer mode, choose either 'dsr' or 'snat'
#   # Due to unknown reasons some people need this set to 'snat' in order
#   # for Cilium L2 announcements to work properly. Keep this dsr unless
#   # you have issues with connecting to Cilium L2 announcements.
#   cilium_loadbalancer_mode: dsr
#
#   # Path for openebs openebs-hostpath to use for storage on ALL nodes
#   local_storage_path: /var/openebs/local
#
#   # Enable Dual Stack IPv4 first
#   # IMPORTANT: I am looking for people to help maintain IPv6 support since I cannot test it.
#   # https://github.com/onedr0p/flux-cluster-template/issues/1148
#   # Keep in mind that Cilium does not currently support IPv6 L2 announcements.
#   # Make sure you set bootstrap_cluster_cidr and bootstrap_service_cidr
#   # to a valid dual stack CIDRs, e.g. "10.42.0.0/16,fd00:10:244::/64"
#   dual_stack_ipv4_first: false