home-cluster/config.sample.yaml

---
# (Required) Distribution can either be k3s, k0s, or talos
distribution: ""

# (Required) IANA formatted timezone (e.g. America/New_York)
timezone: ""

# (Required) Cluster details
cluster:
  # (Required) The nodes section is used to configure your cluster nodes
  nodes:
    # (Required) CIDR your nodes are on (e.g. 192.168.1.0/24)
    host_network: ""
    # (Required) The DNS server to use for the cluster, this can be an existing
    #   local DNS server or a public one
    # If using a local DNS server make sure it meets the following requirements:
    #   1. your nodes can reach it
    #   2. it is configured to forward requests to a public DNS server
    #   3. you are not force redirecting DNS requests to it - this will break cert generation over DNS01
    # If using multiple DNS servers make sure they are setup the same way,
    #   there is no guarantee that the first DNS server will be used.
    dns_servers:
      - "1.1.1.1"
    # (Optional) The DNS search domain to use for the nodes.
    # Leave this option blank to avoid possible DNS issues inside the cluster.
    search_domain: ""
    # (Required) Use only 1, 3 or more ODD number of controller nodes, recommended is 3
    #   Worker nodes are optional
    inventory: []
      # - name: ""               # Name of the node (must match [a-z0-9-\.]+)
      #   address: ""            # IP address of the node
      #   controller: true       # (Required) Set to true if this is a controller node
      #   ssh_username: ""       # (Required: k3s/k0s) SSH username of the node
      #   talos_disk_device: ""  # (Required: Talos) Device Path or Serial number of Disk for this node
      # ...
  # (Required) The pod CIDR for the cluster, this must NOT overlap with any
  #   existing networks and is usually a /16 (64K IPs).
  # If you want to use IPv6 check the advanced flags below
  pod_network: 10.69.0.0/16
  # (Required) The service CIDR for the cluster, this must NOT overlap with any
  #   existing networks and is usually a /16 (64K IPs).
  # If you want to use IPv6 check the advanced flags below
  service_network: 10.96.0.0/16
  # (Required) The IP address of the Kube API, choose an available IP in
  #   your nodes host network that is NOT being used. This is announced over L2.
  endpoint_vip: ""
  # (Optional) Add additional SANs to the Kube API cert, this is useful
  #   if you want to call the Kube API by hostname rather than IP
  tls_sans: []

# (Required) Flux details
# IMPORTANT: All options are ignored if flux is disabled and no resources
#   outside Cilium and kube-vip (k0s/k3s) will be deployed to your cluster.
flux:
  # (Required) Disable to use a different tool (e.g. kubectl, Argo, Kluctl)
  enabled: true
  # (Required) Options for Github
  github:
    # (Required) Github repository URL (for private repos use the ssh:// URL)
    address: ""
    # (Required) Github repository branch
    branch: main
    # (Required) Options for Flux Github webhook
    webhook:
      # (Required) Enable to use Github push-based sync
      enabled: true
      # Token for Github push-based sync (openssl rand -hex 16)
      token: ""
  # (Required) Age Public Key (e.g. age15uzrw396e67z9wdzsxzdk7ka0g2gr3l460e0slaea563zll3hdfqwqxdta)
  sops_age_public_key: ""

# (Required) Cloudflare details - Cloudflare is used for DNS, TLS certificates and tunneling.
# IMPORTANT: All options are ignored if cloudflare is disabled and no resources
#   outside a bare Flux setup will be deployed to your cluster if Flux is enabled.
cloudflare:
  # (Required) Disable to use a different DNS provider
  enabled: true
  # (Required) Cloudflare Domain
  domain: ""
  # (Required) Cloudflare API Token (NOT API Key)
  token: ""
  # (Required) Optionals for Cloudflare Acme
  acme:
    # (Required) Email you want to be associated with the ACME account (used for TLS certs via letsencrypt.org)
    email: ""
    # (Required) Use the ACME production server when requesting the wildcard certificate.
    #   By default the ACME staging server is used. This is to prevent being rate-limited.
    #   Update this option to `true` when you have verified the staging certificate
    #   works and then re-run `task configure` and push your changes to Github.
    production: false
  # (Required) Provide LAN access to the cluster ingresses for internal ingress classes
  # The Load balancer IP for internal ingress, choose an available IP
  #   in your nodes host network that is NOT being used. This is announced over L2.
  ingress_vip: ""
  # (Required) Gateway is used for providing DNS to your cluster on LAN
  # The Load balancer IP for k8s_gateway, choose an available IP
  #   in your nodes host network that is NOT being used. This is announced over L2.
  gateway_vip: ""
  # (Required) Options for Cloudflare Tunnel
  tunnel:
    # (Required) Cloudflare Account ID (cat ~/.cloudflared/*.json | jq -r .AccountTag)
    account_id: ""
    # (Required) Cloudflared Tunnel ID (cat ~/.cloudflared/*.json | jq -r .TunnelID)
    id: ""
    # (Required) Cloudflared Tunnel Secret (cat ~/.cloudflared/*.json | jq -r .TunnelSecret)
    secret: ""
    # (Required) Provide WAN access to the cluster ingresses for external ingress classes
    # The Load balancer IP for external ingress, choose an available IP
    #   in your nodes host network that is NOT being used. This is announced over L2.
    ingress_vip: ""

# (Optional) Feature gates are used to enable experimental features
feature_gates:
  # Enable Dual Stack IPv4 first
  # IMPORTANT: I am looking for people to help maintain IPv6 support since I cannot test it.
  #   Ref: https://github.com/onedr0p/cluster-template/issues/1148
  # Keep in mind that Cilium does not currently support IPv6 L2 announcements.
  # Make sure you set cluster.pod_cidr and cluster.service_cidr
  #   to a valid dual stack CIDRs, e.g. "10.42.0.0/16,fd00:10:244::/64"
  dual_stack_ipv4_first: false