services:
  k3s-server:
    image: rancher/k3s:v1.36.2-k3s1
    container_name: k3s-server
    command:
      - server
      - --tls-san=127.0.0.1
      - --tls-san=k3s-server
      - --disable=traefik
    privileged: true
    restart: unless-stopped
    environment:
      K3S_TOKEN: ${K3S_TOKEN:-supersecrettoken}
      K3S_KUBECONFIG_OUTPUT: /output/kubeconfig.yaml
      K3S_KUBECONFIG_MODE: "644"
    ports:
      - "6443:6443"   # kube-apiserver
      - "80:80"        # ingress http
      - "443:443"      # ingress https
    volumes:
      - k3s-server-data:/var/lib/rancher/k3s   # etcd/state, образы, манифесты — только named volume
      - ./k3s:/output                   # отсюда забираем контекст k8s
    tmpfs:
      - /run
      - /var/run
    ulimits:
      nproc: 65535
      nofile:
        soft: 65535
        hard: 65535
    healthcheck:
      test: ["CMD", "kubectl", "get", "--raw=/readyz"]
      interval: 10s
      timeout: 5s
      retries: 30
      start_period: 30s

  k3s-worker:
    image: rancher/k3s:v1.36.2-k3s1
    container_name: k3s-worker
    command:
      - agent
    privileged: true
    restart: unless-stopped
    depends_on:
      k3s-server:
        condition: service_healthy
    environment:
      K3S_URL: https://k3s-server:6443
      K3S_TOKEN: ${K3S_TOKEN:-supersecrettoken}
    volumes:
      - k3s-worker-data:/var/lib/rancher/k3s
    tmpfs:
      - /run
      - /var/run
    ulimits:
      nproc: 65535
      nofile:
        soft: 65535
        hard: 65535

volumes:
  k3s-server-data:
  k3s-worker-data: