From ee57154a67a835d09aaea385f6e5c9acba7ad3ab Mon Sep 17 00:00:00 2001
From: Lemon Lam <alemonmk@users.noreply.github.com>
Date: Sat, 7 Mar 2026 23:34:56 +0800
Subject: [PATCH] nixos/warpgate: add options for Kubernetes listener

---
 nixos/modules/services/security/warpgate.nix | 32 ++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/nixos/modules/services/security/warpgate.nix b/nixos/modules/services/security/warpgate.nix
index a9fb7ed438f6..b7b7a886e9f9 100644
--- a/nixos/modules/services/security/warpgate.nix
+++ b/nixos/modules/services/security/warpgate.nix
@@ -282,6 +282,38 @@ in
                 type = str;
               };
             };
+            kubernetes = {
+              enable = mkOption {
+                description = "Whether to enable Kubernetes listener.";
+                default = false;
+                type = bool;
+              };
+              listen = mkOption {
+                description = "Listen endpoint of Kubernetes listener.";
+                default = "[::]:8443";
+                type = str;
+              };
+              external_port = mkOption {
+                description = "The Kubernetes listener is reachable via this port externally.";
+                default = null;
+                type = nullOr str;
+              };
+              certificate = mkOption {
+                description = "Path to Kubernetes listener certificate.";
+                default = "/var/lib/warpgate/tls.certificate.pem";
+                type = str;
+              };
+              key = mkOption {
+                description = "Path to Kubernetes listener private key.";
+                default = "/var/lib/warpgate/tls.key.pem";
+                type = str;
+              };
+              session_max_age = mkOption {
+                description = "How long until a logged in session expires.";
+                default = "30m";
+                type = str;
+              };
+            };
             log = {
               format = mkOption {
                 description = "The format Warpgate emits logs in.";