k3s: init

flake.nix

@@ -34,6 +34,7 @@
         ./modules/applications/1password.nix
         ./modules/services/archiveteam-warrior.nix
         ./modules/services/linkding.nix
+        ./modules/services/k3s.nix
 
         ./modules/nix/linux.nix
         ./modules/shell.nix

modules/services/k3s.nix

@@ -0,0 +1,12 @@
+{ config, ... }:
+
+{
+  services.k3s = {
+    enable = true;
+    role = "server";
+  };
+
+  networking.firewall.allowedTCPPorts = [
+    6443 # k3s: required so that pods can reach the API server (running on port 6443 by default)
+  ];
+}