Add k8s-server configuration and deployment scripts

modules/gateway.nix

@@ -55,6 +55,7 @@
     80    # HTTP (Caddy)
     443   # HTTPS (Caddy)
     2222  # External SSH to Gitea
+    6443  # Kubernetes API to k8s-server
   ];
 
   networking.firewall.allowedUDPPorts = [
@@ -70,6 +71,7 @@
     # Hairpin NAT for LAN clients hitting gateway:2222 so replies go back via gateway
     extraCommands = ''
       iptables -t nat -A POSTROUTING -p tcp -d 10.202.82.6 --dport 2222 -j MASQUERADE
+      iptables -t nat -A POSTROUTING -p tcp -d 10.202.82.7 --dport 6443 -j MASQUERADE
     '';
     forwardPorts = [
       {
@@ -77,6 +79,11 @@
         sourcePort = 2222;
         destination = "10.202.82.6:2222";
       }
+      {
+        proto = "tcp";
+        sourcePort = 6443;
+        destination = "10.202.82.7:6443";
+      }
     ];
   };
 }

modules/kubernetes.nix

@@ -0,0 +1,30 @@
+{ config, pkgs, ... }:
+
+{
+  ########################################
+  # k3s Single-Node (Traefik disabled)
+  ########################################
+  services.k3s = {
+    enable = true;
+    role = "server";
+    # Initialize single-server cluster and disable bundled Traefik ingress.
+    extraFlags = toString [
+      "--cluster-init"
+      "--disable=traefik"
+      "--flannel-backend=vxlan"
+    ];
+  };
+
+  ########################################
+  # Firewall for k3s
+  ########################################
+  networking.firewall.enable = true;
+  networking.firewall.allowedTCPPorts = [
+    6443  # Kubernetes API
+    10250 # Kubelet metrics
+  ];
+
+  networking.firewall.allowedUDPPorts = [
+    8472  # flannel VXLAN
+  ];
+}