Remove k8s-server host

Drop k8s-server from flake, Makefile targets, modules
(kubernetes.nix, docker-registry.nix), install script and
hardware config. Remove related registry vhost, port 6443
and NAT rules from gateway.nix. Drop K8s-Server section
and dangling markdown wrapper from README.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

modules/docker-registry.nix

@@ -1,164 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  ########################################
-  # Docker Registry v2
-  ########################################
-  services.dockerRegistry = {
-    enable = true;
-    port = 5000;
-    listenAddress = "0.0.0.0";
-    
-    # Enable image deletion and garbage collection
-    enableDelete = true;
-    enableGarbageCollect = true;
-    garbageCollectDates = "Sun 03:00";
-    
-    # Storage location (root partition)
-    storagePath = "/var/lib/docker-registry";
-    
-    # TLS configuration (for internal access)
-    extraConfig = {
-      http = {
-        tls = {
-          certificate = "/var/lib/docker-registry/certs/registry.crt";
-          key = "/var/lib/docker-registry/certs/registry.key";
-        };
-      };
-    };
-  };
-
-  ########################################
-  # Firewall
-  ########################################
-  networking.firewall.allowedTCPPorts = [ 5000 ];
-
-  ########################################
-  # Setup: directories, certificates, htpasswd
-  ########################################
-  systemd.tmpfiles.rules = [
-    "d /var/lib/docker-registry 0755 root root -"
-    "d /var/lib/docker-registry/certs 0755 root root -"
-  ];
-
-  # Generate self-signed certificate
-  systemd.services.docker-registry-setup = {
-    description = "Docker Registry initial setup";
-    wantedBy = [ "multi-user.target" ];
-    before = [ "docker-registry.service" ];
-    path = with pkgs; [ openssl apacheHttpd ];
-    
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-    };
-    
-    script = ''
-      # Create self-signed certificate if it doesn't exist
-      if [ ! -f /var/lib/docker-registry/certs/registry.crt ]; then
-        echo "Generating self-signed certificate for Docker Registry..."
-        ${pkgs.openssl}/bin/openssl req -x509 -newkey rsa:4096 -nodes \
-          -keyout /var/lib/docker-registry/certs/registry.key \
-          -out /var/lib/docker-registry/certs/registry.crt \
-          -days 3650 \
-          -subj "/CN=registry.home.lindenfelser.de" \
-          -addext "subjectAltName=DNS:registry.home.lindenfelser.de,DNS:k8s-server,IP:10.202.82.7"
-        chmod 644 /var/lib/docker-registry/certs/registry.key
-        chmod 644 /var/lib/docker-registry/certs/registry.crt
-        echo "Certificate generated successfully"
-      fi
-      
-      # Ensure correct ownership
-      chown -R docker-registry:docker-registry /var/lib/docker-registry
-    '';
-  };
-
-  ########################################
-  # Storage Monitoring (80% threshold)
-  ########################################
-  systemd.services.docker-registry-storage-check = {
-    description = "Check Docker Registry storage usage";
-    path = with pkgs; [ coreutils util-linux ];
-    
-    serviceConfig = {
-      Type = "oneshot";
-      User = "root";
-    };
-    
-    script = ''
-      REGISTRY_PATH="/var/lib/docker-registry"
-      THRESHOLD=80
-      
-      if [ ! -d "$REGISTRY_PATH" ]; then
-        echo "Registry path does not exist yet"
-        exit 0
-      fi
-      
-      # Get disk usage percentage of the filesystem containing the registry
-      USAGE=$(df -h "$REGISTRY_PATH" | awk 'NR==2 {print $5}' | sed 's/%//')
-      REGISTRY_SIZE=$(du -sh "$REGISTRY_PATH" | cut -f1)
-      
-      echo "Docker Registry storage: $REGISTRY_SIZE (filesystem usage: $USAGE%)"
-      
-      if [ "$USAGE" -gt "$THRESHOLD" ]; then
-        echo "WARNING: Filesystem usage ($USAGE%) exceeds threshold ($THRESHOLD%)"
-        echo "Consider cleaning up old images or expanding storage"
-      fi
-    '';
-  };
-
-  systemd.timers.docker-registry-storage-check = {
-    description = "Timer for Docker Registry storage check";
-    wantedBy = [ "timers.target" ];
-    
-    timerConfig = {
-      OnCalendar = "daily";
-      Persistent = true;
-    };
-  };
-
-  ########################################
-  # Daily Storage Growth Tracking
-  ########################################
-  systemd.services.docker-registry-growth-tracker = {
-    description = "Track Docker Registry storage growth";
-    path = with pkgs; [ coreutils ];
-    
-    serviceConfig = {
-      Type = "oneshot";
-      User = "root";
-    };
-    
-    script = ''
-      REGISTRY_PATH="/var/lib/docker-registry"
-      LOG_FILE="/var/log/docker-registry-growth.log"
-      
-      if [ ! -d "$REGISTRY_PATH" ]; then
-        echo "Registry path does not exist yet"
-        exit 0
-      fi
-      
-      TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
-      SIZE_BYTES=$(du -sb "$REGISTRY_PATH" | cut -f1)
-      SIZE_HUMAN=$(du -sh "$REGISTRY_PATH" | cut -f1)
-      
-      echo "$TIMESTAMP | Size: $SIZE_HUMAN ($SIZE_BYTES bytes)" >> "$LOG_FILE"
-      
-      # Keep only last 90 days of logs
-      if [ -f "$LOG_FILE" ]; then
-        tail -n 90 "$LOG_FILE" > "$LOG_FILE.tmp"
-        mv "$LOG_FILE.tmp" "$LOG_FILE"
-      fi
-    '';
-  };
-
-  systemd.timers.docker-registry-growth-tracker = {
-    description = "Timer for Docker Registry growth tracking";
-    wantedBy = [ "timers.target" ];
-    
-    timerConfig = {
-      OnCalendar = "daily";
-      Persistent = true;
-    };
-  };
-}

modules/gateway.nix

@@ -42,20 +42,6 @@
           reverse_proxy 10.202.82.6:3000
         '';
       };
-      "registry.home.lindenfelser.de" = {
-        extraConfig = ''
-          @registry host registry.home.lindenfelser.de
-          basicauth @registry {
-            admin $2a$14$Ga5BCiHvtlfRjdnlI9bhseFnNZ8dwXsLz4t1FdSemA1mAUV/vA1oi
-          }
-          reverse_proxy @registry https://10.202.82.7:5000 {
-            transport http {
-              tls
-              tls_insecure_skip_verify
-            }
-          }
-        '';
-      };
     };
   };
 
@@ -69,7 +55,6 @@
     80    # HTTP (Caddy)
     443   # HTTPS (Caddy)
     2222  # External SSH to Gitea
-    6443  # Kubernetes API to k8s-server
   ];
 
   networking.firewall.allowedUDPPorts = [
@@ -85,7 +70,6 @@
     # Hairpin NAT for LAN clients hitting gateway:2222 so replies go back via gateway
     extraCommands = ''
       iptables -t nat -A POSTROUTING -p tcp -d 10.202.82.6 --dport 2222 -j MASQUERADE
-      iptables -t nat -A POSTROUTING -p tcp -d 10.202.82.7 --dport 6443 -j MASQUERADE
     '';
     forwardPorts = [
       {
@@ -93,11 +77,6 @@
         sourcePort = 2222;
         destination = "10.202.82.6:2222";
       }
-      {
-        proto = "tcp";
-        sourcePort = 6443;
-        destination = "10.202.82.7:6443";
-      }
     ];
   };
 }

modules/kubernetes.nix

@@ -1,49 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  ########################################
-  # k3s Single-Node (Traefik disabled)
-  ########################################
-  services.k3s = {
-    enable = true;
-    role = "server";
-    # Initialize single-server cluster and disable bundled Traefik ingress.
-    extraFlags = toString [
-      "--cluster-init"
-      "--disable=traefik"
-      "--flannel-backend=vxlan"
-      "--tls-san=k8s.home.lindenfelser.de"
-    ];
-  };
-
-  ########################################
-  # Firewall for k3s
-  ########################################
-  networking.firewall.enable = true;
-  networking.firewall.allowedTCPPorts = [
-    6443  # Kubernetes API
-    10250 # Kubelet metrics
-    5000  # Docker Registry
-  ];
-
-  networking.firewall.allowedUDPPorts = [
-    8472  # flannel VXLAN
-  ];
-
-  ########################################
-  # Containerd registry configuration
-  ########################################
-  environment.etc."rancher/k3s/registries.yaml" = {
-    text = ''
-      mirrors:
-        registry.home.lindenfelser.de:
-          endpoint:
-            - "https://10.202.82.7:5000"
-      configs:
-        "10.202.82.7:5000":
-          tls:
-            insecure_skip_verify: true
-    '';
-    mode = "0644";
-  };
-}