{ config, pkgs, ... }:

{
  ########################################
  # k3s Single-Node (Traefik disabled)
  ########################################
  services.k3s = {
    enable = true;
    role = "server";
    # Initialize single-server cluster and disable bundled Traefik ingress.
    extraFlags = toString [
      "--cluster-init"
      "--disable=traefik"
      "--flannel-backend=vxlan"
    ];
  };

  ########################################
  # Firewall for k3s
  ########################################
  networking.firewall.enable = true;
  networking.firewall.allowedTCPPorts = [
    6443  # Kubernetes API
    10250 # Kubelet metrics
  ];

  networking.firewall.allowedUDPPorts = [
    8472  # flannel VXLAN
  ];
}