{ config, pkgs, ... }:

{
  ########################################
  # k3s Single-Node (Traefik disabled)
  ########################################
  services.k3s = {
    enable = true;
    role = "server";
    # Initialize single-server cluster and disable bundled Traefik ingress.
    extraFlags = toString [
      "--cluster-init"
      "--disable=traefik"
      "--flannel-backend=vxlan"
      "--tls-san=k8s.home.lindenfelser.de"
    ];
  };

  ########################################
  # Firewall for k3s
  ########################################
  networking.firewall.enable = true;
  networking.firewall.allowedTCPPorts = [
    6443  # Kubernetes API
    10250 # Kubelet metrics
    5000  # Docker Registry
  ];

  networking.firewall.allowedUDPPorts = [
    8472  # flannel VXLAN
  ];

  ########################################
  # Containerd registry configuration
  ########################################
  environment.etc."rancher/k3s/registries.yaml" = {
    text = ''
      mirrors:
        registry.home.lindenfelser.de:
          endpoint:
            - "https://10.202.82.7:5000"
      configs:
        "10.202.82.7:5000":
          tls:
            insecure_skip_verify: true
    '';
    mode = "0644";
  };
}