diff --git a/hosts/isaiah/default.nix b/hosts/isaiah/default.nix
index 7ed661e..817eaa2 100644
--- a/hosts/isaiah/default.nix
+++ b/hosts/isaiah/default.nix
@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  pkgs,
   top,
   ...
 }:
@@ -38,16 +37,8 @@
     supportedFilesystems = [ "ntfs" ];
   };
 
-  environment.systemPackages = with pkgs; [
-    curl
-    gawk
-    git
-    unzip
-    wget
-    zstd
-  ];
-
   greg = {
+    kubernetes.enable = true;
     tailscale.enable = true;
     remote-builder.enable = true;
   };
@@ -93,13 +84,6 @@
     useDHCP = false;
   };
 
-  nixpkgs = {
-    config = {
-      allowUnfree = true;
-      permittedInsecurePackages = [ "nodejs-16.20.2" ];
-    };
-  };
-
   services = {
     gitlab-runner = {
       enable = true;
@@ -133,50 +117,21 @@
             "/cache"
           ];
         };
-        # qemu = {
-        #   executor = "shell";
-        #   limit = 5;
-        #   authenticationTokenConfigFile = config.age.secrets.runner-qemu.path;
-        #   environmentVariables = {
-        #     EFI_DIR = "${pkgs.OVMF.fd}/FV/";
-        #     STORAGE_URL = "s3.thehellings.lan:9000";
-        #   };
-        # };
       };
     };
+    k3s.clusterInit = true; # This is the first node in the cluster
     openssh = {
       enable = true;
       settings.PermitRootLogin = "yes";
     };
-    proxmox-ve = {
-      enable = true;
-      ipAddress = (builtins.elemAt config.networking.interfaces.br0.ipv4.addresses 0).address;
-    };
   };
 
-  system.stateVersion = lib.mkForce "24.05";
-
   systemd.services.gitlab-runner = {
     after = [ "network-online.target" ];
     requires = [ "network-online.target" ];
   };
 
-  users = {
-    users = {
-      greg = {
-        extraGroups = [
-          "kvm"
-          "libvirtd"
-          "sudo"
-          "wheel"
-        ];
-        isNormalUser = true;
-      };
-    };
-  };
-
   virtualisation = {
-    podman.enable = true;
     libvirtd = {
       enable = true;
       allowedBridges = [
@@ -186,6 +141,5 @@
       onBoot = "ignore"; # only restart VMs labeled 'autostart'
       qemu.ovmf.enable = true;
     };
-    oci-containers.backend = "podman";
   };
 }
diff --git a/hosts/jude/default.nix b/hosts/jude/default.nix
index a28c35a..78cbdf7 100644
--- a/hosts/jude/default.nix
+++ b/hosts/jude/default.nix
@@ -103,8 +103,6 @@
     };
   };
 
-  nixpkgs.config.permittedInsecurePackages = [ "ventoy-1.1.05" ];
-
   programs = {
     adb.enable = true;
     steam.enable = true;
diff --git a/modules/nix-conf.nix b/modules/nix-conf.nix
index ec1dd2f..c94c061 100644
--- a/modules/nix-conf.nix
+++ b/modules/nix-conf.nix
@@ -55,6 +55,6 @@
   nixpkgs.config = {
     allowUnfree = true;
     allowUnfreePredicate = _: true;
-    permittedInsecurePackages = [ "jitsi-meet-1.0.8043" ];
+    permittedInsecurePackages = [ "ventoy-1.1.05" ];
   };
 }
diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix
index ba67899..5a26223 100644
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@@ -16,6 +16,7 @@
     ./home.nix
     ./kde.nix
     ./kiwix-serve.nix
+    ./kubernetes.nix
     ./linode.nix
     ./podman.nix
     ./print.nix
diff --git a/modules/nixos/kubernetes.nix b/modules/nixos/kubernetes.nix
new file mode 100644
index 0000000..f566ce8
--- /dev/null
+++ b/modules/nixos/kubernetes.nix
@@ -0,0 +1,32 @@
+{ config, lib, ... }:
+let
+  cfg = config.greg.kubernetes;
+in
+{
+  options.greg = {
+    kubernetes = {
+      enable = lib.mkEnableOption "kubernetes";
+      agentOnly = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to run the Kubernetes agent only";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    age.secrets.kubernetesToken.file = ../../secrets/kubernetes/kubernetesToken.age;
+
+    networking.firewall = {
+      allowedTCPPorts = [ 6443 ];
+      allowedUDPPorts = [ 8472 ];
+    };
+
+    services.k3s = {
+      enable = true;
+      role = if cfg.agentOnly then "agent" else "server";
+      tokenFile = config.age.secrets.kubernetesToken.path;
+      serverAddr = lib.mkIf (config.networking.hostName != "isaiah") "https://isaiah.home:6443";
+    };
+  };
+}
diff --git a/secrets/kubernetes/kubernetesToken.age b/secrets/kubernetes/kubernetesToken.age
new file mode 100644
index 0000000..bc610c8
Binary files /dev/null and b/secrets/kubernetes/kubernetesToken.age differ
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index c2f8077..6e94e1c 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -105,4 +105,10 @@ in
 
   "minio_secret_access_key.age".publicKeys = everyone;
   "minio_access_key_id.age".publicKeys = everyone;
+
+  "kubernetes/kubernetesToken.age".publicKeys = [
+    isaiah
+    user_isaiah
+    user_jude
+  ];
 }