Isaiah spin up

Bring Isaiah back into commission, this time as the core of my k3s
cluster. Standing up the basic serverInit, and also creating the core
server components that are needed.

modules/nix-conf.nix

@@ -55,6 +55,6 @@
   nixpkgs.config = {
     allowUnfree = true;
     allowUnfreePredicate = _: true;
-    permittedInsecurePackages = [ "jitsi-meet-1.0.8043" ];
+    permittedInsecurePackages = [ "ventoy-1.1.05" ];
   };
 }

modules/nixos/default.nix

@@ -16,6 +16,7 @@
     ./home.nix
     ./kde.nix
     ./kiwix-serve.nix
+    ./kubernetes.nix
     ./linode.nix
     ./podman.nix
     ./print.nix

modules/nixos/kubernetes.nix

@@ -0,0 +1,32 @@
+{ config, lib, ... }:
+let
+  cfg = config.greg.kubernetes;
+in
+{
+  options.greg = {
+    kubernetes = {
+      enable = lib.mkEnableOption "kubernetes";
+      agentOnly = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to run the Kubernetes agent only";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    age.secrets.kubernetesToken.file = ../../secrets/kubernetes/kubernetesToken.age;
+
+    networking.firewall = {
+      allowedTCPPorts = [ 6443 ];
+      allowedUDPPorts = [ 8472 ];
+    };
+
+    services.k3s = {
+      enable = true;
+      role = if cfg.agentOnly then "agent" else "server";
+      tokenFile = config.age.secrets.kubernetesToken.path;
+      serverAddr = lib.mkIf (config.networking.hostName != "isaiah") "https://isaiah.home:6443";
+    };
+  };
+}