use k3s instead

common/core.nix

@@ -6,6 +6,7 @@
   programs.nix-ld.enable = true;
   security.sudo.wheelNeedsPassword = false;
   system.stateVersion = "25.11";
+  environment.enableAllTerminfo = true;
 
   nix = {
     settings = {

flake.nix

@@ -1,6 +1,18 @@
 {
   description = "Black Start essential infrastructure for cloud operations";
 
+  nixConfig = {
+    substituters = [
+      "https://nix-cache.dubyatp.xyz/duby"
+      "https://cache.nixos.org/"
+    ];
+
+    trusted-public-keys = [
+      "duby:IUVsFbQu499JOaHmUpi/mwhZEVQK7soFn7H6lD2/2T4="
+      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+    ];
+  };
+
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
 
@@ -27,6 +39,7 @@
           ./security/security.nix
           ./disko/uefi-nosecure.nix
           ./users/users.nix
+          ./kubernetes/kubernetes.nix
           {
             config.boot = {
               loader = {
@@ -72,5 +85,7 @@
         };
       };
     };
+
+    packages.x86_64-linux.attic = nixpkgs.legacyPackages.x86_64-linux.attic-client;
   };
 }

kubernetes/kubernetes.nix

@@ -0,0 +1,8 @@
+{
+  networking.firewall.allowedTCPPorts = [6443];
+  
+  services.k3s = {
+    enable = true;
+    role = "server";
+  };
+}