feat: add zerotier

nixos/server/premhome-gc1/configuration.nix

@@ -1,13 +1,16 @@
 {
   config,
+  meta,
   pkgs,
   ...
 }: {
-  imports = [../../common/users.nix];
+  imports = [../../common/users.nix ../../common/zerotier.nix];
   nix = {
     settings.experimental-features = ["nix-command" "flakes"];
   };
 
+  nixpkgs.config.allowUnfree = true;
+
   networking.hostName = "premhome-gc1";
 
   age.secrets.k3s.file = ../../secrets/k3s.age;
@@ -16,6 +19,10 @@
   # grub.device is set by disko
   boot.tmp.cleanOnBoot = true;
 
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+  };
+
   services.openssh.enable = true;
   services.qemuGuest.enable = true;
 
@@ -23,7 +30,27 @@
     git
     neovim
     wget
+    jq
+    ripgrep
+    fd
   ];
 
+  networking = {
+    nftables.enable = true;
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [22 80 443];
+      trustedInterfaces = ["zts23oi5io"];
+    };
+  };
+
+  services.k3s = {
+    enable = true;
+    role = "server";
+    tokenFile = config.age.secrets.k3s.path;
+    clusterInit = true;
+    extraFlags = ["--disable=servicelb" "--disable=traefik" "--node-ip ${meta.zt-ip}" "--flannel-iface zts23oi5io"];
+  };
+
   system.stateVersion = "24.11";
 }