{ config, lib, pkgs, ... }:

let
  tailscaleIP = "100.x.x.x";
in {
  networking.hostName = "n97-2";

  services.k3s-cluster = {
    enable = true;
    role = "agent";
    serverAddr = "https://100.x.x.x:6443";  # n97-1 IP
    tailscaleIP = tailscaleIP;
    tokenFile = "/var/lib/k3s/cluster-token";
    withOllama = true;
  };

  # Ollama models to serve
  services.ollama.models = [
    "deepseek-v4-pro:cloud"  # heavy reasoning
    "kimi-k2.6:cloud"        # backup reasoning
    "glm-5.1:cloud"          # fallback
  ];

  networking.firewall = {
    enable = true;
    trustedInterfaces = [ "tailscale0" ];
    allowedTCPPorts = [ 11434 ];
  };

  users.users.sscoble = {
    isNormalUser = true;
    extraGroups = [ "wheel" ];
  };

  security.sudo.extraRules = [{
    users = [ "sscoble" ];
    commands = [{ command = "ALL"; options = [ "NOPASSWD" ]; }];
  }];

  nix.settings.experimental-features = [ "nix-command" "flakes" ];
  nix.settings.trusted-users = [ "sscoble" ];
}