{ config, lib, pkgs, ... }:

let
  tailscaleIP = "100.x.x.x";
in {
  networking.hostName = "rpi4-1";

  services.k3s-cluster = {
    enable = true;
    role = "agent";
    serverAddr = "https://100.x.x.x:6443";  # n97-1 IP
    tailscaleIP = tailscaleIP;
    tokenFile = "/var/lib/k3s/cluster-token";
  };

  # ARM worker — light services only
  # Taints/tolerations will be set via kubectl to prevent x86 pods landing here

  networking.firewall = {
    enable = true;
    trustedInterfaces = [ "tailscale0" ];
  };

  users.users.sscoble = {
    isNormalUser = true;
    extraGroups = [ "wheel" ];
  };

  security.sudo.extraRules = [{
    users = [ "sscoble" ];
    commands = [{ command = "ALL"; options = [ "NOPASSWD" ]; }];
  }];

  nix.settings.experimental-features = [ "nix-command" "flakes" ];
  nix.settings.trusted-users = [ "sscoble" ];
}