From 434e6dfb975d7ef03bf0622fb324141573091b4f Mon Sep 17 00:00:00 2001
From: poslop <poslop@archfox.org>
Date: Thu, 30 Jul 2026 21:05:15 -0500
Subject: [PATCH] k3s: allow traefik dashboard port 8969

---
 modules/k3s/k3s.nix | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/modules/k3s/k3s.nix b/modules/k3s/k3s.nix
index 9f0b0e4..d5310cc 100644
--- a/modules/k3s/k3s.nix
+++ b/modules/k3s/k3s.nix
@@ -1,5 +1,11 @@
 {
-  networking.firewall.allowedTCPPorts = [ 6443 80 443 33073 ];
+  networking.firewall.allowedTCPPorts = [
+    6443
+    80
+    443
+    8969
+    33073
+  ];
   networking.firewall.allowedUDPPorts = [ 3479 ];
 
   services.k3s = {
@@ -8,19 +14,12 @@
     extraFlags = "--write-kubeconfig-mode 644";
   };
 
-  # k3s manifests live in a separate repo (git.archfox.org/poslop/k3s),
-  # cloned at /home/poslop/k3s. Bind-mounting (not symlinking!) into
-  # k3s's manifest dir lets k3s's native recursive directory watch pick
-  # up new/changed files automatically -- no nixos-rebuild, no kubectl
-  # apply needed for changes under apps/. Symlinked dirs are explicitly
-  # NOT picked up by k3s's watcher (see k3s-io/k3s#9288), hence bind mount.
-  #
-  # TODO: once Flux is set up, replace this bind mount with a Flux
-  # GitRepository/Kustomization pointing at the same repo, and remove
-  # this fileSystems entry.
   fileSystems."/var/lib/rancher/k3s/server/manifests/apps" = {
     device = "/home/poslop/k3s/apps";
     fsType = "none";
-    options = [ "bind" "ro" ];
+    options = [
+      "bind"
+      "ro"
+    ];
   };
 }