k3s: allow traefik dashboard port 8969

This reverts commit 8b65c53a11.

hosts/goyplex-vm/configuration.nix

@@ -4,6 +4,7 @@
   imports = [
     ./hardware-configuration.nix
     ../../modules
+    ../../modules/k3s/k3s.nix
   ];
 
   boot.loader.systemd-boot.enable = true;

modules/core/packages/dev.nix

@@ -5,6 +5,7 @@
     neovim
     git
     tree-sitter
+    yamlfmt
     gcc
 
     # lua

modules/core/zsh/.zshrc

@@ -17,7 +17,7 @@ alias gs='git status'
 
 alias hermes='docker exec -it -u hermes hermes-agent /data/current-package/bin/hermes'
 
-alias hermes-age='cd /etc/rice-flakes/modules/hermes/secrets && sudo EDITOR=nvim agenix -e ./hermes-env.age -i /etc/ssh/ssh_host_ed25519_key'
+alias hermes-age='cd /etc/rice-flakes/modules/hermes/secrets && sudo EDITOR=nvim agenix -e hermes-env.age -i /etc/ssh/ssh_host_ed25519_key'
 
 ga() {
   if [[ -z "$1" ]]; then

modules/hermes/hermes.nix

@@ -1,7 +1,6 @@
 {
   inputs,
   config,
-  pkgs,
   ...
 }:
 
@@ -45,8 +44,8 @@
       };
 
       delegation = {
-        model = "openai/gpt-5.6-luna";
-        provider = "nous";
+        model = "us.anthropic.claude-sonnet-5";
+        provider = "bedrock";
       };
 
       discord = {
@@ -61,24 +60,4 @@
     9119
     8642
   ];
-
-  systemd = {
-    timers.hermes-perms-maintenance = {
-      description = "Periodically fix hermes file permissions";
-      wantedBy = [ "timers.target" ];
-      timerConfig = {
-        OnBootSec = "10s";
-        OnUnitActiveSec = "30s";
-      };
-    };
-
-    services.hermes-perms-maintenance = {
-      description = "Fix hermes file permissions for gateway access";
-      serviceConfig = {
-        Type = "oneshot";
-        ExecStartPre = "${pkgs.findutils}/bin/find /var/lib/hermes/.hermes/ -type d -not -perm -2770 -exec ${pkgs.coreutils}/bin/chmod 2770 {} +";
-        ExecStart = "${pkgs.findutils}/bin/find /var/lib/hermes/.hermes/ -type f -not -perm -0660 -exec ${pkgs.coreutils}/bin/chmod 660 {} +";
-      };
-    };
-  };
 }

modules/k3s/k3s.nix

@@ -0,0 +1,25 @@
+{
+  networking.firewall.allowedTCPPorts = [
+    6443
+    80
+    443
+    8969
+    33073
+  ];
+  networking.firewall.allowedUDPPorts = [ 3479 ];
+
+  services.k3s = {
+    enable = true;
+    role = "server";
+    extraFlags = "--write-kubeconfig-mode 644";
+  };
+
+  fileSystems."/var/lib/rancher/k3s/server/manifests/apps" = {
+    device = "/home/poslop/k3s/apps";
+    fsType = "none";
+    options = [
+      "bind"
+      "ro"
+    ];
+  };
+}