create shared entrypoint nixos config for physical and vm

nixos/modules/k3s/bootstrap.nix

@@ -0,0 +1,16 @@
+{ kubenix, ... }: {
+  imports = [ kubenix.modules.k8s ];
+  kubernetes.resources.clusterRoleBindings.pim-cluster-admin = {
+    roleRef = {
+      apiGroup = "rbac.authorization.k8s.io";
+      kind = "ClusterRole";
+      name = "cluster-admin";
+    };
+    subjects = [
+      {
+        kind = "User";
+        name = "pim";
+      }
+    ];
+  };
+}

nixos/modules/k3s/default.nix

@@ -0,0 +1,32 @@
+{ pkgs, lib, config, kubenix, ... }:
+let cfg = config.lab.k3s;
+in {
+  options.lab.k3s.enable = lib.mkOption {
+    default = false;
+    type = lib.types.bool;
+    description = ''
+      Whether to start k3s with custom configuration.
+    '';
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.k3s ];
+    networking.firewall.allowedTCPPorts = [ 6443 ];
+
+    services.k3s = {
+      enable = true;
+      role = "server";
+      extraFlags = "--tls-san ${config.networking.fqdn} --data-dir ${config.lab.dataDisk.mountPoint}/k3s";
+    };
+
+    system.activationScripts.k3s-bootstrap.text =
+      let
+        k3sBootstrapFile = (kubenix.evalModules.x86_64-linux {
+          module = import ./bootstrap.nix;
+        }).config.kubernetes.result;
+      in
+      ''
+        ln -sf ${k3sBootstrapFile} ${config.lab.dataDisk.mountPoint}/k3s/server/manifests/k3s-bootstrap.json
+      '';
+  };
+}