feat: convert template-base into k8s-ready VM template

nixos/template-base/configuration.nix

@@ -1,11 +1,15 @@
 { lib, pkgs, ... }:
 
+let
+  pinnedK8s = lib.attrByPath [ "kubernetes_1_31" ] pkgs.kubernetes pkgs;
+in
+
 {
   imports =
     lib.optional (builtins.pathExists ./hardware-configuration.nix)
       ./hardware-configuration.nix;
 
-  networking.hostName = "nixos-template";
+  networking.hostName = "k8s-base-template";
   networking.useDHCP = lib.mkDefault true;
   networking.nameservers = [ "1.1.1.1" "8.8.8.8" ];
 
@@ -17,13 +21,37 @@
 
   services.qemuGuest.enable = true;
   services.openssh.enable = true;
-  services.tailscale.enable = true;
   services.openssh.settings = {
     PasswordAuthentication = false;
     KbdInteractiveAuthentication = false;
     PermitRootLogin = "prohibit-password";
   };
 
+  boot.kernelModules = [ "overlay" "br_netfilter" ];
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+    "net.bridge.bridge-nf-call-iptables" = 1;
+    "net.bridge.bridge-nf-call-ip6tables" = 1;
+  };
+
+  virtualisation.containerd.enable = true;
+  virtualisation.containerd.settings = {
+    plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options.SystemdCgroup = true;
+  };
+
+  swapDevices = lib.mkForce [ ];
+
+  nix.settings = {
+    trusted-users = [ "root" "micqdf" ];
+    auto-optimise-store = true;
+  };
+
+  nix.gc = {
+    automatic = true;
+    dates = "daily";
+    options = "--delete-older-than 3d";
+  };
+
   programs.fish.enable = true;
 
   users.users.micqdf = {
@@ -36,16 +64,27 @@
 
   environment.systemPackages = with pkgs; [
     btop
+    cni-plugins
+    conntrack-tools
+    containerd
+    cri-tools
     curl
     dig
+    ebtables
+    ethtool
     eza
     fd
     fzf
     git
     htop
+    iproute2
+    iptables
+    ipvsadm
     jq
+    kubernetes-helm
+    pinnedK8s
     ripgrep
-    tailscale
+    socat
     tree
     unzip
     vim