From ea5309eff190a7870649b534384fa2b03f61e8ea Mon Sep 17 00:00:00 2001
From: hektor <hektor.misplon@pm.me>
Date: Fri, 12 Jun 2026 20:29:45 +0200
Subject: [PATCH] feat(k8s): declare 'talos' modules

---
 home/hosts/andromache/default.nix |  7 ++++++-
 home/modules/k8s/default.nix      |  7 +++++++
 home/modules/k8s/talos.nix        | 12 +++++++++++
 hosts/andromache/default.nix      |  1 +
 modules/k8s/crossplane.nix        |  5 -----
 modules/k8s/default.nix           | 35 ++++++++++++++++++++++++++++++-
 modules/k8s/talos.nix             | 29 +++++++++++++++++++++++++
 7 files changed, 89 insertions(+), 7 deletions(-)
 create mode 100644 home/modules/k8s/talos.nix
 create mode 100644 modules/k8s/talos.nix

diff --git a/home/hosts/andromache/default.nix b/home/hosts/andromache/default.nix
index b4892b8..68f4ac8 100644
--- a/home/hosts/andromache/default.nix
+++ b/home/hosts/andromache/default.nix
@@ -40,7 +40,12 @@
     gitea.enable = true;
     github.enable = true;
   };
-  k8s.k9s.enable = true;
+  k8s = {
+    enable = true;
+    k9s.enable = true;
+    talos.enable = true;
+  };
+  keyboard.vortexCore.enable = true;
   keepassxc.enable = true;
   music.enable = true;
   newsboat.enable = true;
diff --git a/home/modules/k8s/default.nix b/home/modules/k8s/default.nix
index 04838e0..e964b27 100644
--- a/home/modules/k8s/default.nix
+++ b/home/modules/k8s/default.nix
@@ -24,12 +24,19 @@ in
         type = lib.types.bool;
       };
     };
+    talos = {
+      enable = lib.mkOption {
+        default = false;
+        type = lib.types.bool;
+      };
+    };
   };
 
   imports = [
     ./crossplane.nix
     ./helm.nix
     ./k9s.nix
+    ./talos.nix
   ];
 
   config = lib.mkIf cfg.enable {
diff --git a/home/modules/k8s/talos.nix b/home/modules/k8s/talos.nix
new file mode 100644
index 0000000..bb4f2d1
--- /dev/null
+++ b/home/modules/k8s/talos.nix
@@ -0,0 +1,12 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  config = lib.mkIf config.k8s.talos.enable {
+    home.packages = [ pkgs.talosctl ];
+  };
+}
diff --git a/hosts/andromache/default.nix b/hosts/andromache/default.nix
index ad6ac57..6ac1a5f 100644
--- a/hosts/andromache/default.nix
+++ b/hosts/andromache/default.nix
@@ -55,6 +55,7 @@ in
   };
   desktop.ly.enable = true;
   docker.enable = true;
+  k8s.enable = true;
   hcloud.enable = true;
   networking = {
     enable = true;
diff --git a/modules/k8s/crossplane.nix b/modules/k8s/crossplane.nix
index 29e718a..4122361 100644
--- a/modules/k8s/crossplane.nix
+++ b/modules/k8s/crossplane.nix
@@ -1,11 +1,6 @@
 { config, lib, ... }:
 
 {
-  options.k8s.crossplane.enable = lib.mkOption {
-    default = false;
-    type = lib.types.bool;
-  };
-
   config = lib.mkIf config.k8s.crossplane.enable {
     nixpkgs.allowedUnfree = [ "upbound" ];
   };
diff --git a/modules/k8s/default.nix b/modules/k8s/default.nix
index 98e8c57..5ff1241 100644
--- a/modules/k8s/default.nix
+++ b/modules/k8s/default.nix
@@ -1,3 +1,36 @@
+{ config, lib, ... }:
+
 {
-  imports = [ ./crossplane.nix ];
+  imports = [
+    ./crossplane.nix
+    ./talos.nix
+  ];
+
+  options.k8s = {
+    enable = lib.mkOption {
+      default = false;
+      type = lib.types.bool;
+    };
+    crossplane.enable = lib.mkOption {
+      default = false;
+      type = lib.types.bool;
+    };
+    talos = {
+      enable = lib.mkOption {
+        default = false;
+        type = lib.types.bool;
+      };
+      platform = lib.mkOption {
+        default = "qemu";
+        type = lib.types.enum [
+          "docker"
+          "qemu"
+        ];
+      };
+    };
+  };
+
+  config = lib.mkIf config.k8s.enable {
+    k8s.talos.enable = lib.mkDefault true;
+  };
 }
diff --git a/modules/k8s/talos.nix b/modules/k8s/talos.nix
new file mode 100644
index 0000000..d19dc7d
--- /dev/null
+++ b/modules/k8s/talos.nix
@@ -0,0 +1,29 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (config.host) username;
+in
+{
+  config = lib.mkIf config.k8s.talos.enable (
+    lib.mkMerge [
+      (lib.mkIf (config.k8s.talos.platform == "docker") {
+        docker.enable = true;
+        assertions = [
+          {
+            assertion = !config.docker.rootless;
+            message = "talos in docker needs 'docker.rootless = false;'";
+          }
+        ];
+      })
+      (lib.mkIf (config.k8s.talos.platform == "qemu") {
+        users.users.${username}.extraGroups = [ "kvm" ];
+        environment.systemPackages = [ pkgs.qemu ];
+      })
+    ]
+  );
+}