From e9b3e5961c30f9654acc85c1efa76e706f06f22f Mon Sep 17 00:00:00 2001
From: aaron <aaron@0x29a.ch>
Date: Wed, 7 Oct 2026 16:05:46 +0200
Subject: [PATCH] feature(docker): make changes to the rootless docker setup to
 support the netgame webapp which relies on k3d and traefik

---
 modules/nixos/docker.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/modules/nixos/docker.nix b/modules/nixos/docker.nix
index c06235c..bf2b1c6 100644
--- a/modules/nixos/docker.nix
+++ b/modules/nixos/docker.nix
@@ -12,4 +12,10 @@
       registry-mirrors = [ "https://mirror.gcr.io" ];
     };
   };
+
+  # k3s/k3d in rootless docker needs the cpuset controller delegated to the user session
+  systemd.services."user@".serviceConfig.Delegate = "cpu cpuset io memory pids";
+
+  # let rootless docker publish ports 80/443 (e.g. k3d traefik ingress)
+  boot.kernel.sysctl."net.ipv4.ip_unprivileged_port_start" = 80;
 }