docs: use default SSH key name, install kubectl, fix .kube dir

Rename k8s's key from the custom k3s_homelab to the default
id_ed25519 - the custom name had no real justification (k8s is a
fresh account with nothing to collide with) and caused a real bug:
OpenSSH only auto-offers default-named keys, so ssh commands lacking
an explicit -i silently failed to authenticate. Also add the
never-actually-documented kubectl install step, and mkdir -p ~/.kube
before the first redirect into it, in both SETUP.md and QUICKSTART.md.

docs/QUICKSTART.md

@@ -10,7 +10,7 @@ and provision the "real" 3-node cluster properly instead.
 Shares steps 1–4 of `docs/SETUP.md` as prerequisites — do those first if you
 haven't:
 - Step 1: KVM/libvirt installed on the T630.
-- Step 2: the unprivileged `k8s` user exists, with `~/.ssh/k3s_homelab`
+- Step 2: the unprivileged `k8s` user exists, with `~/.ssh/id_ed25519`
   generated.
 - Step 3: `openssl rand -hex 32` isn't needed here (no agents joining, so no
   cluster token) — skip it.
@@ -92,7 +92,7 @@ virsh -c qemu:///system vol-list --pool default   # should list both volumes
 ```
 
 Write the cloud-init user-data — paste in the contents of
-`~/.ssh/k3s_homelab.pub` where marked:
+`~/.ssh/id_ed25519.pub` where marked:
 
 ```sh
 mkdir -p ~/vms
@@ -107,7 +107,7 @@ users:
     shell: /bin/bash
     sudo: ALL=(ALL) NOPASSWD:ALL
     ssh_authorized_keys:
-      - PASTE ~/.ssh/k3s_homelab.pub CONTENTS HERE
+      - PASTE ~/.ssh/id_ed25519.pub CONTENTS HERE
 
 package_update: true
 packages:
@@ -162,7 +162,22 @@ Give cloud-init ~2 minutes to finish installing k3s after the VM boots.
 
 ```sh
 virsh -c qemu:///system domifaddr k3s-manual   # note the IP under the default network
+```
 
+If you haven't installed `kubectl` on the T630 yet (as `k8s`, no sudo
+needed):
+
+```sh
+curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
+chmod +x kubectl
+mkdir -p ~/.local/bin
+mv kubectl ~/.local/bin/
+echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
+export PATH="$HOME/.local/bin:$PATH"
+```
+
+```sh
+mkdir -p ~/.kube
 ssh k3s@<VM_IP> sudo cat /etc/rancher/k3s/k3s.yaml \
   | sed "s/127.0.0.1/<VM_IP>/" > ~/.kube/config-manual
 

docs/SETUP.md

@@ -48,7 +48,7 @@ sudo loginctl enable-linger k8s           # lets its services keep running after
 
 # as k8s, from here on (sudo -iu, not su -, since k8s has no password set):
 sudo -iu k8s
-ssh-keygen -t ed25519 -C "k3s-homelab" -f ~/.ssh/k3s_homelab   # only needed if you'll SSH in as k8s day-to-day
+ssh-keygen -t ed25519 -C "k3s-homelab" -f ~/.ssh/id_ed25519   # only needed if you'll SSH in as k8s day-to-day
 virsh -c qemu:///system list --all        # sanity check: should run with no permission error, no sudo
 ```
 
@@ -100,7 +100,7 @@ references — no placeholder-swapping needed).
      reuse that same in-cluster Secret) — it's never written to `k8s`'s
      filesystem at all.
 
-   Using HTTPS tokens instead of `k8s`'s SSH key (`~/.ssh/k3s_homelab`, from
+   Using HTTPS tokens instead of `k8s`'s SSH key (`~/.ssh/id_ed25519`, from
    step 2) sidesteps an open question: Forgejo's git-SSH port isn't
    reachable from this desktop through your router (see the SSH
    troubleshooting earlier in this conversation), and whether it's reachable
@@ -136,7 +136,7 @@ chmod 600 ~/.git-credentials
 
 cd ~/k3s/terraform
 cp terraform.tfvars.example terraform.tfvars
-# edit terraform.tfvars: ssh_public_key (contents of ~/.ssh/k3s_homelab.pub
+# edit terraform.tfvars: ssh_public_key (contents of ~/.ssh/id_ed25519.pub
 # from step 2), k3s_token. Defaults for network/sizing are fine to start.
 
 tofu init
@@ -154,7 +154,21 @@ each on first boot — give it ~2 minutes after `apply` finishes.
 
 ## 6. Get kubectl talking to the cluster
 
+`kubectl` itself was never actually installed anywhere earlier in this
+guide despite being listed as a prerequisite — install it now (as `k8s`,
+no sudo needed, same pattern as the OpenTofu install):
+
 ```sh
+curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
+chmod +x kubectl
+mkdir -p ~/.local/bin
+mv kubectl ~/.local/bin/
+echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
+export PATH="$HOME/.local/bin:$PATH"
+```
+
+```sh
+mkdir -p ~/.kube
 ssh k3s@$(tofu output -raw server_ip) sudo cat /etc/rancher/k3s/k3s.yaml \
   | sed "s/127.0.0.1/$(tofu output -raw server_ip)/" > ~/.kube/config-homelab
 

terraform/terraform.tfvars.example

@@ -4,7 +4,7 @@
 # Default (qemu:///system) assumes you're running tofu on the T630 itself
 # as the 'k8s' user - see docs/SETUP.md step 2. Leave commented out unless
 # you're running Terraform from a separate workstation instead.
-# libvirt_uri = "qemu+ssh://k8s@t630.lan/system?keyfile=/home/you/.ssh/k3s_homelab"
+# libvirt_uri = "qemu+ssh://k8s@t630.lan/system?keyfile=/home/you/.ssh/id_ed25519"
 
 ssh_public_key = "ssh-ed25519 AAAA... you@workstation"
 k3s_token      = "generate-with: openssl rand -hex 32"