{
  networking.firewall.allowedTCPPorts = [
    6443
    80
    443
    8969
    33073
  ];
  networking.firewall.allowedUDPPorts = [ 3479 ];

  services.k3s = {
    enable = true;
    role = "server";
    extraFlags = "--write-kubeconfig-mode 644";
  };

  fileSystems."/var/lib/rancher/k3s/server/manifests/apps" = {
    device = "/home/poslop/k3s/apps";
    fsType = "none";
    options = [
      "bind"
      "ro"
    ];
  };
}