{
  # NFS client support: k3s mounts NFS volumes for media pods
  boot.supportedFilesystems = [ "nfs" ];
  networking.firewall.allowedTCPPorts = [
    6443
    80
    443
    8969
    33073
  ];
  networking.firewall.allowedUDPPorts = [ 3479 ];

  services.k3s = {
    enable = true;
    role = "server";
    extraFlags = "--write-kubeconfig-mode 644 --disable-network-policy";
  };

  fileSystems."/var/lib/rancher/k3s/server/manifests/apps" = {
    device = "/home/poslop/k3s/apps";
    fsType = "none";
    options = [
      "bind"
      "ro"
    ];
  };

  # Weekly rolling refresh: restart all deployments so floating :latest images
  # are re-pulled, then prune dangling images.
  systemd.services.image-refresh = {
    description = "Pull latest floating images by restarting all deployments, then prune";
    path = [ "/run/current-system/sw/bin" ];
    script = ''
      /run/current-system/sw/bin/k3s kubectl rollout restart deployments -A
      sleep 120
      /run/current-system/sw/bin/k3s crictl rmi --prune || true
    '';
    serviceConfig.Type = "oneshot";
  };

  systemd.timers.image-refresh = {
    description = "Weekly image refresh";
    wantedBy = [ "timers.target" ];
    timerConfig = {
      OnCalendar = "Sun *-*-* 04:30:00";
      Persistent = true;
      RandomizedDelaySec = "10m";
    };
  };
}