{
  networking.firewall.allowedTCPPorts = [ 6443 80 443 33073 ];
  networking.firewall.allowedUDPPorts = [ 3478 ];

  services.k3s = {
    enable = true;
    role = "server";
    extraFlags = "--write-kubeconfig-mode 644";
    manifests = {
      traefik-namespace    = { source = ./traefik/namespace.yaml; };
      traefik-rbac         = { source = ./traefik/rbac.yaml; };
      traefik-pvc          = { source = ./traefik/pvc.yaml; };
      traefik-deployment   = { source = ./traefik/deployment.yaml; };
      traefik-service      = { source = ./traefik/service.yaml; };
      netbird-namespace    = { source = ./netbird/namespace.yaml; };
      netbird-config       = { source = ./netbird/config.yaml; };
      netbird-server       = { source = ./netbird/server.yaml; };
      netbird-dashboard    = { source = ./netbird/dashboard.yaml; };
      netbird-ingress      = { source = ./netbird/ingress.yaml; };
    };
  };
}