{
  services.k3s = { enable = true; };

  networking.firewall = {
    allowedTCPPorts = [
      6443 # Kubernetes API
    ];
    allowedTCPPortRanges = [{
      from = 9000;
      to = 15000;
    }];
  };
}
