{
  # For the first node:
  services.k3s = {
    enable = true;
    role = "server";
    token = "<randomized common secret>";
    clusterInit = true;
  };

  # All subsequent nodes:
  # services.k3s = {
    # enable = true;
    # role = "server"; # Or "agent" for worker only nodes
    # token = "<randomized common secret";
    # serverAddr = "https://<ip of first node>:6443";
  # };

  networking.firewall.allowedTCPPorts = [ 
    6443
    2379
    2380
  ];

  networking.firewall.allowedUDPPorts = [ 
    8472
  ];
}