test udev rule

modules/k3s/default.nix

@@ -23,6 +23,10 @@ in
     boot.kernelModules = [ "fuse" ];
     programs.fuse.userAllowOther = true;
 
+    services.udev.extraRules = ''
+      KERNEL=="fuse", MODE="0666", OWNER="root", GROUP="root"
+    '';
+
     networking.firewall.allowedTCPPorts = [
       6443 # k3s, api server
       2379 # k3s, etcd clients
@@ -69,7 +73,6 @@ in
       images = import ./images args;
       disable = [];
     };
-    # systemd.services.k3s.serviceConfig.DeviceAllow = mkForce [ "/dev/fuse rwm" ];
     systemd.services.k3s = {
       restartTriggers = [
         (builtins.toJSON config.services.k3s.manifests)

modules/k3s/deployments/storage-combo.nix

@@ -36,7 +36,10 @@
                     mountPath = "/dev/fuse";
                   }
                 ];
-                securityContext.capabilities.add = ["SYS_ADMIN"];
+                securityContext = {
+                  capabilities.add = ["SYS_ADMIN"];
+                  # privileged = true;
+                };
               }
             ];
             volumes = [