korals k3s portability PoC — served from Hetzner, no AWS in this path