diff --git a/hosts/eple/default.nix b/hosts/eple/default.nix
index aec7465..32c65e5 100644
--- a/hosts/eple/default.nix
+++ b/hosts/eple/default.nix
@@ -5,6 +5,8 @@
   boot.loader.efi.canTouchEfiVariables = true;
   boot.loader.efi.efiSysMountPoint = "/boot/efi";
 
+  services.nfs.server.enable = false; # TODO: remove?
+
   imports = [
     ./hardware-configuration.nix
     ../../profiles/sshd.nix
diff --git a/profiles/mounts/common-zfs.nix b/profiles/mounts/common-zfs.nix
index 1d3ee41..107987c 100644
--- a/profiles/mounts/common-zfs.nix
+++ b/profiles/mounts/common-zfs.nix
@@ -41,7 +41,7 @@
     statdPort = 4000;
     extraNfsdConfig = '''';
   };
-  networking.firewall = {
+  networking.firewall = lib.mkIf (config.services.nfs.server.enable) {
     # for NFSv3; view with `rpcinfo -p`
     allowedTCPPorts = [ 111 2049 4000 4001 4002 ]; # 20048
     allowedUDPPorts = [ 111 2049 4000 4001 4002 ]; # 20048