wip: server-factory + firewall refractor

modules/factories/server-factory.nix

@@ -0,0 +1,24 @@
+{
+  lib,
+  config,
+  name,
+  subdomain,
+  port,
+  serviceConfig ? { },
+  nginxConfig ? null,
+}:
+let
+  cfg = config.my.servers.${name};
+  setup = import ./setup.nix { inherit lib config; };
+in
+{
+  options.my.servers.${name} = setup.mkOptions name subdomain port;
+
+  config = lib.mkIf cfg.enable {
+    services = serviceConfig // {
+      nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (
+        if nginxConfig != null then nginxConfig cfg else setup.proxyReverseFix cfg
+      );
+    };
+  };
+}

modules/modules.nix

@@ -15,7 +15,12 @@ let
     config.my.servers.drpp.enable
     config.my.servers.plex-discord-bot.enable
   ];
-  filterNames = file: file != "base.nix" && file != "setup.nix" && file != "librewolf.nix";
+  filterNames =
+    file:
+    file != "base.nix"
+    && file != "setup.nix"
+    && file != "librewolf.nix"
+    && file != "server-factory.nix";
   autoImport =
     dir:
     builtins.readDir ./${dir}
@@ -34,6 +39,7 @@ in
     ++ [
       ./nix/build.nix
       ./users/nixremote.nix
+      ./network/firewall.nix
     ];
   options.my = {
     localhost = lib.mkOption {

modules/network/firewall.nix

@@ -0,0 +1,32 @@
+{ lib, config, ... }:
+{
+  options.my.network.firewall = {
+    enabledServicePorts = lib.mkEnableOption "auto-open ports for enabled services";
+    staticPorts = lib.mkOption {
+      type = lib.types.listOf lib.types.int;
+      default = [ ];
+      description = "Static ports to always open";
+    };
+    additionalPorts = lib.mkOption {
+      type = lib.types.listOf lib.types.int;
+      default = [ ];
+      description = "Additional ports to open (like syncthing, gitea, etc.)";
+    };
+  };
+
+  config = lib.mkIf config.my.network.firewall.enabledServicePorts {
+    networking.firewall.allowedTCPPorts =
+      config.my.network.firewall.staticPorts
+      ++ config.my.network.firewall.additionalPorts
+      ++ (
+        config.my.servers
+        |> lib.filterAttrs (_: srv: (srv.enable or false) && (srv ? port))
+        |> lib.attrValues
+        |> map (srv: srv.port)
+      )
+      ++ (lib.optionals config.services.nginx.enable [
+        80
+        443
+      ]);
+  };
+}

modules/nix/build.nix

@@ -14,19 +14,19 @@
       ];
       description = "List of supported nix build features for this system";
     };
-    
+
     buildMachines = lib.mkOption {
       type = lib.types.listOf lib.types.attrs;
-      default = [];
+      default = [ ];
       description = "List of remote build machines configuration";
     };
-    
+
     cores = lib.mkOption {
       type = lib.types.nullOr lib.types.int;
       default = null;
       description = "Number of cores to use for builds (null = auto-detect)";
     };
-    
+
     maxJobs = lib.mkOption {
       type = lib.types.nullOr lib.types.int;
       default = null;
@@ -46,8 +46,7 @@
         max-jobs = config.my.nix.maxJobs;
       })
     ];
-    
-    nix.buildMachines = lib.mkIf (config.my.nix.buildMachines != []) 
-      config.my.nix.buildMachines;
+
+    nix.buildMachines = lib.mkIf (config.my.nix.buildMachines != [ ]) config.my.nix.buildMachines;
   };
-} 
+}

modules/users/nixremote.nix

@@ -2,7 +2,7 @@
 {
   options.my.users.nixremote = {
     enable = lib.mkEnableOption "nixremote user for distributed builds";
-    
+
     authorizedKeys = lib.mkOption {
       type = lib.types.listOf lib.types.path;
       default = [
@@ -12,13 +12,13 @@
       ];
       description = "List of SSH public key files to authorize for nixremote user";
     };
-    
+
     gid = lib.mkOption {
       type = lib.types.int;
       default = 555;
       description = "Group ID for the nixremote group";
     };
-    
+
     home = lib.mkOption {
       type = lib.types.str;
       default = "/var/nixremote/";
@@ -38,4 +38,4 @@
       };
     };
   };
-} 
+}