modularized firewall logic

modules/network/firewall.nix

@@ -1,4 +1,28 @@
 { lib, config, ... }:
+let
+  nativeServicesWithOpenFirewall = [
+    "adguardhome"
+    "plex"
+    "sabnzbd"
+    "nix-serve"
+    "radarr"
+    "sonarr"
+    "jellyfin"
+    "prowlarr"
+    "bazarr"
+    "stash"
+    "ombi"
+    "flaresolverr"
+  ];
+
+  servicesConfig = lib.listToAttrs (
+    map (serviceName: {
+      name = serviceName;
+      value.openFirewall = config.my.servers.${serviceName}.enable or false;
+    }) nativeServicesWithOpenFirewall
+  );
+
+in
 {
   options.my.network.firewall = {
     enabledServicePorts = lib.mkEnableOption "auto-open ports for enabled services";
@@ -15,12 +39,17 @@
   };
 
   config = lib.mkIf config.my.network.firewall.enabledServicePorts {
+    services = servicesConfig;
+
     networking.firewall.allowedTCPPorts =
       config.my.network.firewall.staticPorts
       ++ config.my.network.firewall.additionalPorts
       ++ (
         config.my.servers
-        |> lib.filterAttrs (_: srv: (srv.enable or false) && (srv ? port))
+        |> lib.filterAttrs (
+          name: srv:
+          (srv.enable or false) && (srv ? port) && !(builtins.elem name nativeServicesWithOpenFirewall)
+        )
         |> lib.attrValues
         |> map (srv: srv.port)
       )