modularized firewall logic

modules/servers/adguardhome.nix

@@ -5,7 +5,6 @@
     services.adguardhome = {
       enable = true;
       mutableSettings = true;
-      openFirewall = true;
     };
   };
 }

modules/servers/bazarr.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.bazarr = setup.mkOptions "bazarr" "subs" config.services.bazarr.listenPort;
   config = {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     services = {
       bazarr = lib.mkIf cfg.enable {
         enable = true;

modules/servers/homepage.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.homepage = setup.mkOptions "homepage" "home" 8082;
   config = {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     sops.secrets = lib.mkIf cfg.enable {
       homepage.sopsFile = ../../secrets/homepage.yaml;
       "private-ca/pem" = {

modules/servers/jellyfin.nix

@@ -24,7 +24,6 @@ in
 {
   options.my.servers.jellyfin = setup.mkOptions "jellyfin" "flix" 8096;
   config = {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     environment = {
       systemPackages = lib.mkIf cfg.enable (
         [ pkgs.jellyfin-ffmpeg ] ++ (lib.optional cfg.enableCron [ sub-sync-path ])

modules/servers/kavita.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.kavita = setup.mkOptions "kavita" "library" config.services.kavita.settings.Port;
   config = {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     sops.secrets.kavita-token = lib.mkIf cfg.enable {
       owner = config.users.users.kavita.name;
       inherit (config.users.users.kavita) group;

modules/servers/lidarr.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.lidarr = setup.mkOptions "lidarr" "music" 8686;
   config = {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     virtualisation.oci-containers.containers.lidarr = lib.mkIf cfg.enable {
       autoStart = true;
       image = "linuxserver/lidarr:version-2.13.3.4711";

modules/servers/maloja.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.maloja = setup.mkOptions "maloja" "maloja" 42010;
   config = {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     sops.secrets = lib.mkIf cfg.enable { maloja.sopsFile = ../../secrets/env.yaml; };
     virtualisation.oci-containers.containers.maloja = lib.mkIf cfg.enable {
       image = "krateng/maloja:3.2.3";

modules/servers/mealie.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.mealie = setup.mkOptions "mealie" "mealie" 9925;
   config = {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     sops.secrets = lib.mkIf cfg.enable { mealie.sopsFile = ../../secrets/env.yaml; };
     services = {
       mealie = lib.mkIf cfg.enable {

modules/servers/metube.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.metube = setup.mkOptions "metube" "bajameesta" 8881;
   config = {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     virtualisation.oci-containers.containers.metube = lib.mkIf cfg.enable {
       image = "ghcr.io/alexta69/metube:2024-11-05";
       ports = [ "${toString cfg.port}:8081" ];

modules/servers/microbin.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.microbin = setup.mkOptions "microbin" "copy" 8086;
   config = lib.mkIf config.my.servers.microbin.enable {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     services = {
       microbin = lib.mkIf cfg.enable {
         enable = true;

modules/servers/multi-scrobbler.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.multi-scrobbler = setup.mkOptions "multi-scrobbler" "scrobble" 9078;
   config = {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     sops.secrets = lib.mkIf cfg.enable { multi-scrobbler.sopsFile = ../../secrets/env.yaml; };
     virtualisation.oci-containers.containers.multi-scrobbler = lib.mkIf cfg.enable {
       image = "foxxmd/multi-scrobbler:0.9.11";

modules/servers/nix-serve.nix

@@ -15,7 +15,6 @@ in
     services = {
       nix-serve = {
         enable = true;
-        openFirewall = true;
         package = pkgs.nix-serve-ng;
         inherit (cfg) port;
         secretKeyFile = config.sops.secrets."private_cache_keys/miniserver".path;

modules/servers/ombi.nix

@@ -9,7 +9,6 @@ in
     ombi = lib.mkIf cfg.enable {
       enable = true;
       inherit (cfg) port;
-      openFirewall = !cfg.isLocal;
     };
     nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverseFix cfg);
   };

modules/servers/plex.nix

@@ -13,7 +13,6 @@ in
     plex = lib.mkIf cfg.enable {
       enable = true;
       group = "piracy";
-      openFirewall = true;
     };
     nginx = lib.mkIf cfg.enableProxy {
       virtualHosts."${cfg.host}" = {

modules/servers/prowlarr.nix

@@ -1,5 +1,4 @@
 {
-  pkgs,
   lib,
   config,
   ...
@@ -11,17 +10,13 @@ in
 {
   options.my.servers.prowlarr = setup.mkOptions "prowlarr" "indexer" 9696;
   config = {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     users.users.prowlarr = lib.mkIf cfg.enable {
       group = "piracy";
       isSystemUser = true;
     };
     services = {
       prowlarr.enable = cfg.enable;
-      flaresolverr = {
-        inherit (cfg) enable;
-        openFirewall = true;
-      };
+      flaresolverr.enable = cfg.enable;
       nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverseFix cfg);
     };
   };

modules/servers/radarr.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.radarr = setup.mkOptions "radarr" "movies" 7878;
   config = {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     services = {
       radarr = lib.mkIf cfg.enable {
         enable = true;

modules/servers/sabnzbd.nix

@@ -9,11 +9,9 @@
     };
   };
   config = lib.mkIf config.my.servers.sabnzbd.enable {
-    networking.firewall.allowedTCPPorts = [ config.my.servers.sabnzbd.port ];
     services.sabnzbd = {
       enable = true;
       group = "piracy";
-      openFirewall = true;
     };
   };
 }

modules/servers/shiori.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.shiori = setup.mkOptions "shiori" "bookmarks" 4368;
   config = lib.mkIf (config.my.servers.shiori.enable && config.my.servers.postgres.enable) {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     sops.secrets = lib.mkIf cfg.enable { shiori.sopsFile = ../../secrets/env.yaml; };
     services = {
       shiori = lib.mkIf cfg.enable {

modules/servers/sonarr.nix

@@ -9,7 +9,6 @@ in
     sonarr = lib.mkIf cfg.enable {
       enable = true;
       group = "piracy";
-      openFirewall = !cfg.isLocal;
     };
     nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverseFix cfg);
   };

modules/servers/stash.nix

@@ -15,7 +15,6 @@ in
       stash = lib.mkIf cfg.enable {
         enable = true;
         group = "piracy";
-        openFirewall = !cfg.isLocal;
         mutableSettings = true;
         username = "Suing8150";
         passwordFile = config.sops.secrets."stash/password".path;

modules/servers/tranga.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.tranga = setup.mkOptions "tranga" "tranga" 9555;
   config = {
-    networking.firewall.allowedTCPPorts = [ cfg.port ];
     virtualisation.oci-containers.containers = lib.mkIf cfg.enable {
       tranga-api = {
         image = "glax/tranga-api:latest";

modules/servers/vaultwarden.nix

@@ -11,7 +11,6 @@ in
 {
   options.my.servers.vaultwarden = setup.mkOptions "vaultwarden" "vault" 8222;
   config = lib.mkIf (cfg.enable && config.my.servers.postgres.enable) {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     sops.secrets = lib.mkIf cfg.enable { vaultwarden.sopsFile = ../../secrets/env.yaml; };
     services = {
       vaultwarden = lib.mkIf cfg.enable {