modularized firewall logic

config/base.nix

@@ -1,5 +1,4 @@
 {
-  self,
   lib,
   pkgs,
   inputs,

hosts/server/configuration.nix

@@ -1,7 +1,6 @@
 {
   pkgs,
   config,
-  lib,
   ...
 }:
 {

hosts/workstation/configuration.nix

@@ -1,6 +1,5 @@
 {
   pkgs,
-  inputs,
   ...
 }:
 let

modules/factories/server-factory.nix

@@ -1,24 +0,0 @@
-{
-  lib,
-  config,
-  name,
-  subdomain,
-  port,
-  serviceConfig ? { },
-  nginxConfig ? null,
-}:
-let
-  cfg = config.my.servers.${name};
-  setup = import ./setup.nix { inherit lib config; };
-in
-{
-  options.my.servers.${name} = setup.mkOptions name subdomain port;
-
-  config = lib.mkIf cfg.enable {
-    services = serviceConfig // {
-      nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (
-        if nginxConfig != null then nginxConfig cfg else setup.proxyReverseFix cfg
-      );
-    };
-  };
-}

modules/network/firewall.nix

@@ -1,4 +1,28 @@
 { lib, config, ... }:
+let
+  nativeServicesWithOpenFirewall = [
+    "adguardhome"
+    "plex"
+    "sabnzbd"
+    "nix-serve"
+    "radarr"
+    "sonarr"
+    "jellyfin"
+    "prowlarr"
+    "bazarr"
+    "stash"
+    "ombi"
+    "flaresolverr"
+  ];
+
+  servicesConfig = lib.listToAttrs (
+    map (serviceName: {
+      name = serviceName;
+      value.openFirewall = config.my.servers.${serviceName}.enable or false;
+    }) nativeServicesWithOpenFirewall
+  );
+
+in
 {
   options.my.network.firewall = {
     enabledServicePorts = lib.mkEnableOption "auto-open ports for enabled services";
@@ -15,12 +39,17 @@
   };
 
   config = lib.mkIf config.my.network.firewall.enabledServicePorts {
+    services = servicesConfig;
+
     networking.firewall.allowedTCPPorts =
       config.my.network.firewall.staticPorts
       ++ config.my.network.firewall.additionalPorts
       ++ (
         config.my.servers
-        |> lib.filterAttrs (_: srv: (srv.enable or false) && (srv ? port))
+        |> lib.filterAttrs (
+          name: srv:
+          (srv.enable or false) && (srv ? port) && !(builtins.elem name nativeServicesWithOpenFirewall)
+        )
         |> lib.attrValues
         |> map (srv: srv.port)
       )

modules/servers/adguardhome.nix

@@ -5,7 +5,6 @@
     services.adguardhome = {
       enable = true;
       mutableSettings = true;
-      openFirewall = true;
     };
   };
 }

modules/servers/bazarr.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.bazarr = setup.mkOptions "bazarr" "subs" config.services.bazarr.listenPort;
   config = {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     services = {
       bazarr = lib.mkIf cfg.enable {
         enable = true;

modules/servers/homepage.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.homepage = setup.mkOptions "homepage" "home" 8082;
   config = {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     sops.secrets = lib.mkIf cfg.enable {
       homepage.sopsFile = ../../secrets/homepage.yaml;
       "private-ca/pem" = {

modules/servers/jellyfin.nix

@@ -24,7 +24,6 @@ in
 {
   options.my.servers.jellyfin = setup.mkOptions "jellyfin" "flix" 8096;
   config = {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     environment = {
       systemPackages = lib.mkIf cfg.enable (
         [ pkgs.jellyfin-ffmpeg ] ++ (lib.optional cfg.enableCron [ sub-sync-path ])

modules/servers/kavita.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.kavita = setup.mkOptions "kavita" "library" config.services.kavita.settings.Port;
   config = {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     sops.secrets.kavita-token = lib.mkIf cfg.enable {
       owner = config.users.users.kavita.name;
       inherit (config.users.users.kavita) group;

modules/servers/lidarr.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.lidarr = setup.mkOptions "lidarr" "music" 8686;
   config = {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     virtualisation.oci-containers.containers.lidarr = lib.mkIf cfg.enable {
       autoStart = true;
       image = "linuxserver/lidarr:version-2.13.3.4711";

modules/servers/maloja.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.maloja = setup.mkOptions "maloja" "maloja" 42010;
   config = {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     sops.secrets = lib.mkIf cfg.enable { maloja.sopsFile = ../../secrets/env.yaml; };
     virtualisation.oci-containers.containers.maloja = lib.mkIf cfg.enable {
       image = "krateng/maloja:3.2.3";

modules/servers/mealie.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.mealie = setup.mkOptions "mealie" "mealie" 9925;
   config = {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     sops.secrets = lib.mkIf cfg.enable { mealie.sopsFile = ../../secrets/env.yaml; };
     services = {
       mealie = lib.mkIf cfg.enable {

modules/servers/metube.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.metube = setup.mkOptions "metube" "bajameesta" 8881;
   config = {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     virtualisation.oci-containers.containers.metube = lib.mkIf cfg.enable {
       image = "ghcr.io/alexta69/metube:2024-11-05";
       ports = [ "${toString cfg.port}:8081" ];

modules/servers/microbin.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.microbin = setup.mkOptions "microbin" "copy" 8086;
   config = lib.mkIf config.my.servers.microbin.enable {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     services = {
       microbin = lib.mkIf cfg.enable {
         enable = true;

modules/servers/multi-scrobbler.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.multi-scrobbler = setup.mkOptions "multi-scrobbler" "scrobble" 9078;
   config = {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     sops.secrets = lib.mkIf cfg.enable { multi-scrobbler.sopsFile = ../../secrets/env.yaml; };
     virtualisation.oci-containers.containers.multi-scrobbler = lib.mkIf cfg.enable {
       image = "foxxmd/multi-scrobbler:0.9.11";

modules/servers/nix-serve.nix

@@ -15,7 +15,6 @@ in
     services = {
       nix-serve = {
         enable = true;
-        openFirewall = true;
         package = pkgs.nix-serve-ng;
         inherit (cfg) port;
         secretKeyFile = config.sops.secrets."private_cache_keys/miniserver".path;

modules/servers/ombi.nix

@@ -9,7 +9,6 @@ in
     ombi = lib.mkIf cfg.enable {
       enable = true;
       inherit (cfg) port;
-      openFirewall = !cfg.isLocal;
     };
     nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverseFix cfg);
   };

modules/servers/plex.nix

@@ -13,7 +13,6 @@ in
     plex = lib.mkIf cfg.enable {
       enable = true;
       group = "piracy";
-      openFirewall = true;
     };
     nginx = lib.mkIf cfg.enableProxy {
       virtualHosts."${cfg.host}" = {

modules/servers/prowlarr.nix

@@ -1,5 +1,4 @@
 {
-  pkgs,
   lib,
   config,
   ...
@@ -11,17 +10,13 @@ in
 {
   options.my.servers.prowlarr = setup.mkOptions "prowlarr" "indexer" 9696;
   config = {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     users.users.prowlarr = lib.mkIf cfg.enable {
       group = "piracy";
       isSystemUser = true;
     };
     services = {
       prowlarr.enable = cfg.enable;
-      flaresolverr = {
+      flaresolverr.enable = cfg.enable;
-        inherit (cfg) enable;
-        openFirewall = true;
-      };
       nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverseFix cfg);
     };
   };

modules/servers/radarr.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.radarr = setup.mkOptions "radarr" "movies" 7878;
   config = {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     services = {
       radarr = lib.mkIf cfg.enable {
         enable = true;

modules/servers/sabnzbd.nix

@@ -9,11 +9,9 @@
     };
   };
   config = lib.mkIf config.my.servers.sabnzbd.enable {
-    networking.firewall.allowedTCPPorts = [ config.my.servers.sabnzbd.port ];
     services.sabnzbd = {
       enable = true;
       group = "piracy";
-      openFirewall = true;
     };
   };
 }

modules/servers/shiori.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.shiori = setup.mkOptions "shiori" "bookmarks" 4368;
   config = lib.mkIf (config.my.servers.shiori.enable && config.my.servers.postgres.enable) {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     sops.secrets = lib.mkIf cfg.enable { shiori.sopsFile = ../../secrets/env.yaml; };
     services = {
       shiori = lib.mkIf cfg.enable {

modules/servers/sonarr.nix

@@ -9,7 +9,6 @@ in
     sonarr = lib.mkIf cfg.enable {
       enable = true;
       group = "piracy";
-      openFirewall = !cfg.isLocal;
     };
     nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverseFix cfg);
   };

modules/servers/stash.nix

@@ -15,7 +15,6 @@ in
       stash = lib.mkIf cfg.enable {
         enable = true;
         group = "piracy";
-        openFirewall = !cfg.isLocal;
         mutableSettings = true;
         username = "Suing8150";
         passwordFile = config.sops.secrets."stash/password".path;

modules/servers/tranga.nix

@@ -6,7 +6,6 @@ in
 {
   options.my.servers.tranga = setup.mkOptions "tranga" "tranga" 9555;
   config = {
-    networking.firewall.allowedTCPPorts = [ cfg.port ];
     virtualisation.oci-containers.containers = lib.mkIf cfg.enable {
       tranga-api = {
         image = "glax/tranga-api:latest";

modules/servers/vaultwarden.nix

@@ -11,7 +11,6 @@ in
 {
   options.my.servers.vaultwarden = setup.mkOptions "vaultwarden" "vault" 8222;
   config = lib.mkIf (cfg.enable && config.my.servers.postgres.enable) {
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
     sops.secrets = lib.mkIf cfg.enable { vaultwarden.sopsFile = ../../secrets/env.yaml; };
     services = {
       vaultwarden = lib.mkIf cfg.enable {