ports refactor

flake.nix

@@ -142,19 +142,46 @@
             ;
         };
         modules = [
-          # SAFETY! make sure no ports collide
+          # SAFETY! port sanity checks
           (
-            { lib, ... }:
+            { config, lib, ... }:
+            let
+              publicPorts = lib.attrValues service_configs.ports.public;
+              privatePorts = lib.attrValues service_configs.ports.private;
+              allPortNumbers = map (p: p.port) (publicPorts ++ privatePorts);
+              uniquePortNumbers = lib.unique allPortNumbers;
+
+              # Which public ports must be in each firewall list
+              publicTcp = map (p: p.port) (lib.filter (p: p.proto == "tcp" || p.proto == "both") publicPorts);
+              publicUdp = map (p: p.port) (lib.filter (p: p.proto == "udp" || p.proto == "both") publicPorts);
+
+              privatePortNumbers = map (p: p.port) privatePorts;
+
+              fwTcp = config.networking.firewall.allowedTCPPorts;
+              fwUdp = config.networking.firewall.allowedUDPPorts;
+
+              missingTcp = lib.filter (p: !(builtins.elem p fwTcp)) publicTcp;
+              missingUdp = lib.filter (p: !(builtins.elem p fwUdp)) publicUdp;
+              leakedTcp = lib.filter (p: builtins.elem p fwTcp) privatePortNumbers;
+              leakedUdp = lib.filter (p: builtins.elem p fwUdp) privatePortNumbers;
+            in
             {
               config.assertions = [
                 {
-                  assertion =
-                    let
-                      ports = lib.attrValues service_configs.ports;
-                      uniquePorts = lib.unique ports;
-                    in
-                    (lib.length ports) == (lib.length uniquePorts);
-                  message = "Duplicate ports detected in 'ports' configuration";
+                  assertion = (lib.length allPortNumbers) == (lib.length uniquePortNumbers);
+                  message = "Duplicate port numbers detected in ports.public / ports.private";
+                }
+                {
+                  assertion = missingTcp == [ ];
+                  message = "Public ports missing from allowedTCPPorts: ${builtins.toString missingTcp}";
+                }
+                {
+                  assertion = missingUdp == [ ];
+                  message = "Public ports missing from allowedUDPPorts: ${builtins.toString missingUdp}";
+                }
+                {
+                  assertion = leakedTcp == [ ] && leakedUdp == [ ];
+                  message = "Private ports leaked into firewall allow-lists — TCP: ${builtins.toString leakedTcp}, UDP: ${builtins.toString leakedUdp}";
                 }
               ];
             }