ports refactor

service-configs.nix

@@ -9,42 +9,147 @@ rec {
   cpu_arch = "znver3";
 
   ports = {
-    # public
-    http = 80; # TCP
-    https = 443; # TCP+UDP (HTTP/3 QUIC)
-    minecraft = 25565; # TCP
-    syncthing_protocol = 22000; # TCP+UDP (QUIC)
-    syncthing_discovery = 21027; # UDP
-    matrix_federation = 8448; # TCP+UDP (HTTP/3 QUIC)
-    coturn = 3478; # TCP+UDP
-    coturn_tls = 5349; # TCP+UDP
-    livekit = 7880; # TCP
-    soulseek_listen = 50300; # TCP
-    monero = 18080; # TCP
-    p2pool_p2p = 37889; # TCP
-    murmur = 64738; # TCP + UDP
+    # Ports exposed to the internet. The flake asserts every public port
+    # appears in the corresponding firewall allow-list (TCP, UDP, or both).
+    public = {
+      http = {
+        port = 80;
+        proto = "tcp";
+      };
+      https = {
+        port = 443;
+        proto = "both";
+      }; # HTTP/3 QUIC
+      minecraft = {
+        port = 25565;
+        proto = "tcp";
+      };
+      syncthing_protocol = {
+        port = 22000;
+        proto = "both";
+      }; # QUIC
+      syncthing_discovery = {
+        port = 21027;
+        proto = "udp";
+      };
+      matrix_federation = {
+        port = 8448;
+        proto = "both";
+      }; # HTTP/3 QUIC
+      coturn = {
+        port = 3478;
+        proto = "both";
+      };
+      coturn_tls = {
+        port = 5349;
+        proto = "both";
+      };
+      livekit = {
+        port = 7880;
+        proto = "tcp";
+      };
+      soulseek_listen = {
+        port = 50300;
+        proto = "tcp";
+      };
+      monero = {
+        port = 18080;
+        proto = "tcp";
+      };
+      monero_rpc = {
+        port = 18081;
+        proto = "tcp";
+      }; # restricted public RPC
+      p2pool_p2p = {
+        port = 37889;
+        proto = "tcp";
+      };
+      murmur = {
+        port = 64738;
+        proto = "both";
+      };
+    };
 
-    # private
-    jellyfin = 8096; # TCP - no services.jellyfin option for this
-    torrent = 6011; # TCP
-    bitmagnet = 3333; # TCP
-    gitea = 2283; # TCP
-    immich = 2284; # TCP
-    soulseek_web = 5030; # TCP
-    vaultwarden = 8222; # TCP
-    syncthing_gui = 8384; # TCP
-    matrix = 6167; # TCP
-    ntfy = 2586; # TCP
-    lk_jwt = 8081; # TCP
-    prowlarr = 9696; # TCP
-    sonarr = 8989; # TCP
-    radarr = 7878; # TCP
-    bazarr = 6767; # TCP
-    jellyseerr = 5055; # TCP
-    monero_rpc = 18081; # TCP
-    monero_zmq = 18083; # TCP
-    p2pool_stratum = 3334; # TCP
-    firefox_syncserver = 5000; # TCP
+    # Ports bound to localhost / VPN only. The flake asserts none of
+    # these appear in the firewall allow-lists.
+    private = {
+      jellyfin = {
+        port = 8096;
+        proto = "tcp";
+      };
+      torrent = {
+        port = 6011;
+        proto = "tcp";
+      };
+      bitmagnet = {
+        port = 3333;
+        proto = "tcp";
+      };
+      gitea = {
+        port = 2283;
+        proto = "tcp";
+      };
+      immich = {
+        port = 2284;
+        proto = "tcp";
+      };
+      soulseek_web = {
+        port = 5030;
+        proto = "tcp";
+      };
+      vaultwarden = {
+        port = 8222;
+        proto = "tcp";
+      };
+      syncthing_gui = {
+        port = 8384;
+        proto = "tcp";
+      };
+      matrix = {
+        port = 6167;
+        proto = "tcp";
+      };
+      ntfy = {
+        port = 2586;
+        proto = "tcp";
+      };
+      lk_jwt = {
+        port = 8081;
+        proto = "tcp";
+      };
+      prowlarr = {
+        port = 9696;
+        proto = "tcp";
+      };
+      sonarr = {
+        port = 8989;
+        proto = "tcp";
+      };
+      radarr = {
+        port = 7878;
+        proto = "tcp";
+      };
+      bazarr = {
+        port = 6767;
+        proto = "tcp";
+      };
+      jellyseerr = {
+        port = 5055;
+        proto = "tcp";
+      };
+      monero_zmq = {
+        port = 18083;
+        proto = "tcp";
+      };
+      p2pool_stratum = {
+        port = 3334;
+        proto = "tcp";
+      };
+      firefox_syncserver = {
+        port = 5000;
+        proto = "tcp";
+      };
+    };
   };
 
   https = {