Move host firewall configs into host dirs

nixos/hosts/cloud-pc/default.nix

@@ -5,7 +5,7 @@
     ../../modules/base.nix
     ../../modules/docker.nix
     ../../modules/libvirtd.nix
-    ../../modules/firewall.nix
+    ./firewall.nix
     ./hardware.nix
   ];
 

nixos/hosts/cloud-pc/firewall.nix

@@ -0,0 +1,25 @@
+{
+  networking.firewall = {
+    enable = true;
+    allowedTCPPorts = [
+      22 # SSH
+      139 # Samba (NetBIOS session)
+      445 # Samba (SMB)
+      2222 # Gitea SSH
+      3002
+      4567
+      5432 # PostgreSQL
+      7080
+      8081
+      8384 # Syncthing web UI
+      22000 # Syncthing data transfer
+    ];
+    allowedUDPPorts = [
+      137 # Samba (NetBIOS name)
+      138 # Samba (NetBIOS datagram)
+      9993 # ZeroTier
+      21027 # Syncthing discovery
+      22000 # Syncthing data transfer
+    ];
+  };
+}

nixos/hosts/mini-pc/default.nix

@@ -5,7 +5,7 @@
     ../../modules/base.nix
     ../../modules/docker.nix
     ../../modules/libvirtd.nix
-    ../../modules/firewall-mini-pc.nix
+    ./firewall.nix
     ./hardware.nix
   ];
 

nixos/hosts/mini-pc/firewall.nix

@@ -0,0 +1,29 @@
+{
+  networking.firewall = {
+    enable = true;
+    allowedTCPPorts = [
+      22 # SSH
+      53 # DNS (AdGuard)
+      80 # HTTP
+      443 # HTTPS
+      784 # DNS-over-QUIC
+      853 # DNS-over-TLS
+      3001 # Uptime Kuma
+      3015
+      20171 # v2raya SOCKS5
+      20172 # v2raya HTTP proxy
+      20170 # v2raya mixed
+      4438
+      5443
+      8088
+      10380
+    ];
+    allowedUDPPorts = [
+      53 # DNS
+      443 # QUIC
+      784 # DNS-over-QUIC
+      9993 # ZeroTier
+      5443
+    ];
+  };
+}