{
  networking.firewall = {
    enable = true;
    allowedTCPPorts = [
      22 # SSH
      139 # Samba (NetBIOS session)
      445 # Samba (SMB)
      2222 # Gitea SSH
      3002 
      4567
      5432 # PostgreSQL
      7080
      8081
      8384 # Syncthing web UI
      22000 # Syncthing data transfer
    ];
    allowedUDPPorts = [
      137 # Samba (NetBIOS name)
      138 # Samba (NetBIOS datagram)
      9993 # ZeroTier
      21027 # Syncthing discovery
      22000 # Syncthing data transfer
    ];
  };
}