Evolution in Seattle

lib/fudo/git.nix

@@ -25,20 +25,22 @@ let
     };
   };
 
-  sshOpts = { ... }: with types; {
-    options = {
-      listen-ip = mkOption {
-        type = str;
-        description = "IP on which to listen for SSH connections.";
-      };
+  sshOpts = { ... }:
+    with types; {
+      options = {
+        listen-ip = mkOption {
+          type = str;
+          description = "IP on which to listen for SSH connections.";
+        };
 
-      listen-port = mkOption {
-        type = port;
-        description = "Port on which to listen for SSH connections, on <listen-ip>.";
-        default = 22;
+        listen-port = mkOption {
+          type = port;
+          description =
+            "Port on which to listen for SSH connections, on <listen-ip>.";
+          default = 22;
+        };
       };
     };
-  };
 
 in {
   options.fudo.git = with types; {
@@ -81,7 +83,8 @@ in {
 
     local-port = mkOption {
       type = port;
-      description = "Local port to which the Gitea server will bind. Not globally accessible.";
+      description =
+        "Local port to which the Gitea server will bind. Not globally accessible.";
       default = 3543;
     };
 
@@ -93,9 +96,12 @@ in {
   };
 
   config = mkIf cfg.enable {
-    security.acme.certs.${cfg.hostname}.email = let
-      domain-name = config.fudo.hosts.${config.instance.hostname}.domain;
-     in config.fudo.domains.${domain-name}.admin-email;
+    security.acme.certs.${cfg.hostname}.email =
+      let domain-name = config.fudo.hosts.${config.instance.hostname}.domain;
+      in config.fudo.domains.${domain-name}.admin-email;
+
+    networking.firewall.allowedTCPPorts =
+      mkIf (cfg.ssh != null) [ cfg.ssh.listen-port ];
 
     services = {
       gitea = {
@@ -123,7 +129,7 @@ in {
         settings = mkIf (cfg.ssh != null) {
           server = {
             SSH_DOMAIN = cfg.hostname;
-            SSH_LISTEN_PORT = cfg.ssh.listen-port;
+            # SSH_LISTEN_PORT = cfg.ssh.listen-port;
             SSH_LISTEN_HOST = cfg.ssh.listen-ip;
           };
         };