refactor

modules/firewall.nix

@@ -16,18 +16,25 @@ let
       { allowedUDPPorts = [ ]; allowedTCPPorts = [ ]; }
       enabledServices;
 
-  cfg = config.modules.firewall.rules;
+  cfg = config.modules.firewall;
 in
 {
-  options.modules.firewall.rules = lib.mkOption {
-    type = lib.types.attrsOf (lib.types.listOf (lib.types.enum (lib.attrNames services)));
-    default = { };
-  };
-
-  config = lib.mkIf (lib.length (lib.attrNames cfg) > 0) {
-    networking.firewall = {
-      enable = lib.mkDefault true;
-      interfaces = lib.mapAttrs (_: enabledServices: rulesForServices enabledServices) cfg;
+  options.modules.firewall = {
+    enable = lib.mkEnableOption "Enable the firewall";
+    interfaces = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.listOf (lib.types.enum (lib.attrNames services)));
+      default = { };
+    };
+    allInterfaces = lib.mkOption {
+      type = lib.types.listOf (lib.types.enum (lib.attrNames services));
+      default = [ ];
     };
   };
+
+  config = lib.mkIf cfg.enable {
+    networking.firewall = {
+      enable = true;
+      interfaces = lib.mapAttrs (_: enabledServices: rulesForServices enabledServices) cfg.interfaces;
+    } // rulesForServices cfg.allInterfaces;
+  };
 }