diff --git a/systems/jeeves/default.nix b/systems/jeeves/default.nix
index 9148070..b55fcd0 100644
--- a/systems/jeeves/default.nix
+++ b/systems/jeeves/default.nix
@@ -20,7 +20,7 @@ in
     ./docker
     ./services
     ./hardware.nix
-    ./networking.nix
+    ./networking
     ./programs.nix
     ./runners
     ./syncthing.nix
diff --git a/systems/jeeves/docker/signal-cli-rest-api.nix b/systems/jeeves/docker/signal-cli-rest-api.nix
index 0432e9f..d2ab6e3 100644
--- a/systems/jeeves/docker/signal-cli-rest-api.nix
+++ b/systems/jeeves/docker/signal-cli-rest-api.nix
@@ -2,9 +2,6 @@ let
   vars = import ../vars.nix;
 in
 {
-  networking.firewall.allowedTCPPorts = [
-    8989
-  ];
   virtualisation.oci-containers.containers.signal_cli_rest_api = {
     image = "bbernhard/signal-cli-rest-api:0.199-dev";
     ports = [
diff --git a/systems/jeeves/networking/default.nix b/systems/jeeves/networking/default.nix
new file mode 100644
index 0000000..a937bc6
--- /dev/null
+++ b/systems/jeeves/networking/default.nix
@@ -0,0 +1,16 @@
+{
+  imports = [
+    ./firewall.nix
+    ./interfaces.nix
+  ];
+  networking = {
+    hostName = "jeeves";
+    hostId = "0e15ce35";
+    useNetworkd = true;
+    # Without this, unconfigured NICs get a catch-all DHCP network and
+    # join the LAN uninvited (how the dead atlantic card ended up
+    # ARP-poisoning 192.168.99.14). Every interface must be configured
+    # explicitly below.
+    useDHCP = false;
+  };
+}
diff --git a/systems/jeeves/networking/firewall.nix b/systems/jeeves/networking/firewall.nix
new file mode 100644
index 0000000..e085295
--- /dev/null
+++ b/systems/jeeves/networking/firewall.nix
@@ -0,0 +1,47 @@
+let
+  ports = {
+    audiobookshelf = 8000;
+    ebook_searcher = 8070;
+    gems = 8002;
+    gitea_http = 6443;
+    gitea_ssh = 2223;
+    grafana = 3000;
+    jellyfin_http = 8096;
+    nix_binary_cache = 5000;
+    nornsight = 8001;
+    ollama = 11434;
+    open_webui = 8080;
+    postgresql = 5432;
+    share = 8091;
+    signal_cli = 8989;
+    syncthing = 8384;
+  };
+in
+{
+  networking.firewall = {
+    enable = true;
+    interfaces.br-nix-builder = {
+      allowedTCPPorts = [ ];
+      allowedUDPPorts = [ ];
+    };
+    interfaces.tailscale0.allowedTCPPorts = [
+      ports.audiobookshelf
+      ports.gems
+      ports.jellyfin_http
+      ports.nix_binary_cache
+      ports.nornsight
+      ports.share
+    ];
+    allowedTCPPorts = [
+      ports.ebook_searcher
+      ports.gitea_http
+      ports.gitea_ssh
+      ports.grafana
+      ports.ollama
+      ports.open_webui
+      ports.postgresql
+      ports.signal_cli
+      ports.syncthing
+    ];
+  };
+}
diff --git a/systems/jeeves/networking.nix b/systems/jeeves/networking/interfaces.nix
similarity index 74%
rename from systems/jeeves/networking.nix
rename to systems/jeeves/networking/interfaces.nix
index 8686a42..dab7d63 100644
--- a/systems/jeeves/networking.nix
+++ b/systems/jeeves/networking/interfaces.nix
@@ -8,36 +8,6 @@
     "net.bridge.bridge-nf-call-iptables" = 0;
   };
 
-  networking = {
-    hostName = "jeeves";
-    hostId = "0e15ce35";
-    firewall = {
-      enable = true;
-      interfaces.br-nix-builder = {
-        allowedTCPPorts = [ ];
-        allowedUDPPorts = [ ];
-      };
-      interfaces.tailscale0.allowedTCPPorts = [
-        5000 # Nix binary cache
-        8000 # Audiobookshelf
-        8001 # Norn Sight
-        8002 # Gems
-        8091 # Share
-        8096 # Jellyfin HTTP
-      ];
-      allowedTCPPorts = [
-        6443 # Gitea HTTP
-        8070 # ebook searcher
-      ];
-    };
-    useNetworkd = true;
-    # Without this, unconfigured NICs get a catch-all DHCP network and
-    # join the LAN uninvited (how the dead atlantic card ended up
-    # ARP-poisoning 192.168.99.14). Every interface must be configured
-    # explicitly below.
-    useDHCP = false;
-  };
-
   systemd.network = {
     enable = true;
     wait-online = {
diff --git a/systems/jeeves/services/gitea.nix b/systems/jeeves/services/gitea.nix
index 3e84d3d..b807af4 100644
--- a/systems/jeeves/services/gitea.nix
+++ b/systems/jeeves/services/gitea.nix
@@ -2,10 +2,6 @@ let
   vars = import ../vars.nix;
 in
 {
-  networking.firewall.allowedTCPPorts = [
-    2223
-  ];
-
   services.gitea = {
     enable = true;
     appName = "TMM Workshop";
diff --git a/systems/jeeves/services/grafana.nix b/systems/jeeves/services/grafana.nix
index b259127..cc32eb7 100644
--- a/systems/jeeves/services/grafana.nix
+++ b/systems/jeeves/services/grafana.nix
@@ -6,8 +6,6 @@ let
   grafanaDataDir = "${vars.services}/grafana";
 in
 {
-  networking.firewall.allowedTCPPorts = [ 3000 ];
-
   services.grafana = {
     enable = true;
     dataDir = grafanaDataDir;
diff --git a/systems/jeeves/services/jellyfin.nix b/systems/jeeves/services/jellyfin.nix
index eb8c696..7e2aa5c 100644
--- a/systems/jeeves/services/jellyfin.nix
+++ b/systems/jeeves/services/jellyfin.nix
@@ -4,7 +4,6 @@ in
 {
   services.jellyfin = {
     enable = true;
-    openFirewall = false;
     dataDir = "${vars.services}/jellyfin";
     cacheDir = "${vars.services}/jellyfin/cache";
   };
diff --git a/systems/jeeves/services/llms.nix b/systems/jeeves/services/llms.nix
index 31b608c..63a13bc 100644
--- a/systems/jeeves/services/llms.nix
+++ b/systems/jeeves/services/llms.nix
@@ -38,7 +38,6 @@ in
       "qwen3.5:35b"
     ];
     modelsDir = vars.ollama;
-    openFirewall = true;
   };
   systemd.services = {
     ollama.serviceConfig = {
diff --git a/systems/jeeves/services/nix_serve.nix b/systems/jeeves/services/nix_serve.nix
index 6fdc67a..5fe9739 100644
--- a/systems/jeeves/services/nix_serve.nix
+++ b/systems/jeeves/services/nix_serve.nix
@@ -7,6 +7,5 @@ in
     package = pkgs.nix-serve-ng;
     enable = true;
     secretKeyFile = "${vars.secrets}/services/nix-cache/cache-priv-key.pem";
-    openFirewall = false;
   };
 }
diff --git a/systems/jeeves/services/open_webui.nix b/systems/jeeves/services/open_webui.nix
index 152eeb6..96b2951 100644
--- a/systems/jeeves/services/open_webui.nix
+++ b/systems/jeeves/services/open_webui.nix
@@ -2,7 +2,6 @@
   services.open-webui = {
     enable = true;
     host = "0.0.0.0";
-    openFirewall = true;
     environment = {
       ANONYMIZED_TELEMETRY = "False";
       DO_NOT_TRACK = "True";
diff --git a/systems/jeeves/services/postgress.nix b/systems/jeeves/services/postgress.nix
index 2e4ff40..9ae0c79 100644
--- a/systems/jeeves/services/postgress.nix
+++ b/systems/jeeves/services/postgress.nix
@@ -3,8 +3,6 @@ let
   vars = import ../vars.nix;
 in
 {
-  networking.firewall.allowedTCPPorts = [ 5432 ];
-
   # Symlink pg_wal to a ZFS dataset on the special (metadata) vdev for fast WAL writes
   # this is required for systemd sandboxing
   systemd.services.postgresql.serviceConfig.ReadWritePaths = [ "/zfs/media/database/postgres-wal" ];
diff --git a/systems/jeeves/syncthing.nix b/systems/jeeves/syncthing.nix
index df9aaf0..9e1618d 100644
--- a/systems/jeeves/syncthing.nix
+++ b/systems/jeeves/syncthing.nix
@@ -2,8 +2,6 @@ let
   vars = import ./vars.nix;
 in
 {
-  networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ 8384 ];
-
   services.syncthing = {
     overrideFolders = false;
     guiAddress = "0.0.0.0:8384";