feat(jeeves): centralize firewall configuration

- split networking into interface and firewall modules - define named service ports in one location - remove scattered service-level firewall rules
2026-08-27 08:45:52 -04:00
parent 677364fe74
commit e4eef6dff0
13 changed files with 64 additions and 48 deletions
@@ -3,8 +3,6 @@ let
  vars = import ../vars.nix;
 in
 {
-  networking.firewall.allowedTCPPorts = [ 5432 ];
-
  # Symlink pg_wal to a ZFS dataset on the special (metadata) vdev for fast WAL writes
  # this is required for systemd sandboxing
  systemd.services.postgresql.serviceConfig.ReadWritePaths = [ "/zfs/media/database/postgres-wal" ];