let
  ports = {
    audiobookshelf = 8000;
    ebook_searcher = 8070;
    gems = 8002;
    gitea_http = 6443;
    gitea_ssh = 2223;
    grafana = 3000;
    jellyfin_http = 8096;
    nix_binary_cache = 5000;
    nornsight = 8001;
    ollama = 11434;
    open_webui = 8080;
    postgresql = 5432;
    share = 8091;
    signal_cli = 8989;
    syncthing = 8384;
  };
in
{
  networking.firewall = {
    enable = true;
    interfaces.br-nix-builder = {
      allowedTCPPorts = [ ];
      allowedUDPPorts = [ ];
    };
    interfaces.tailscale0.allowedTCPPorts = [
      ports.audiobookshelf
      ports.gems
      ports.jellyfin_http
      ports.nix_binary_cache
      ports.nornsight
      ports.share
    ];
    allowedTCPPorts = [
      ports.ebook_searcher
      ports.gitea_http
      ports.gitea_ssh
      ports.grafana
      ports.ollama
      ports.open_webui
      ports.postgresql
      ports.signal_cli
      ports.syncthing
    ];
  };
}