Add uniqueness check for ports

Credit to https://lorenzbischof.ch/posts/detect-port-conflicts-in-nixos-services/

hosts/alto/default.nix

@@ -9,6 +9,7 @@
     users.seb.enable = true;
 
     services = {
+      resolved.enable = true;
       tailscale = {
         enable = true;
         ssh.enable = true;

hosts/alto/hardware.nix

@@ -39,5 +39,4 @@
       linkConfig.RequiredForOnline = "routable";
     };
   };
-  services.resolved.enable = true;
 }

hosts/cirrus/default.nix

@@ -9,6 +9,7 @@
     users.seb.enable = true;
 
     services = {
+      resolved.enable = true;
       tailscale = {
         enable = true;
         ssh.enable = true;

hosts/cirrus/hardware.nix

@@ -44,5 +44,4 @@
       ];
     };
   };
-  services.resolved.enable = true;
 }

hosts/cumulus/default.nix

@@ -9,6 +9,7 @@
     users.seb.enable = true;
 
     services = {
+      resolved.enable = true;
       tailscale = {
         enable = true;
         ssh.enable = true;

hosts/cumulus/hardware.nix

@@ -44,5 +44,4 @@
       ];
     };
   };
-  services.resolved.enable = true;
 }

hosts/north/default.nix

@@ -22,6 +22,7 @@
     sound.enable = true;
 
     services = {
+      resolved.enable = true;
       gc.enable = true;
       geoclue.enable = true;
       tailscale = {

hosts/north/hardware.nix

@@ -35,8 +35,6 @@
     udev.extraRules = ''
       ACTION=="add" SUBSYSTEM=="pci" ATTR{vendor}=="0x1022" ATTR{device}=="0x43ee" ATTR{power/wakeup}="disabled"
     '';
-
-    resolved.enable = true;
   };
 
   networking.useNetworkd = true;

modules/system/meta/ports.nix

@@ -0,0 +1,50 @@
+{
+  config,
+  options,
+  lib,
+  ...
+}:
+let
+  cfg = config.meta.ports;
+
+  duplicatedPorts =
+    options.meta.ports.list.definitionsWithLocations
+    |> lib.concatMap (
+      entry:
+      map (port: {
+        file = entry.file;
+        port = port;
+      }) entry.value
+    )
+    |> lib.groupBy (entry: toString entry.port)
+    |> lib.filterAttrs (port: entries: lib.length entries > 1);
+
+  errorMessage =
+    duplicatedPorts
+    |> lib.mapAttrsToList (
+      port: entries:
+      "Duplicate port ${port} found in:\n" + lib.concatMapStrings (entry: "  - ${entry.file}\n") entries
+    )
+    |> lib.concatStrings;
+in
+{
+  options.meta.ports = {
+    list = lib.mkOption {
+      type = lib.types.listOf lib.types.port;
+      default = [ ];
+      internal = true;
+    };
+    assertUnique = lib.mkEnableOption "" // {
+      default = true;
+    };
+  };
+
+  config = lib.mkIf cfg.assertUnique {
+    assertions = [
+      {
+        assertion = duplicatedPorts == { };
+        message = errorMessage;
+      }
+    ];
+  };
+}

modules/system/services/actualbudget/default.nix

@@ -16,6 +16,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    meta.ports.list = [ cfg.port ];
+
     users = {
       groups.actual = { };
       users.actual = {

modules/system/services/caddy.nix

@@ -27,6 +27,11 @@ let
       reverse_proxy localhost:${toString port}
     '';
   };
+
+  ports = [
+    80
+    443
+  ];
 in
 {
   options.custom.services.caddy.virtualHosts = lib.mkOption {
@@ -57,6 +62,9 @@ in
   config = lib.mkIf (virtualHosts != { }) (
     lib.mkMerge [
       {
+        meta.ports.list = lib.mkIf nonTailscaleHostsExist ports;
+        networking.firewall.allowedTCPPorts = lib.mkIf nonTailscaleHostsExist ports;
+
         services.caddy = {
           enable = true;
           enableReload = false;
@@ -66,11 +74,6 @@ in
               _: value: lib.nameValuePair value.domain (mkVirtualHostConfig value.domain value.port)
             );
         };
-
-        networking.firewall.allowedTCPPorts = lib.mkIf nonTailscaleHostsExist [
-          80
-          443
-        ];
       }
 
       (lib.mkIf tailscaleHostsExist {
@@ -78,7 +81,6 @@ in
 
         services.caddy = {
           package = caddyWithTailscale;
-          enableReload = false;
           globalConfig = ''
             admin off
 

modules/system/services/crowdsec/default.nix

@@ -19,6 +19,10 @@ in
       type = lib.types.port;
       default = 8080;
     };
+    prometheusPort = lib.mkOption {
+      type = lib.types.port;
+      default = 6060;
+    };
     sources = lib.mkOption {
       type = lib.types.listOf (
         lib.types.enum [
@@ -32,6 +36,11 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    meta.ports.list = [
+      cfg.apiPort
+      cfg.prometheusPort
+    ];
+
     nixpkgs.overlays = [ inputs.crowdsec.overlays.default ];
 
     sops.secrets."crowdsec/enrollment-key".owner = user;
@@ -42,7 +51,10 @@ in
       enable = true;
       package = inputs.crowdsec.packages.${pkgs.system}.crowdsec;
       enrollKeyFile = config.sops.secrets."crowdsec/enrollment-key".path;
-      settings.api.server.listen_uri = "127.0.0.1:${toString cfg.apiPort}";
+      settings = {
+        api.server.listen_uri = "127.0.0.1:${toString cfg.apiPort}";
+        cscli.prometheus_uri = "http://127.0.0.1:${toString cfg.prometheusPort}";
+      };
 
       allowLocalJournalAccess = true;
       acquisitions =

modules/system/services/forgejo/default.nix

@@ -24,6 +24,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    meta.ports.list = [ cfg.port ];
+
     sops.secrets."forgejo/admin-password".owner = user;
 
     services.forgejo = {

modules/system/services/forgejo/ssh.nix

@@ -12,6 +12,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    meta.ports.list = [ cfg.port ];
+
     services.forgejo.settings.server.SSH_PORT = cfg.port;
 
     services.openssh = {

modules/system/services/hedgedoc/default.nix

@@ -25,6 +25,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    meta.ports.list = [ cfg.port ];
+
     sops = {
       secrets = {
         "hedgedoc/seb-password".owner = user;

modules/system/services/nextcloud/default.nix

@@ -25,6 +25,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    meta.ports.list = [ cfg.port ];
+
     sops.secrets."nextcloud/admin-password".owner = user;
 
     services.nextcloud = {

modules/system/services/ntfy.nix

@@ -16,6 +16,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    meta.ports.list = [ cfg.port ];
+
     services.ntfy-sh = {
       enable = true;
       settings = {

modules/system/services/resolved.nix

@@ -0,0 +1,14 @@
+{ config, lib, ... }:
+{
+  options.custom.services.resolved.enable = lib.mkEnableOption "";
+
+  config = lib.mkIf config.custom.services.resolved.enable {
+    meta.ports.list = [
+      53
+      5353
+      5355
+    ];
+
+    services.resolved.enable = true;
+  };
+}

modules/system/services/syncthing/default.nix

@@ -40,6 +40,11 @@ in
       }
     ];
 
+    meta.ports.list = [
+      cfg.syncPort
+      cfg.gui.port
+    ];
+
     services.syncthing = {
       enable = true;
 

modules/system/services/tailscale.nix

@@ -14,6 +14,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    meta.ports.list = [ config.services.tailscale.port ];
+
     sops.secrets."tailscale-auth-key" = { };
 
     services.tailscale = {

modules/system/services/uptime-kuma/default.nix

@@ -16,6 +16,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    meta.ports.list = [ cfg.port ];
+
     services.uptime-kuma = {
       enable = true;
       settings.PORT = toString cfg.port;