meta/ports: Separate tcp and udp lists to avoid false conflicts

modules/system/services/actualbudget.nix

@@ -12,14 +12,14 @@ in
     };
     port = lib.mkOption {
       type = lib.types.port;
-      default = 8888;
+      default = 5006;
     };
   };
 
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports.tcp.list = [ cfg.port ];
     };
 
     services.actual = {

modules/system/services/alloy.nix

@@ -18,7 +18,7 @@ in
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports.tcp.list = [ cfg.port ];
     };
 
     services.alloy = {

modules/system/services/caddy.nix

@@ -81,7 +81,7 @@ in
   config = lib.mkIf (virtualHosts != { }) (
     lib.mkMerge [
       {
-        meta.ports.list = lib.mkIf nonTailscaleHostsExist ports;
+        meta.ports.tcp.list = lib.mkIf nonTailscaleHostsExist ports;
 
         networking.firewall.allowedTCPPorts = lib.mkIf nonTailscaleHostsExist ports;
 

modules/system/services/crowdsec/default.nix

@@ -36,7 +36,7 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    meta.ports.list = [
+    meta.ports.tcp.list = [
       cfg.apiPort
       cfg.prometheusPort
     ];

modules/system/services/forgejo/default.nix

@@ -24,7 +24,7 @@ in
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports.tcp.list = [ cfg.port ];
     };
 
     sops.secrets."forgejo/admin-password".owner = config.users.users.forgejo.name;

modules/system/services/forgejo/ssh.nix

@@ -12,7 +12,7 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    meta.ports.list = [ cfg.port ];
+    meta.ports.tcp.list = [ cfg.port ];
 
     services.forgejo.settings.server.SSH_PORT = cfg.port;
 

modules/system/services/gatus.nix

@@ -75,7 +75,7 @@ in
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports.tcp.list = [ cfg.port ];
     };
 
     sops = {

modules/system/services/grafana.nix

@@ -18,7 +18,7 @@ in
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports.tcp.list = [ cfg.port ];
     };
 
     sops.secrets."grafana/admin-password".owner = config.users.users.grafana.name;

modules/system/services/hedgedoc.nix

@@ -24,7 +24,7 @@ in
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports.tcp.list = [ cfg.port ];
     };
 
     sops = {

modules/system/services/it-tools.nix

@@ -23,7 +23,7 @@ in
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports.tcp.list = [ cfg.port ];
     };
 
     services.static-web-server = {

modules/system/services/nextcloud/default.nix

@@ -27,7 +27,10 @@ in
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports = {
+        tcp.list = [ cfg.port ];
+        udp.list = [ config.services.postgresql.settings.port ];
+      };
     };
 
     sops.secrets."nextcloud/admin-password".owner = user;

modules/system/services/ntfy.nix

@@ -18,7 +18,7 @@ in
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports.tcp.list = [ cfg.port ];
     };
 
     services.ntfy-sh = {

modules/system/services/openspeedtest.nix

@@ -18,7 +18,7 @@ in
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports.tcp.list = [ cfg.port ];
     };
 
     virtualisation.oci-containers.containers.openspeedtest = {

modules/system/services/radicale.nix

@@ -18,7 +18,7 @@ in
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports.tcp.list = [ cfg.port ];
     };
 
     sops = {

modules/system/services/resolved.nix

@@ -3,11 +3,18 @@
   options.custom.services.resolved.enable = lib.mkEnableOption "";
 
   config = lib.mkIf config.custom.services.resolved.enable {
-    meta.ports.list = [
-      53
-      5353
-      5355
-    ];
+    meta.ports =
+      let
+        ports = [
+          53
+          5353
+          5355
+        ];
+      in
+      {
+        tcp.list = ports;
+        udp.list = ports;
+      };
 
     services.resolved.enable = true;
   };

modules/system/services/syncthing.nix

@@ -49,10 +49,13 @@ in
 
     meta = {
       domains.list = lib.mkIf cfg.isServer [ cfg.gui.domain ];
-      ports.list = [
-        cfg.syncPort
-        cfg.gui.port
-      ];
+      ports = {
+        tcp.list = [
+          cfg.syncPort
+          cfg.gui.port
+        ];
+        udp.list = [ cfg.syncPort ];
+      };
     };
 
     sops.secrets = lib.mkIf useStaticTls {

modules/system/services/tailscale.nix

@@ -14,7 +14,9 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    meta.ports.list = [ config.services.tailscale.port ];
+    meta.ports.udp.list = lib.mkIf config.services.tailscale.openFirewall [
+      config.services.tailscale.port
+    ];
 
     sops.secrets."tailscale/auth-key" = { };
 

modules/system/services/victorialogs.nix

@@ -27,7 +27,7 @@ in
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports.tcp.list = [ cfg.port ];
     };
 
     services.victorialogs = {