meta/ports: Separate tcp and udp lists to avoid false conflicts

modules/system/meta/ports.nix

@@ -10,7 +10,11 @@ let
 in
 {
   options.meta.ports = {
-    list = lib.mkOption {
+    tcp.list = lib.mkOption {
+      type = lib.types.listOf lib.types.port;
+      default = [ ];
+    };
+    udp.list = lib.mkOption {
       type = lib.types.listOf lib.types.port;
       default = [ ];
     };
@@ -20,8 +24,9 @@ in
   config = lib.mkIf cfg.assertUnique {
     assertions =
       let
-        duplicatePorts =
-          options.meta.ports.list.definitionsWithLocations
+        findDuplicatePorts =
+          protocol:
+          options.meta.ports.${protocol}.list.definitionsWithLocations
           |> lib.concatMap (
             entry:
             entry.value
@@ -33,7 +38,8 @@ in
           |> lib.groupBy (entry: builtins.toString entry.port)
           |> lib.filterAttrs (_: entries: lib.length entries > 1);
 
-        errorMessage =
+        mkErrorMessage =
+          duplicatePorts:
           duplicatePorts
           |> lib.mapAttrsToList (
             port: entries:
@@ -41,11 +47,19 @@ in
             + (entries |> lib.map (entry: "  - ${entry.file}") |> lib.concatLines)
           )
           |> lib.concatStrings;
+
+        duplicateTcpPorts = findDuplicatePorts "tcp";
+
+        duplicateUdpPorts = findDuplicatePorts "udp";
       in
       [
         {
-          assertion = duplicatePorts == { };
-          message = errorMessage;
+          assertion = duplicateTcpPorts == { };
+          message = mkErrorMessage duplicateTcpPorts;
+        }
+        {
+          assertion = duplicateUdpPorts == { };
+          message = mkErrorMessage duplicateUdpPorts;
         }
       ];
   };

modules/system/services/actualbudget.nix

@@ -12,14 +12,14 @@ in
     };
     port = lib.mkOption {
       type = lib.types.port;
-      default = 8888;
+      default = 5006;
     };
   };
 
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports.tcp.list = [ cfg.port ];
     };
 
     services.actual = {

modules/system/services/alloy.nix

@@ -18,7 +18,7 @@ in
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports.tcp.list = [ cfg.port ];
     };
 
     services.alloy = {

modules/system/services/caddy.nix

@@ -81,7 +81,7 @@ in
   config = lib.mkIf (virtualHosts != { }) (
     lib.mkMerge [
       {
-        meta.ports.list = lib.mkIf nonTailscaleHostsExist ports;
+        meta.ports.tcp.list = lib.mkIf nonTailscaleHostsExist ports;
 
         networking.firewall.allowedTCPPorts = lib.mkIf nonTailscaleHostsExist ports;
 

modules/system/services/crowdsec/default.nix

@@ -36,7 +36,7 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    meta.ports.list = [
+    meta.ports.tcp.list = [
       cfg.apiPort
       cfg.prometheusPort
     ];

modules/system/services/forgejo/default.nix

@@ -24,7 +24,7 @@ in
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports.tcp.list = [ cfg.port ];
     };
 
     sops.secrets."forgejo/admin-password".owner = config.users.users.forgejo.name;

modules/system/services/forgejo/ssh.nix

@@ -12,7 +12,7 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    meta.ports.list = [ cfg.port ];
+    meta.ports.tcp.list = [ cfg.port ];
 
     services.forgejo.settings.server.SSH_PORT = cfg.port;
 

modules/system/services/gatus.nix

@@ -75,7 +75,7 @@ in
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports.tcp.list = [ cfg.port ];
     };
 
     sops = {

modules/system/services/grafana.nix

@@ -18,7 +18,7 @@ in
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports.tcp.list = [ cfg.port ];
     };
 
     sops.secrets."grafana/admin-password".owner = config.users.users.grafana.name;

modules/system/services/hedgedoc.nix

@@ -24,7 +24,7 @@ in
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports.tcp.list = [ cfg.port ];
     };
 
     sops = {

modules/system/services/it-tools.nix

@@ -23,7 +23,7 @@ in
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports.tcp.list = [ cfg.port ];
     };
 
     services.static-web-server = {

modules/system/services/nextcloud/default.nix

@@ -27,7 +27,10 @@ in
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports = {
+        tcp.list = [ cfg.port ];
+        udp.list = [ config.services.postgresql.settings.port ];
+      };
     };
 
     sops.secrets."nextcloud/admin-password".owner = user;

modules/system/services/ntfy.nix

@@ -18,7 +18,7 @@ in
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports.tcp.list = [ cfg.port ];
     };
 
     services.ntfy-sh = {

modules/system/services/openspeedtest.nix

@@ -18,7 +18,7 @@ in
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports.tcp.list = [ cfg.port ];
     };
 
     virtualisation.oci-containers.containers.openspeedtest = {

modules/system/services/radicale.nix

@@ -18,7 +18,7 @@ in
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports.tcp.list = [ cfg.port ];
     };
 
     sops = {

modules/system/services/resolved.nix

@@ -3,11 +3,18 @@
   options.custom.services.resolved.enable = lib.mkEnableOption "";
 
   config = lib.mkIf config.custom.services.resolved.enable {
-    meta.ports.list = [
+    meta.ports =
+      let
+        ports = [
           53
           5353
           5355
         ];
+      in
+      {
+        tcp.list = ports;
+        udp.list = ports;
+      };
 
     services.resolved.enable = true;
   };

modules/system/services/syncthing.nix

@@ -49,10 +49,13 @@ in
 
     meta = {
       domains.list = lib.mkIf cfg.isServer [ cfg.gui.domain ];
-      ports.list = [
+      ports = {
+        tcp.list = [
           cfg.syncPort
           cfg.gui.port
         ];
+        udp.list = [ cfg.syncPort ];
+      };
     };
 
     sops.secrets = lib.mkIf useStaticTls {

modules/system/services/tailscale.nix

@@ -14,7 +14,9 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    meta.ports.list = [ config.services.tailscale.port ];
+    meta.ports.udp.list = lib.mkIf config.services.tailscale.openFirewall [
+      config.services.tailscale.port
+    ];
 
     sops.secrets."tailscale/auth-key" = { };
 

modules/system/services/victorialogs.nix

@@ -27,7 +27,7 @@ in
   config = lib.mkIf cfg.enable {
     meta = {
       domains.list = [ cfg.domain ];
-      ports.list = [ cfg.port ];
+      ports.tcp.list = [ cfg.port ];
     };
 
     services.victorialogs = {