merge

modules/nixos/crowdsec/default.nix

@@ -58,11 +58,9 @@ in
         [ "${script}/bin/register-bouncer" ];
     };
 
-    networking = {
-      firewall = {
-        allowedTCPPorts = [ cfg.port ];
-        allowedUDPPorts = [ cfg.port ];
-      };
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+      allowedUDPPorts = [ cfg.port ];
     };
   };
 }

modules/nixos/crowdsec/options.nix

@@ -5,23 +5,33 @@ with lib;
     enable = mkEnableOption "crowdsec service";
 
     port = mkOption {
-      type = types.int;
+      type = types.port;
       default = 9898;
+      description = "Port for crowdsec API";
+    };
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = true;
+      description = "Whether to open firewall for crowdsec";
     };
 
     apiAddress = mkOption {
       type = types.str;
       default = "127.0.0.1";
+      description = "API address for crowdsec";
     };
 
     apiKey = mkOption {
       type = types.str;
       default = "";
+      description = "API key for crowdsec bouncer";
     };
 
     dataDir = mkOption {
       type = types.str;
       default = "";
+      description = "Data directory for crowdsec";
     };
   };
 }