feat: nix/fod firewall deployment

Author: Conni2461

flake.lock

@@ -3,6 +3,7 @@
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
     nixpkgs_25_05.url = "github:NixOS/nixpkgs/nixos-25.05-small";
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs-unstable-helsinki.url = "github:helsinki-systems/nixpkgs/feat/nix-daemon-firewall";
     # Why?
     flake-parts.url = "github:hercules-ci/flake-parts";
     flake-parts.inputs.nixpkgs-lib.follows = "nixpkgs";

flake.nix

@@ -5,9 +5,24 @@
     "${inputs.infra}/modules/common.nix"
     "${inputs.infra}/non-critical-infra/modules/common.nix"
     ./ofborg-config.nix
+    "${inputs.nixpkgs-unstable-helsinki}/nixos/modules/services/system/nix-daemon-firewall.nix"
   ];
 
-  nix.gc.automatic = true;
+  nix = {
+    gc.automatic = true;
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [
+        21 # access to ftp files
+        22 # fetchGit
+        34
+        "http"
+        443
+        "30000-31000"
+      ];
+      allowedUDPPorts = [ 53 ];
+    };
+  };
 
   # TODO wire up exporters
   # TODO loki