From a5719c4e02382abbf1bce488a5fb1d2bcc1ff776 Mon Sep 17 00:00:00 2001
From: root <root@openclaw.thehellings.lan>
Date: Wed, 25 Mar 2026 17:35:52 -0500
Subject: [PATCH] fix: open ports 80/443 in proxy module when proxies are
 configured

The greg.proxies module enables nginx but never opened the firewall,
so all proxied services (Jellyfin, Grafana, etc.) were unreachable
on the LAN. Add allowedTCPPorts [80 443] conditioned on the same
mkIf guard as the nginx virtualHosts config.
---
 modules/nixos/proxy.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/nixos/proxy.nix b/modules/nixos/proxy.nix
index de90a2c..46cc37b 100644
--- a/modules/nixos/proxy.nix
+++ b/modules/nixos/proxy.nix
@@ -92,4 +92,9 @@ with lib;
 
     virtualHosts = mapAttrs makeHost cfg;
   };
+
+  config.networking.firewall.allowedTCPPorts = mkIf ((attrValues cfg) != [ ]) [
+    80
+    443
+  ];
 }