Open proxy protocol, node-exporter ports

config/default.nix

@@ -85,6 +85,12 @@
     ];
   };
 
+  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [
+    # proxy protocol used by public-access-proxy
+    8080
+    8443
+  ];
+
   nix = {
     deleteChannels = true;
     deleteUserProfiles = true;

modules/stats.nix

@@ -14,6 +14,8 @@ in
   };
 
   config = {
+    networking.firewall.allowedTCPPorts = [ 9100 ];
+
     services = lib.mkMerge [
       (let
         nginxStatusPort = 9100;