refactor: extract 'firewall' and 'wol' modules

modules/firewall/default.nix

@@ -0,0 +1,27 @@
+{ lib, config, ... }:
+
+let
+  inherit (lib) mkEnableOption mkOption types;
+in
+{
+  options.firewall = {
+    enable = mkEnableOption "firewall";
+
+    allowedTCPPorts = mkOption {
+      type = types.listOf types.port;
+      default = [ ];
+    };
+
+    allowedUDPPorts = mkOption {
+      type = types.listOf types.port;
+      default = [ ];
+    };
+  };
+
+  config = lib.mkIf config.firewall.enable {
+    networking.firewall = {
+      enable = true;
+      inherit (config.firewall) allowedTCPPorts allowedUDPPorts;
+    };
+  };
+}

modules/wol/default.nix

@@ -0,0 +1,33 @@
+{ lib, config, ... }:
+
+let
+  inherit (lib) mkEnableOption mkOption types;
+in
+{
+  options.wol = {
+    enable = mkEnableOption "Wake-on-LAN configuration";
+
+    interfaces = mkOption {
+      type = types.attrsOf (
+        types.submodule {
+          options = {
+            macAddress = mkOption {
+              type = types.str;
+              example = "02:68:b3:29:da:98";
+            };
+          };
+        }
+      );
+      default = { };
+    };
+  };
+
+  config = lib.mkIf config.wol.enable {
+    networking.interfaces = lib.mapAttrs (_: iface: {
+      wakeOnLan.enable = true;
+      inherit (iface) macAddress;
+    }) config.wol.interfaces;
+
+    # firewall.allowedUDPPorts = [ 9 ];
+  };
+}