refactor: extract 'firewall' and 'wol' modules

modules/firewall/default.nix

@@ -0,0 +1,27 @@
+{ lib, config, ... }:
+
+let
+  inherit (lib) mkEnableOption mkOption types;
+in
+{
+  options.firewall = {
+    enable = mkEnableOption "firewall";
+
+    allowedTCPPorts = mkOption {
+      type = types.listOf types.port;
+      default = [ ];
+    };
+
+    allowedUDPPorts = mkOption {
+      type = types.listOf types.port;
+      default = [ ];
+    };
+  };
+
+  config = lib.mkIf config.firewall.enable {
+    networking.firewall = {
+      enable = true;
+      inherit (config.firewall) allowedTCPPorts allowedUDPPorts;
+    };
+  };
+}