nixos/searx: add openFirewall option (#500388)

nixos/modules/services/networking/searx.nix

@@ -54,6 +54,19 @@ in
         description = "Whether to enable Searx, the meta search engine.";
       };
 
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to open the port in the firewall.
+          Enabling this option adds the port specified in {option}`services.settings.server.port` to {option}`networking.firewall.allowedTCPPorts`.
+
+          ::: {.note}
+          When this option is set to true, {option}`services.settings.server.port` must be set as well or an error will be thrown.
+          :::
+        '';
+      };
+
       domain = mkOption {
         type = types.str;
         description = ''
@@ -244,6 +257,13 @@ in
   ];
 
   config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.openFirewall -> cfg.settings ? server.port;
+        message = "services.searx.settings.server.port must be set when openFirewall is enabled.";
+      }
+    ];
+
     environment = {
       etc = {
         "searxng/favicons.toml" = lib.mkIf (cfg.faviconsSettings != { }) {
@@ -392,6 +412,8 @@ in
         isSystemUser = true;
       };
     };
+
+    networking.firewall = lib.mkIf cfg.openFirewall { allowedTCPPorts = [ cfg.settings.server.port ]; };
   };
 
   meta.maintainers = with maintainers; [