From abd4cb9ecfa04cad6147dd6c8a093edd7a9a4add Mon Sep 17 00:00:00 2001
From: Daniel Perez <danielpza@protonmail.com>
Date: Mon, 16 Mar 2026 05:34:57 -0700
Subject: [PATCH] nixos/searx: add openFirewall option

Added an `openFirewall` option to searx module, similar to many other
modules.

This option adds the specified port from `settings.server.port` to
`networking.firewall.allowedTCPPorts`
---
 nixos/modules/services/networking/searx.nix | 22 +++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/nixos/modules/services/networking/searx.nix b/nixos/modules/services/networking/searx.nix
index 8f09ad170ac7..da48474d776c 100644
--- a/nixos/modules/services/networking/searx.nix
+++ b/nixos/modules/services/networking/searx.nix
@@ -54,6 +54,19 @@ in
         description = "Whether to enable Searx, the meta search engine.";
       };
 
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to open the port in the firewall.
+          Enabling this option adds the port specified in {option}`services.settings.server.port` to {option}`networking.firewall.allowedTCPPorts`.
+
+          ::: {.note}
+          When this option is set to true, {option}`services.settings.server.port` must be set as well or an error will be thrown.
+          :::
+        '';
+      };
+
       domain = mkOption {
         type = types.str;
         description = ''
@@ -244,6 +257,13 @@ in
   ];
 
   config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.openFirewall -> cfg.settings ? server.port;
+        message = "services.searx.settings.server.port must be set when openFirewall is enabled.";
+      }
+    ];
+
     environment = {
       etc = {
         "searxng/favicons.toml" = lib.mkIf (cfg.faviconsSettings != { }) {
@@ -392,6 +412,8 @@ in
         isSystemUser = true;
       };
     };
+
+    networking.firewall = lib.mkIf cfg.openFirewall { allowedTCPPorts = [ cfg.settings.server.port ]; };
   };
 
   meta.maintainers = with maintainers; [