nixos/firewall: disable refused connections logging

On any server on the internet this causes fast rotation of the kernel
ringbuffer, which makes more important message disappear from dmesg much
too quickly.

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -343,6 +343,12 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
 - `services.slurm` now supports slurmrestd usage through the `services.slurm.rest` NixOS options.
 
+- The `networking.firewall.logRefusedConnections` option now defaults to
+  `false`.  Logging of refused or dropped incoming connections can generate a
+  very high volume of kernel log messages on internet-facing systems, causing
+  the kernel ring buffer (dmesg) to rotate quickly and potentially discard more
+  relevant diagnostic information.
+
 - The `services.calibre-web` systemd service has been hardened with additional sandboxing restrictions.
 
 - `services.kanidm` options for server, client and unix were moved under dedicated namespaces.

nixos/modules/services/networking/firewall.nix

@@ -118,7 +118,7 @@ in
 
       logRefusedConnections = lib.mkOption {
         type = lib.types.bool;
-        default = true;
+        default = false;
         description = ''
           Whether to log rejected or dropped incoming connections.
           Note: The logs are found in the kernel logs, i.e. dmesg