From 84160ddeb87005ca31b58ea0c55c9c7241d1eb77 Mon Sep 17 00:00:00 2001
From: ArisoN <arison@duck.com>
Date: Mon, 25 May 2026 15:49:50 +0300
Subject: [PATCH] nixos/firewalld: add reload triggers for config file changes

When firewalld serves as the backend for networking.firewall, changes
to allowedTCPPorts, zones, settings etc. rewrite /etc/firewalld/*
but firewalld.service was never reloaded. Add reloadTriggers pointing
to firewalld.conf, all zone XMLs and service XMLs so
switch-to-configuration reloads the daemon on nixos-rebuild switch.

nixos/firewalld: treefmt
---
 .../services/networking/firewalld/default.nix      | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/firewalld/default.nix b/nixos/modules/services/networking/firewalld/default.nix
index e0e8bf4cb47c..aa6217db21ab 100644
--- a/nixos/modules/services/networking/firewalld/default.nix
+++ b/nixos/modules/services/networking/firewalld/default.nix
@@ -57,7 +57,19 @@ in
     systemd.services.firewalld = {
       aliases = [ "dbus-org.fedoraproject.FirewallD1.service" ];
       wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecReload = "${lib.getExe' pkgs.coreutils "kill"} -HUP $MAINPID";
+      serviceConfig.ExecReload = [
+        ""
+        "${lib.getExe' pkgs.coreutils "kill"} -HUP $MAINPID"
+      ];
+      reloadTriggers = [
+        config.environment.etc."firewalld/firewalld.conf".source
+      ]
+      ++ lib.mapAttrsToList (
+        name: _: config.environment.etc."firewalld/zones/${name}.xml".source
+      ) config.services.firewalld.zones
+      ++ lib.mapAttrsToList (
+        name: _: config.environment.etc."firewalld/services/${name}.xml".source
+      ) config.services.firewalld.services;
       environment.NIX_FIREWALLD_CONFIG_PATH = "${paths}/lib/firewalld";
     };
   };