When firewalld serves as the backend for networking.firewall, changes to allowedTCPPorts, zones, settings etc. rewrite /etc/firewalld/* but firewalld.service was never reloaded. Add reloadTriggers pointing to firewalld.conf, all zone XMLs and service XMLs so switch-to-configuration reloads the daemon on nixos-rebuild switch. nixos/firewalld: treefmt