{ lib, config, ... }:
with lib;
{
  config = {
    networking.firewall.allowedTCPPorts = [
      (mkIf config.services.nginx.enable 80)
      (mkIf config.services.nginx.enable 443)
    ];
  };
}