# roles/thin-client/network/firewall.nix
#
# Hardened firewall: deny all inbound except NetBird interface and ICMP.
{config, lib, ...}: let
  inherit (lib) mkIf;
  cfg = config.az.tc;
in {
  config = mkIf cfg.enable {
    networking.firewall = {
      enable = true;
      allowPing = true;
      # No inbound TCP/UDP ports opened — all access via NetBird.
      allowedTCPPorts = [];
      allowedUDPPorts = [];

      # NetBird's WireGuard port (allowed by NetBird service itself,
      # but make explicit here).
      interfaces."wt0".allowedTCPPorts = []; # NetBird userspace daemon
      trustedInterfaces = ["lo"];
      checkReversePath = "loose";
    };
  };
}