2 files changed, 17 insertions, 3 deletions
diff --git a/modules/services/default.nix b/modules/services/default.nix
index 637e60f..8da870e 100644
--- a/modules/services/default.nix
+++ b/modules/services/default.nix
@@ -1,6 +1,14 @@
 { ... }:
 
 {
-  imports =
-    [ ./navidrome ./samba ./ssh-server ./tailscale ./thermald ./tlp ./fwupd ];
+  imports = [
+    ./fwupd
+    ./navidrome
+    ./samba
+    ./ssh-server
+    ./tailscale
+    ./thermald
+    ./tlp
+    ./unifi
+  ];
 }
diff --git a/hosts/common/server/unifi.nix b/modules/services/unifi/default.nix
index ab32cec..af7b059 100644
--- a/hosts/common/server/unifi.nix
+++ b/modules/services/unifi/default.nix
@@ -1,6 +1,7 @@
 { config, lib, pkgs, ... }:
 
 let
+  cfg = config.my.services.unifi;
   allowedRules = {
     # https://help.ubnt.com/hc/en-us/articles/218506997
     allowedTCPPorts = [
@@ -8,6 +9,7 @@ let
       8880 # Port for HTTP portal redirect, if guest portal is enabled.
       8843 # Port for HTTPS portal redirect, ditto.
       6789 # Port for UniFi mobile speed test.
+      9130 # Port for the prometheus exporter
     ];
     allowedUDPPorts = [
       3478 # UDP port used for STUN.
@@ -15,7 +17,11 @@ let
     ];
   };
 in {
-  config = {
+  options.my.services.unifi = with lib; {
+    enable = mkEnableOption "Unifi controller";
+  };
+
+  config = lib.mkIf cfg.enable {
     networking.firewall = allowedRules;
     users.users.unifi.group = "unifi";
     users.users.unifi.isSystemUser = true;