What problem does it solve? Changing network-facing services in a multi-host NixOS flake risks duplicated firewall rules, lockouts, broken state, and leaked secrets. This Skill guides safe service and firewall refactors in the nixcf repository by enforcing single rule ownership, typed options, and staged validation. ## Core Features & Use Cases - Firewall ownership migration: Inventory declared and evaluated rules, assign each TCP/UDP rule to exactly one owning module, and migrate without lockout. - Service hardening and state preservation: Design typed options (ports, bind addresses, openFirewall), minimize privileges with systemd hardening, and protect state for Gitea, Attic, Hobob, Syncthing, vlmcsd, and recorder containers. - Secret-safe workflows: Wire Agenix runtime credentials without exposing secret content, gated by a source-safety check before any Nix evaluation. - Use Case: When moving a Gitea or Attic firewall rule from a broad host-level range into the service module, use this Skill to compare evaluated ports before and after, preserve data paths, and stage rollout per host. ## Quick Start Use the nixcf-service-firewall skill to move the Gitea firewall rule into its service module and verify the evaluated ports stay unchanged.
