{pkgs, ...}: {
  networking.firewall.allowedTCPPorts = [
    80 #nginx/http
    22 #ssh
    222 #ubuntu vm ssh
    443 #ssl

    2200 #forgejo ssh
    3000 #forgejo http

    9090 #sync.io

    9091 #caddy
  ];
}