{config, lib, ...}: let
  inherit (lib.modules) mkIf;
  cfg = config.services.nginx;
in {
  networking.firewall.allowedTCPPorts = mkIf cfg.enable [
    443
    80
  ];
}