caesium: bump

module.firewall.nix

@@ -34,15 +34,17 @@ let
   formatCidrRule = rule: cidr:
     let
       family = if hasInfix ":" cidr then "ip6" else "ip";
-      # toString handles both integers (2222) and strings ("8000-8010") cleanly
-      portStr = toString rule.port; 
+      # toString handles both integers (2222) and strings ("8000-8010") cleanly --
+      # nftables accepts dash-range syntax directly in a rule statement.
+      portStr = toString rule.port;
     in
-      "${family} saddr ${cidr} ${rule.protocol} dport ${portStr} accept comment \"${rule.name}\"";
+    "${family} saddr ${cidr} ${rule.protocol} dport ${portStr} accept comment \"${rule.name}\"";
 
-  formatRule = ruleName: rule:
+  formatRule = _ruleName: rule:
     concatMapStringsSep "\n" (formatCidrRule rule) rule.allowedCIDRs;
 
-in {
+in
+{
   options.networking.firewall.restrictedPorts = mkOption {
     type = types.attrsOf (types.submodule ruleOpts);
     default = { };
@@ -50,7 +52,7 @@ in {
   };
 
   config = mkIf (cfg != { }) {
-    networking.firewall.extraInputRules = 
+    networking.firewall.extraInputRules =
       concatMapStringsSep "\n" (ruleName: formatRule ruleName cfg.${ruleName}) (attrNames cfg);
   };
 }