prometheus exporter modules: unify firewall handling

nixos/modules/services/monitoring/prometheus/blackbox-exporter.nix

···
           Extra commandline options when launching the blackbox exporter.
         '';
       };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Open port in firewall for incoming connections.
+        '';
+      };
     };
   };
 
   config = mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = optional cfg.openFirewall cfg.port;
+
     systemd.services.prometheus-blackbox-exporter = {
       description = "Prometheus exporter for blackbox probes";
       unitConfig.Documentation = "https://github.com/prometheus/blackbox_exporter";

nixos/modules/services/monitoring/prometheus/json-exporter.nix

···
           Extra commandline options when launching the JSON exporter.
         '';
       };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Open port in firewall for incoming connections.
+        '';
+      };
     };
   };
 
   config = mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = optional cfg.openFirewall cfg.port;
+
     systemd.services.prometheus-json-exporter = {
       description = "Prometheus exporter for JSON over HTTP";
       unitConfig.Documentation = "https://github.com/kawamuray/prometheus-json-exporter";

nixos/modules/services/monitoring/prometheus/nginx-exporter.nix

···
           Extra commandline options when launching the nginx exporter.
         '';
       };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Open port in firewall for incoming connections.
+        '';
+      };
     };
   };
 
   config = mkIf cfg.enable {
-    networking.firewall.allowedTCPPorts = [ cfg.port ];
+    networking.firewall.allowedTCPPorts = optional cfg.openFirewall cfg.port;
 
     systemd.services.prometheus-nginx-exporter = {
       after = [ "network.target" "nginx.service" ];

nixos/modules/services/monitoring/prometheus/node-exporter.nix

···
           Extra commandline options when launching the node exporter.
         '';
       };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Open port in firewall for incoming connections.
+        '';
+      };
     };
   };
 
   config = mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = optional cfg.openFirewall cfg.port;
+
     systemd.services.prometheus-node-exporter = {
       description = "Prometheus exporter for machine metrics";
       unitConfig.Documentation = "https://github.com/prometheus/node_exporter";

nixos/modules/services/monitoring/prometheus/varnish-exporter.nix

···
           Extra commandline options when launching the Varnish exporter.
         '';
       };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Open port in firewall for incoming connections.
+        '';
+      };
     };
   };
 
   config = mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = optional cfg.openFirewall cfg.port;
+
     systemd.services.prometheus-varnish-exporter = {
       description = "Prometheus exporter for Varnish metrics";
       unitConfig.Documentation = "https://github.com/jonnenauha/prometheus_varnish_exporter";