From 0cf8b1c078e5564ee3a6abf5b07e656c424f0ea1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B8rn=20Forsman?= <bjorn.forsman@gmail.com>
Date: Fri, 4 Nov 2022 14:05:43 +0100
Subject: [PATCH] nixos/sane: add openFirewall option

Open ports needed for discovery of scanners on the local network, e.g.
needed for Canon scanners (BJNP protocol).

Ref. https://github.com/NixOS/nixpkgs/issues/28406.

(cherry picked from commit c3cff074f8dc3aaa4739ae0f60d0b3c907aba164)
---
 nixos/modules/services/hardware/sane.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/nixos/modules/services/hardware/sane.nix b/nixos/modules/services/hardware/sane.nix
index dd5c65b1f6a6..fe6dd268df60 100644
--- a/nixos/modules/services/hardware/sane.nix
+++ b/nixos/modules/services/hardware/sane.nix
@@ -126,6 +126,15 @@ in
       '';
     };
 
+    hardware.sane.openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Open ports needed for discovery of scanners on the local network, e.g.
+        needed for Canon scanners (BJNP protocol).
+      '';
+    };
+
     services.saned.enable = mkOption {
       type = types.bool;
       default = false;
@@ -163,6 +172,7 @@ in
       services.udev.packages = backends;
 
       users.groups.scanner.gid = config.ids.gids.scanner;
+      networking.firewall.allowedUDPPorts = mkIf config.hardware.sane.openFirewall [ 8612 ];
     })
 
     (mkIf config.services.saned.enable {