nixos/wireguard: set networking.firewall.allowedUDPPorts automatically

[spacekookie]

Motivation for this change

This changes the wireguard module to automatically add the provided
listenPort for an interface to the list of allowed udp ports in the
firewall. This means that users don't have to do this themselves when
configuring a wireguard server.
It also adjusts the wireguard test to not rely on explicitly-set
firewall ports

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nix-review --run "nix-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Assured whether relevant documentation is up to date
• Fits CONTRIBUTING.md.

[grahamc]

We typically don't want to do this, with the notable exception of openssh. This is because it is easy for users to add this configuration setting, but difficult for users to remove it. I would personally prefer we not do this, even though I do understand that it makes common case configuration easier.

[alyssais]

When would you want to set a listen port, but not make it accessible?

[grahamc]

For example, I might want to make it accessible on some interfaces but not others.

[alyssais]

For example, I might want to make it accessible on some interfaces but not others.

Makes sense to me I guess.

[spacekookie]

We typically don't want to do this, with the notable exception of openssh. This is because it is easy for users to add this configuration setting, but difficult for users to remove it. I would personally prefer we not do this, even though I do understand that it makes common case configuration easier.

Alright, yea that makes sense.

I couldn't find any issues/ PRs where this rationale had been pointed out explicitly before. So I guess this is now documentation 😅