anchor.diff:        uid = config.ids.uids.unifi;
         description = "UniFi controller daemon user";
         home = "${stateDir}";
  +    };
  +
  +    networking.firewall = mkIf cfg.openPorts {
  +      # https://help.ubnt.com/hc/en-us/articles/204910084-UniFi-Change-Default-Ports-for-Controller-and-UAPs
  +      allowedTCPPorts = [
  +        8080  # Port for UAP to inform controller.
  +        8880  # Port for HTTP portal redirect, if guest portal is enabled.
  +        8843  # Port for HTTPS portal redirect, ditto.
  +      ];
  +      allowedUDPPorts = [
  +        3478  # UDP port used for STUN.
  +        10001 # UDP port used for device discovery.
  +      ];
       };
   
       # We must create the binary directories as bind mounts instead of symlinks
  
positive.code:       '';
      };
  
    };
  
    config = mkIf cfg.enable {
  
negative.code: 
        preStart = ''
          # Ensure privacy of state and data.
          chown unifi "${stateDir}" "${stateDir}/data"
          chmod 0700 "${stateDir}" "${stateDir}/data"
  
          # Create the volatile webapps
          rm -rf "${stateDir}/webapps"
  