feat: open listen addr and add firewall config

config.nix

@@ -12,6 +12,12 @@ in
       description = "Port to listen on for HTTP/SSE server";
     };
 
+    openFirewall = mkOption {
+      default = false;
+      type = types.bool;
+      description = "Whether to open the firewall for the specified port.";
+    };
+
     user = lib.mkOption {
       type = lib.types.str;
       default = "cratedocs-mcp";
@@ -26,13 +32,15 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
+
     systemd.services.cratedocs-mcp = {
       description = "CrateDocs MCP server";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
-        ExecStart = "${lib.getExe pkgs.cratedocs-mcp} http -a 127.0.0.1:${toString cfg.port}";
+        ExecStart = "${lib.getExe pkgs.cratedocs-mcp} http -a 0.0.0.0:${toString cfg.port}";
         Restart = "always";
         User = cfg.user;
         Group = cfg.group;