refactor: always allow HTTPS through firewall

modules/forgejo/default.nix

@@ -3,6 +3,8 @@ let
   cfg = config.aether.forgejo;
   forgejo = config.services.forgejo;
   srv = forgejo.settings.server;
+
+  useSubdomain = !(builtins.isNull cfg.subdomain);
 in {
   imports = [ ./options.nix ];
 
@@ -22,7 +24,7 @@ in {
   security.acme.defaults.email = cfg.acmeEmail;
 
   networking.firewall.allowedTCPPorts =
-    [ 80 ] ++ lib.optional config.aether.https 443;
+    [ 80 443 ];
 
   # Forgejo
 
@@ -33,16 +35,15 @@ in {
     database.user = forgejo.user;
 
     settings.server = {
-      DOMAIN = lib.optionalString (!(builtins.isNull cfg.subdomain)) "${cfg.subdomain}."
+      DOMAIN = lib.optionalString useSubdomain "${cfg.subdomain}."
                + config.aether.domain;
       ROOT_URL = "https://${srv.DOMAIN}/";
     };
   };
 
   systemd.tmpfiles.rules =
-    lib.optional
+    lib.optional useSubdomain
-      (!(builtins.isNull cfg.templates))
+      "L+ ${forgejo.stateDir}/custom/templates - - - - ${cfg.templates}";
-      "L+ ${cfg.stateDir}/custom/templates - - - - ${cfg.templates}";
 }
 // lib.mkIf cfg.createUser {
   users.users.${forgejo.user} = {