retard move (at least it works for now)

services.udev.extraRules = 
  ''ACTION=="add", KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ''
  + ''ATTRS{idVendor}=="16d6", ATTRS{idProduct}=="0008", ''
  + ''MODE="0660", OWNER="hass", GROUP="hass", SYMLINK+="jablotron", ''
  + ''RUN+="/bin/sh -c 'systemctl restart home-assistant.service'"''

ok i've created a nixos module for an openthread border router, any feedback?

{
  config,
  pkgs,
  lib,
  ...
}:
{
  options.services.openthread-border-router = {
    enable = lib.mkEnableOption "Enable an OpenThread Border Router";
    package = lib.mkOption {
      type = lib.types.package;
      description = "The OpenThread Border Router package to use";
      default = pkgs.otbr-posix;
    };
    radioProtocol = lib.mkOption {
      description = "The protocol used to connect to the radio coprocessor";
      default = "spinel+hdlc+uart://";
      type = lib.types.string;
    };
    radioDevice = lib.mkOption {
      description = "The device file for the radio coprocessor";
      example = "/dev/ttyUSB0";
      type = lib.types.path;
    };
    infrastructureInterface = lib.mkOption {
      description = "The IPv6 interface to bridge the Thread network to";
      example = "eth0";
      type = lib.types.string;
    };
    logLevel = lib.mkOption {
      description = "The log level";
      type = lib.types.ints.between 1 7;
      default = 5;
    };
    threadInterface = lib.mkOption {
      description = "The Thread interface name to create";
      default = "wpan0";
      type = lib.types.string;
    };
    openFirewall = lib.mkOption {
      description = "Open the firewall port for the server's REST API";
      default = true;
      type = lib.types.bool;
    };
  };
  config =
    let
      cfg = config.services.openthread-border-router;
      otbr = cfg.package;
      threadInterface = cfg.threadInterface;
      accessInterface = cfg.infrastructureInterface;
      forwardIngressChain = "OTBR_FORWARD_INGRESS";

    in
    lib.mkIf cfg.enable {
      networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ 8081 ];
      systemd.services.otbr = {
        serviceConfig = {
          AmbientCapabilities = [
            "CAP_NET_ADMIN"
            "CAP_NET_RAW"
          ];
          CapabilityBoundingSet = [
            "CAP_NET_ADMIN"
            "CAP_NET_RAW"
          ];
        };
        script =
          let
            radioURI = "${cfg.radioProtocol}${cfg.radioDevice}";
          in
          "${otbr}/bin/otbr-agent --verbose -d ${builtins.toString cfg.logLevel} -I ${threadInterface} -B ${accessInterface} ${radioURI} trel://${accessInterface}";
        path = [
          otbr
          pkgs.ipset
          pkgs.iptables
        ];
        postStop = ''
          ipset_destroy_if_exist()
          {
              if ipset list "$1"; then
                  ipset destroy "$1"
              fi
          }
          while ip6tables -C FORWARD -o ${threadInterface} -j ${forwardIngressChain}; do
              ip6tables -D FORWARD -o ${threadInterface} -j ${forwardIngressChain}
          done

          if ip6tables -L ${forwardIngressChain}; then
              ip6tables -w -F ${forwardIngressChain}
              ip6tables -w -X ${forwardIngressChain}
          fi

          ipset_destroy_if_exist otbr-ingress-deny-src
          ipset_destroy_if_exist otbr-ingress-deny-src-swap
          ipset_destroy_if_exist otbr-ingress-allow-dst
          ipset_destroy_if_exist otbr-ingress-allow-dst-swap
        '';
        preStart = ''
          ipset create -exist otbr-ingress-deny-src hash:net family inet6
          ipset create -exist otbr-ingress-deny-src-swap hash:net family inet6
          ipset create -exist otbr-ingress-allow-dst hash:net family inet6
          ipset create -exist otbr-ingress-allow-dst-swap hash:net family inet6

          ip6tables -N ${forwardIngressChain}
          ip6tables -I FORWARD 1 -o ${threadInterface} -j ${forwardIngressChain}

          ip6tables -A ${forwardIngressChain} -m pkttype --pkt-type unicast -i ${threadInterface} -j DROP
          ip6tables -A ${forwardIngressChain} -m set --match-set otbr-ingress-deny-src src -j DROP
          ip6tables -A ${forwardIngressChain} -m set --match-set otbr-ingress-allow-dst dst -j ACCEPT
          ip6tables -A ${forwardIngressChain} -m pkttype --pkt-type unicast -j DROP
          ip6tables -A ${forwardIngressChain} -j ACCEPT
        '';
      };
    };
}

to unclutter it a bit you could

let
  inherit (lib)
    mkEnableOption
    mkOption
    mkPackageOption
    types
    ;
in

In reply to @hexa:lossy.network
the default nixos firewall uses nftables

In reply to @hexa:lossy.network
it just creates another scope, which has a cost