The wg-hive allowedTCPPorts rule gated on deploy.wireguard.enable was a cross-service toggle read in swarm-nats.nix; it now lives in glue-nats-wireguard.nix under the same condition and value.
