configration.nix

{ config, pkgs, ...}: {

  imports = [ ./mymodule.nix ];
  
  mymodule.services.service1.enable = true;
  mymodule.services.service2.enable = true;
  
  networking.firewall.allowedTCPPorts = [
    config.mymodule.services.service1.port
    config.mymodule.services.service2.port
  ];

}

mymodule.nix

{ config, pkgs, lib, ... }: with lib; {

  options.mymodule.services = mkOption {
    default = {};
    type = with types; attrsOf ( submodule {
      port = mkOption {
        type = with types; nullOr int;
        default = null;
      };
    });
    apply = services: let
      notNullOrDefault = value: default: if value != null then value else default;
      ensureAssignedPort = service: defaultPort: service // { port = notNullOrDefault service.port defaultPort; };
    in listToAttrs(imap0(n: name:
      nameValuePair name (ensureAssignedPort services.${name} (5000 + n)))
      (attrNames services)
    );
  };

  config = mkIf (services != {}) {
  };

}