nixos/firewall: Cleanup in case reload fails