diff --git a/hosts/tsumugi/arr/default.nix b/hosts/tsumugi/arr/default.nix
index d1c35ee..9d75e40 100644
--- a/hosts/tsumugi/arr/default.nix
+++ b/hosts/tsumugi/arr/default.nix
@@ -71,38 +71,4 @@
       };
     };
   };
-
-  networking = {
-    nat =
-      let
-        wildcard = if config.networking.nftables.enable then "*" else "+";
-      in
-      {
-        enable = true;
-        enableIPv6 = true;
-        # internalInterfaces = [ ("ve-" + wildcard) ];
-        internalInterfaces = [ "br0" ];
-        externalInterface = "enp6s0";
-      };
-    #networkmanager.unmanaged = [ "interface-name:ve-*" ];
-  };
-  systemd.network = {
-    enable = true;
-    wait-online.enable = false;
-    netdevs = {
-      "20-br0" = {
-        netdevConfig = {
-          Kind = "bridge";
-          Name = "br0";
-        };
-      };
-    };
-    networks = {
-      "40-br0" = {
-        matchConfig.Name = "br0";
-        address = [ "192.168.0.1/16" ];
-      };
-    };
-  };
-
 }
diff --git a/hosts/tsumugi/arr/mkPortRemap.nix b/hosts/tsumugi/arr/mkPortRemap.nix
index dfebe84..390e220 100644
--- a/hosts/tsumugi/arr/mkPortRemap.nix
+++ b/hosts/tsumugi/arr/mkPortRemap.nix
@@ -18,7 +18,7 @@ in
       autoStart = true;
       privateNetwork = true;
       hostBridge = "br0";
-      localAddress = "192.168.${toString id}.10/16";
+      localAddress = "192.168.100.${toString id}/24";
       forwardPorts = [
         {
           containerPort = containerPort;
@@ -37,7 +37,7 @@ in
           networking = {
             firewall.enable = true;
             useHostResolvConf = lib.mkForce false;
-            defaultGateway.address = "192.168.0.1";
+            defaultGateway.address = "192.168.100.1";
             nameservers = [
               "10.0.4.1"
             ];
diff --git a/hosts/tsumugi/arr/radarrAnime.nix b/hosts/tsumugi/arr/radarrAnime.nix
index 9d19352..99df708 100644
--- a/hosts/tsumugi/arr/radarrAnime.nix
+++ b/hosts/tsumugi/arr/radarrAnime.nix
@@ -9,19 +9,21 @@
 let
   profileName = "1080p Anime Movie";
   inherit ((import ./mkRecyclarrScore.nix) profileName) mkScores mkScore;
-  inherit ((import ./mkPortRemap.nix) { inherit config lib; }) portRemap;
 in
 {
-  networking.firewall.allowedTCPPorts = [ 7887 ];
 
-  containers.radarrAnime = portRemap {
-    id = 2;
-    containerPort = 7878;
-    hostPort = 7887;
+  containers.radarrAnime = {
+    autoStart = true;
+    bindMounts."/mnt/media".isReadOnly = false;
     config = {
+      system.stateVersion = "24.05";
       services.radarr = {
         enable = true;
-        openFirewall = true;
+        openFirewall = false;
+        settings = {
+          auth.method = "External";
+          server.port = 7887;
+        };
       };
     };
   };
@@ -33,7 +35,7 @@ in
   ];
 
   services.recyclarr.configuration.radarr.radarrAnime = {
-    base_url = "http://10.0.4.2:7887";
+    base_url = "http://localhost:7887";
     api_key._secret = "/run/credentials/recyclarr.service/radarrAnimeApiKey";
     delete_old_custom_formats = true;
     replace_existing_custom_formats = true;
diff --git a/hosts/tsumugi/arr/radarrMain.nix b/hosts/tsumugi/arr/radarrMain.nix
index e6bf282..29e1bbf 100644
--- a/hosts/tsumugi/arr/radarrMain.nix
+++ b/hosts/tsumugi/arr/radarrMain.nix
@@ -15,6 +15,7 @@ in
   services.radarr = {
     enable = true;
     openFirewall = false; # 7878
+    settings.auth.method = "External";
   };
 
   sops.secrets."tsumugi/radarrMainApiKey" = { };
diff --git a/hosts/tsumugi/arr/sonarrAnime.nix b/hosts/tsumugi/arr/sonarrAnime.nix
index ea1ba11..162ed04 100644
--- a/hosts/tsumugi/arr/sonarrAnime.nix
+++ b/hosts/tsumugi/arr/sonarrAnime.nix
@@ -12,16 +12,15 @@ let
   inherit ((import ./mkPortRemap.nix) { inherit config lib; }) portRemap;
 in
 {
-  networking.firewall.allowedTCPPorts = [ 8998 ];
-
-  containers.sonarrAnime = portRemap {
-    id = 1;
-    containerPort = 8989;
-    hostPort = 8998;
+  containers.sonarrAnime = {
+    autoStart = true;
+    bindMounts."/mnt/media".isReadOnly = false;
     config = {
+      system.stateVersion = "24.05";
       services.sonarr = {
         enable = true;
-        openFirewall = true;
+        openFirewall = false;
+        settings.server.port = 8998;
       };
     };
   };
@@ -33,7 +32,7 @@ in
   ];
 
   services.recyclarr.configuration.sonarr.sonarrAnime = {
-    base_url = "http://10.0.4.2:8998";
+    base_url = "http://localhost:8998";
     api_key._secret = "/run/credentials/recyclarr.service/sonarrAnimeApiKey";
     delete_old_custom_formats = true;
     replace_existing_custom_formats = true;
diff --git a/hosts/tsumugi/transmission.nix b/hosts/tsumugi/transmission.nix
index 85928a4..7d75bc4 100644
--- a/hosts/tsumugi/transmission.nix
+++ b/hosts/tsumugi/transmission.nix
@@ -6,7 +6,8 @@
   ...
 }:
 let
-  inherit ((import ./arr/mkPortRemap.nix) { inherit config lib; }) portRemap;
+  inherit (config.sidonia.lib) configContainerCredential;
+  mbits = x: ((x * 1024) / 8);
 in
 {
   sops.secrets."tsumugi/transmission" = {
@@ -16,104 +17,80 @@ in
   #   restartUnits = [ "container@transmission.service" ];
   # };
 
-  containers.transmission =
-    let
-      id = 100;
-      containerPort = 9092;
-      hostPort = 9092;
-      localAddress = "192.168.${toString id}.10/16";
-      inherit (config.sidonia.lib) configContainerCredential;
-    in
-    lib.mkMerge [
-      (portRemap { inherit id containerPort hostPort; })
-      {
-        # forwardPorts =
-        #   map
-        #     (protocol: {
-        #       containerPort = 51413;
-        #       hostPort = 51413;
-        #       inherit protocol;
-        #     })
-        #     [
-        #       "udp"
-        #       "tcp"
-        #     ];
-        config = {
-          # networking.firewall.allowedTCPPorts = [ 51413 ];
-          # networking.firewall.allowedUDPPorts = [ 51413 ];
-          systemd.services.transmission = {
-            serviceConfig = {
-              # https://github.com/NixOS/nixpkgs/issues/258793
-              RootDirectoryStartOnly = lib.mkForce null;
-              RootDirectory = lib.mkForce null;
-            };
+  containers.transmission = lib.mkMerge [
+    {
+      autoStart = true;
+      bindMounts."/mnt/media".isReadOnly = false;
+      config = {
+        system.stateVersion = "24.05";
+        systemd.services.transmission = {
+          serviceConfig = {
+            # https://github.com/NixOS/nixpkgs/issues/258793
+            RootDirectoryStartOnly = lib.mkForce null;
+            RootDirectory = lib.mkForce null;
           };
-          services.transmission = {
-            enable = true;
-            package = pkgs.transmission_4;
-            openRPCPort = true;
-            openPeerPorts = true;
-            settings =
-              let
-                speed-limit-enabled = true; # speed limit is in KB/s
-                mbits = x: ((x * 1000) / 8);
-              in
-              {
-                # https://github.com/transmission/transmission/blob/main/docs/Editing-Configuration-Files.md
-                speed-limit-up = mbits 10;
-                speed-limit-down = mbits 60;
-                speed-limit-up-enabled = speed-limit-enabled;
-                speed-limit-down-enabled = speed-limit-enabled;
-                download-queue-enabled = false;
-                incomplete-dir-enabled = false;
-                incomplete-dir = "/mnt/media/data/torrents/.incomplete";
-                preallocation = 0;
-                trash-can-enabled = false;
-                cache-size-mb = 8192; # avoid accessing the disk too much
-                rpc-whitelist-enabled = true;
-                rpc-host-whitelist-enabled = false;
-                rpc-authentication-required = true;
-                anti-brute-force-enabled = true;
-                rpc-whitelist = lib.concatStringsSep "," [
-                  "100.109.*.*"
-                  "10.0.4.*"
-                  "192.168.*.*"
-                ];
-                rpc-bind-address = localAddress;
-                rpc-port = 9092;
-                download-dir = "/mnt/media/data/torrents";
-              };
+        };
+        services.transmission = {
+          enable = true;
+          package = pkgs.transmission_4;
+          openRPCPort = true;
+          openPeerPorts = true;
+          settings = {
+            # https://github.com/transmission/transmission/blob/main/docs/Editing-Configuration-Files.md
+            speed-limit-up = mbits 10;
+            speed-limit-down = mbits 60;
+            speed-limit-up-enabled = true;
+            speed-limit-down-enabled = true;
+            download-queue-enabled = false;
+            incomplete-dir-enabled = false;
+            incomplete-dir = "/mnt/media/data/torrents/.incomplete";
+            preallocation = 0;
+            trash-can-enabled = false;
+            cache-size-mb = 8192; # avoid accessing the disk too much
+            rpc-whitelist-enabled = true;
+            rpc-host-whitelist-enabled = false;
+            rpc-authentication-required = true;
+            anti-brute-force-enabled = true;
+            rpc-whitelist = lib.concatStringsSep "," [
+              "100.109.*.*"
+              "10.0.4.*"
+            ];
+            rpc-bind-address = "localhost";
+            rpc-port = 9092;
+            peer-port = 51413;
+            download-dir = "/mnt/media/data/torrents";
           };
         };
-      }
-      (configContainerCredential (cred: {
-        services.transmission.credentialsFile = cred;
-      }) "transmission" config.sops.secrets."tsumugi/transmission".path)
+      };
+    }
+    (configContainerCredential (cred: {
+      services.transmission.credentialsFile = cred;
+    }) "transmission" config.sops.secrets."tsumugi/transmission".path)
 
-      # (configContainerCredential (cred: {
-      #   networking.wg-quick.interfaces.wg0.privateKeyFile = cred;
-      # }) "wg-quick-wg0" config.sops.secrets."tsumugi/transmissionwgpk".path)
-      # {
-      #   config = {
-      #     systemd.services.transmission.after = [ "wg-quick-wg0.service" ];
-      #     networking.wg-quick.interfaces.wg0 = {
-      #       address = [ "10.2.0.2/32" ];
-      #       dns = [ "10.2.0.1" ];
-      #       postUp = lib.concatLines (map (subnet: "ip -4 route add ${subnet} via ${hostAddress}") hostRoutes);
-      #       preDown = lib.concatLines (map (subnet: "ip -4 route delete ${subnet}") hostRoutes);
-      #       peers = [
-      #         {
-      #           publicKey = "D8Sqlj3TYwwnTkycV08HAlxcXXS3Ura4oamz8rB5ImM=";
-      #           allowedIPs = [
-      #             "0.0.0.0/0"
-      #             "::/0"
-      #           ];
-      #           endpoint = "103.69.224.4:51820";
-      #           persistentKeepalive = 25;
-      #         }
-      #       ];
-      #     };
-      #   };
-      # }
-    ];
+    # (configContainerCredential (cred: {
+    #   networking.wg-quick.interfaces.wg0.privateKeyFile = cred;
+    # }) "wg-quick-wg0" config.sops.secrets."tsumugi/transmissionwgpk".path)
+    # {
+    #   config = {
+    #     systemd.services.transmission.after = [ "wg-quick-wg0.service" ];
+    #     networking.wg-quick.interfaces.wg0 = {
+    #       address = [ "10.2.0.2/32" ];
+    #       dns = [ "10.2.0.1" ];
+    #       postUp = lib.concatLines (map (subnet: "ip -4 route add ${subnet} via ${hostAddress}") hostRoutes);
+    #       preDown = lib.concatLines (map (subnet: "ip -4 route delete ${subnet}") hostRoutes);
+    #       peers = [
+    #         {
+    #           publicKey = "D8Sqlj3TYwwnTkycV08HAlxcXXS3Ura4oamz8rB5ImM=";
+    #           allowedIPs = [
+    #             "0.0.0.0/0"
+    #             "::/0"
+    #           ];
+    #           endpoint = "103.69.224.4:51820";
+    #           persistentKeepalive = 25;
+    #         }
+    #       ];
+    #     };
+    #   };
+    # }
+  ];
 }