From e786144ac747fa6e9c0bbeedf20914ef206d5098 Mon Sep 17 00:00:00 2001
From: Quinn Unger <quinn.unger@pm.me>
Date: Sun, 16 Aug 2026 21:25:59 +0100
Subject: [PATCH] tsumugi/containers: use bridge interface

---
 hosts/tsumugi/arr/default.nix     | 21 +++++++++++++++-
 hosts/tsumugi/arr/mkPortRemap.nix |  9 +++----
 hosts/tsumugi/arr/radarrMain.nix  |  2 +-
 hosts/tsumugi/arr/sonarrMain.nix  |  2 +-
 hosts/tsumugi/transmission.nix    | 41 ++++++++++++-------------------
 5 files changed, 42 insertions(+), 33 deletions(-)

diff --git a/hosts/tsumugi/arr/default.nix b/hosts/tsumugi/arr/default.nix
index 0c9f96d..d1c35ee 100644
--- a/hosts/tsumugi/arr/default.nix
+++ b/hosts/tsumugi/arr/default.nix
@@ -80,10 +80,29 @@
       {
         enable = true;
         enableIPv6 = true;
-        internalInterfaces = [ ("ve-" + wildcard) ];
+        # internalInterfaces = [ ("ve-" + wildcard) ];
+        internalInterfaces = [ "br0" ];
         externalInterface = "enp6s0";
       };
     #networkmanager.unmanaged = [ "interface-name:ve-*" ];
   };
+  systemd.network = {
+    enable = true;
+    wait-online.enable = false;
+    netdevs = {
+      "20-br0" = {
+        netdevConfig = {
+          Kind = "bridge";
+          Name = "br0";
+        };
+      };
+    };
+    networks = {
+      "40-br0" = {
+        matchConfig.Name = "br0";
+        address = [ "192.168.0.1/16" ];
+      };
+    };
+  };
 
 }
diff --git a/hosts/tsumugi/arr/mkPortRemap.nix b/hosts/tsumugi/arr/mkPortRemap.nix
index 894b70b..dfebe84 100644
--- a/hosts/tsumugi/arr/mkPortRemap.nix
+++ b/hosts/tsumugi/arr/mkPortRemap.nix
@@ -17,10 +17,8 @@ in
     {
       autoStart = true;
       privateNetwork = true;
-      hostAddress = "192.168.${toString id}.10";
-      localAddress = "192.168.${toString id}.11";
-      hostAddress6 = "fc00::${toString id}:10";
-      localAddress6 = "fc00::${toString id}:11";
+      hostBridge = "br0";
+      localAddress = "192.168.${toString id}.10/16";
       forwardPorts = [
         {
           containerPort = containerPort;
@@ -39,11 +37,12 @@ in
           networking = {
             firewall.enable = true;
             useHostResolvConf = lib.mkForce false;
+            defaultGateway.address = "192.168.0.1";
             nameservers = [
               "10.0.4.1"
-              "2001:bb6:9540:502::1"
             ];
           };
+          services.resolved.enable = true;
         }
         config
       ];
diff --git a/hosts/tsumugi/arr/radarrMain.nix b/hosts/tsumugi/arr/radarrMain.nix
index 682d54f..e6bf282 100644
--- a/hosts/tsumugi/arr/radarrMain.nix
+++ b/hosts/tsumugi/arr/radarrMain.nix
@@ -14,7 +14,7 @@ in
 
   services.radarr = {
     enable = true;
-    openFirewall = true; # 7878
+    openFirewall = false; # 7878
   };
 
   sops.secrets."tsumugi/radarrMainApiKey" = { };
diff --git a/hosts/tsumugi/arr/sonarrMain.nix b/hosts/tsumugi/arr/sonarrMain.nix
index 581dd46..6c82303 100644
--- a/hosts/tsumugi/arr/sonarrMain.nix
+++ b/hosts/tsumugi/arr/sonarrMain.nix
@@ -14,7 +14,7 @@ in
 
   services.sonarr = {
     enable = true;
-    openFirewall = true; # 8989
+    openFirewall = false; # 8989
   };
 
   sops.secrets."tsumugi/sonarrMainApiKey" = { };
diff --git a/hosts/tsumugi/transmission.nix b/hosts/tsumugi/transmission.nix
index 035201b..85928a4 100644
--- a/hosts/tsumugi/transmission.nix
+++ b/hosts/tsumugi/transmission.nix
@@ -16,40 +16,31 @@ in
   #   restartUnits = [ "container@transmission.service" ];
   # };
 
-  networking.firewall.allowedTCPPorts = [ 51413 ];
-  networking.firewall.allowedUDPPorts = [ 51413 ];
-
   containers.transmission =
     let
       id = 100;
-      containerPort = 9091;
+      containerPort = 9092;
       hostPort = 9092;
-      hostAddress = "192.168.${toString id}.10";
-      localAddress = "192.168.${toString id}.11";
-      hostRoutes = [
-        "100.109.0.0/16" # netbird
-        "10.0.4.0/24" # home subnet
-        "192.168.0.0/16" # container subnet
-      ];
+      localAddress = "192.168.${toString id}.10/16";
       inherit (config.sidonia.lib) configContainerCredential;
     in
     lib.mkMerge [
       (portRemap { inherit id containerPort hostPort; })
       {
-        forwardPorts =
-          map
-            (protocol: {
-              containerPort = 51413;
-              hostPort = 51413;
-              inherit protocol;
-            })
-            [
-              "udp"
-              "tcp"
-            ];
+        # forwardPorts =
+        #   map
+        #     (protocol: {
+        #       containerPort = 51413;
+        #       hostPort = 51413;
+        #       inherit protocol;
+        #     })
+        #     [
+        #       "udp"
+        #       "tcp"
+        #     ];
         config = {
-          networking.firewall.allowedTCPPorts = [ 51413 ];
-          networking.firewall.allowedUDPPorts = [ 51413 ];
+          # networking.firewall.allowedTCPPorts = [ 51413 ];
+          # networking.firewall.allowedUDPPorts = [ 51413 ];
           systemd.services.transmission = {
             serviceConfig = {
               # https://github.com/NixOS/nixpkgs/issues/258793
@@ -89,7 +80,7 @@ in
                   "192.168.*.*"
                 ];
                 rpc-bind-address = localAddress;
-                rpc-port = containerPort;
+                rpc-port = 9092;
                 download-dir = "/mnt/media/data/torrents";
               };
           };
-- 
2.54.0