From ec35282fba7df6f56e46f36a3a811131e0d794c5 Mon Sep 17 00:00:00 2001
From: Quinn Unger <quinn.unger@pm.me>
Date: Tue, 1 Sep 2026 15:27:17 +0100
Subject: [PATCH] further configure shelfarr

---
 hosts/tsumugi/arr/shelfarr.nix | 7 +++++--
 hosts/tsumugi/transmission.nix | 7 ++++---
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/hosts/tsumugi/arr/shelfarr.nix b/hosts/tsumugi/arr/shelfarr.nix
index 8434883..9de3d52 100644
--- a/hosts/tsumugi/arr/shelfarr.nix
+++ b/hosts/tsumugi/arr/shelfarr.nix
@@ -23,6 +23,7 @@ in
       "d ${libationState}/control 0700 root root -"
     ];
   };
+  networking.firewall.trustedInterfaces = [ "podman0" ]; # allow access to host services
   virtualisation = {
     containers.enable = true;
     podman = {
@@ -42,6 +43,7 @@ in
             serviceName = "shelfarr";
             hostname = "shelfarr";
             image = "ghcr.io/pedro-revez-silva/shelfarr:${version}";
+            # networks = [ "host" ];
             environment = {
               SOLID_QUEUE_IN_PUMA = "1";
               SHELFARR_LIBATION_URL = "http://shelfarr-libation:8080";
@@ -57,8 +59,9 @@ in
               HTTP_PORT = "5056";
               # Optional: Set your own key instead of auto-generating
               # RAILS_MASTER_KEY=your-64-char-hex-key;
+              TRUST_NFS_UID_SQUASH = "true";
               SHELFARR_SETTING_OIDC_ENABLED = "true";
-              SHELFARR_SETTING_OIDC_AUTO_REDIRECT = "false";
+              SHELFARR_SETTING_OIDC_AUTO_REDIRECT = "true";
               SHELFARR_SETTING_OIDC_ISSUER = "https://auth.moppu.dev";
               SHELFARR_SETTING_OIDC_AUTO_CREATE_USERS = "true";
             };
@@ -72,6 +75,7 @@ in
               "/mnt/media/data/media/ebooks:/ebooks"
               # Download client completed folder (where downloads land before processing)
               "/mnt/media/data/appdata/shelfarr/downloads:/downloads"
+              "/mnt/media/data/torrents/shelfarr:/transmission"
               # Completed Audible backups from the optional Libation companion
               "${libationBooksPath}:${cfg.shelfarr.environment.SHELFARR_LIBATION_IMPORT_ROOT}:ro"
               # Read-only bridge credential generated by the companion
@@ -114,7 +118,6 @@ in
               # Narrow credential handoff: Shelfarr cannot see the private state volume
               "${libationState}/control:${tokenFolder}"
             ];
-            ports = [ "127.0.0.1:5057:8080" ];
           };
       };
     };
diff --git a/hosts/tsumugi/transmission.nix b/hosts/tsumugi/transmission.nix
index 7d75bc4..ba86759 100644
--- a/hosts/tsumugi/transmission.nix
+++ b/hosts/tsumugi/transmission.nix
@@ -46,14 +46,15 @@ in
             incomplete-dir = "/mnt/media/data/torrents/.incomplete";
             preallocation = 0;
             trash-can-enabled = false;
-            cache-size-mb = 8192; # avoid accessing the disk too much
+            cache-size-mb = 4096; # avoid accessing the disk too much
             rpc-whitelist-enabled = true;
             rpc-host-whitelist-enabled = false;
             rpc-authentication-required = true;
             anti-brute-force-enabled = true;
             rpc-whitelist = lib.concatStringsSep "," [
-              "100.109.*.*"
-              "10.0.4.*"
+              "10.88.*.*" # podman network
+              "100.109.*.*" # netbird network
+              "10.0.4.*" # LAN
             ];
             rpc-bind-address = "localhost";
             rpc-port = 9092;
-- 
2.51.2