nixos/jackflix: Improve firewall

nixos/boxes/colony/vms/shill/containers/jackflix/default.nix

@@ -17,85 +17,65 @@
 
     configuration = { lib, pkgs, config, ... }:
     let
-      inherit (lib) mkMerge mkIf;
+      inherit (lib);
     in
     {
       imports = [ ./networking.nix ];
 
-      config = mkMerge [
-        {
-          my = {
-            deploy.enable = false;
-            server.enable = true;
+      config = {
+        my = {
+          deploy.enable = false;
+          server.enable = true;
 
-            secrets = {
-              key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKzzAqa4821NlYfALYOlvR7YlOgxNuulTWo9Vm5L1mNU";
-            };
+          secrets = {
+            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKzzAqa4821NlYfALYOlvR7YlOgxNuulTWo9Vm5L1mNU";
           };
+        };
 
+        users = {
+          groups.media.gid = 2000;
           users = {
-            groups.media.gid = 2000;
-            users = {
-              transmission.extraGroups = [ "media" ];
-              radarr.extraGroups = [ "media" ];
-            };
-          };
-
-          systemd = {
-            services = {
-              jackett.bindsTo = [ "systemd-networkd-wait-online@vpn.service" ];
-              transmission.bindsTo = [ "systemd-networkd-wait-online@vpn.service" ];
-
-              radarr.serviceConfig.UMask = "0002";
-            };
+            transmission.extraGroups = [ "media" ];
+            radarr.extraGroups = [ "media" ];
           };
+        };
 
+        systemd = {
           services = {
-            transmission = {
-              enable = true;
-              openPeerPorts = true;
-              openRPCPort = true;
-              downloadDirPermissions = null;
-              performanceNetParameters = true;
-              settings = {
-                download-dir = "/mnt/media/downloads/torrents";
-                incomplete-dir-enabled = true;
-                incomplete-dir = "/mnt/media/downloads/torrents/.incomplete";
-                umask = 002;
+            jackett.bindsTo = [ "systemd-networkd-wait-online@vpn.service" ];
+            transmission.bindsTo = [ "systemd-networkd-wait-online@vpn.service" ];
 
-                peer-port = 55471;
-                utp-enabled = true;
-                port-forwarding-enabled = false;
+            radarr.serviceConfig.UMask = "0002";
+          };
+        };
 
-                ratio-limit = 2.0;
-                ratio-limit-enabled = true;
+        services = {
+          transmission = {
+            enable = true;
+            downloadDirPermissions = null;
+            performanceNetParameters = true;
+            settings = {
+              download-dir = "/mnt/media/downloads/torrents";
+              incomplete-dir-enabled = true;
+              incomplete-dir = "/mnt/media/downloads/torrents/.incomplete";
+              umask = 002;
 
-                rpc-bind-address = "::";
-                rpc-whitelist-enabled = false;
-                rpc-host-whitelist-enabled = false;
-              };
-            };
+              utp-enabled = true;
+              port-forwarding-enabled = false;
 
-            jackett = {
-              enable = true;
-              openFirewall = true;
-            };
-            radarr = {
-              enable = true;
-              openFirewall = true;
+              ratio-limit = 2.0;
+              ratio-limit-enabled = true;
+
+              rpc-bind-address = "::";
+              rpc-whitelist-enabled = false;
+              rpc-host-whitelist-enabled = false;
             };
           };
-        }
-        (mkIf config.my.build.isDevVM {
-          virtualisation = {
-            forwardPorts = [
-              { from = "host"; host.port = 9117; guest.port = 9117; }
-              { from = "host"; host.port = 7878; guest.port = 7878; }
-              { from = "host"; host.port = 8989; guest.port = 8989; }
-            ];
-          };
-        })
-      ];
+
+          jackett.enable = true;
+          radarr.enable = true;
+        };
+      };
     };
   };
 }