mediaserver: drop no-op firewall rules, close unused DR forwards

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

hosts/FredOS-Mediaserver.nix

@@ -43,8 +43,8 @@
       allowReboot = true;
     };
 
-    # Open firewall for SSH
+    # WAN exposure is controlled by nftables in services/router.nix +
-    networking.firewall.allowedTCPPorts = [ 22 11434 ];
+    # ports.toml (networking.firewall is disabled on this host).
     services.openssh = {
       enable = true;
       settings = {

ports.toml

@@ -45,22 +45,5 @@ name = "7DTD-coop voice/dynamic"
 ports = "26911-26912"
 protocol = "udp"
 
-[[forward]]
+# DR (Dungeon Runners) forwards removed — services/dr-server.nix is disabled.
-name = "DR auth"
+# Re-add 2110 tcp, 2603 both, 2604-2605 udp, 2606 tcp if it comes back.
-port = 2110
-protocol = "tcp"
-
-[[forward]]
-name = "DR game"
-port = 2603
-protocol = "both"
-
-[[forward]]
-name = "DR aux UDP"
-ports = "2604-2605"
-protocol = "udp"
-
-[[forward]]
-name = "DR queue"
-port = 2606
-protocol = "tcp"

services/adguard.nix

@@ -45,8 +45,7 @@
       };
     };
 
-    # LAN DNS — router blocks WAN:53 so this is effectively LAN-only
+    # LAN clients reach :53 via the nftables "LAN trusted" rule in router.nix;
-    networking.firewall.allowedTCPPorts = [ 53 ];
+    # WAN:53 is dropped there.
-    networking.firewall.allowedUDPPorts = [ 53 ];
   };
 }

services/bazarr.nix

@@ -6,7 +6,6 @@
     # Bazarr
     services.bazarr = {
       enable = true;
-      openFirewall = true;  # Opens port 7878
       dataDir = "/var/lib/bazarr";
       user = "bazarr";
       group = "media";

services/dr-server.nix

@@ -66,7 +66,7 @@ in
       };
     };
 
-    networking.firewall.allowedTCPPorts = [ 2110 2603 2604 2605 2606 ];
+    # WAN forwards for 2110/2603-2606 were removed from ports.toml when this
-    networking.firewall.allowedUDPPorts = [ 2110 2603 2604 2605 2606 ];
+    # service was disabled — re-add them there if this comes back.
   };
 }

services/game-servers.nix

@@ -187,8 +187,5 @@
       StartLimitIntervalSec = 300;
       StartLimitBurst = 5;
     };
-
-    networking.firewall.allowedTCPPorts = [ 26900 26910 ];
-    networking.firewall.allowedUDPPorts = [ 26900 26901 26902 26910 26911 26912 ];
   };
 }

services/homepage.nix

@@ -87,7 +87,6 @@ in
 
     services.homepage-dashboard = {
       enable = true;
-      openFirewall = true;
       listenPort = 8084;
 
       # Allow access from anywhere on the LAN

services/jellyfin.nix

@@ -5,7 +5,6 @@
       # Jellyfin
     	services.jellyfin = {
       		enable = true;
-			openFirewall = true;
     	};
 
     	# Ensure Jellyfin can write thumbnails/artwork to media directories

services/nginx.nix

@@ -135,7 +135,5 @@ in
         };
       };
     };
-
-    networking.firewall.allowedTCPPorts = [ 80 443 ];
   };
 }

services/prowlarr.nix

@@ -19,7 +19,6 @@
     # Prowlarr
     services.prowlarr = {
       enable = true;
-      openFirewall = true;
       dataDir = "/var/lib/prowlarr";
     };
   };

services/radarr.nix

@@ -6,7 +6,6 @@
     # Radarr
     services.radarr = {
       enable = true;
-      openFirewall = true;  # Opens port 7878
       dataDir = "/var/lib/radarr";
       user = "radarr";
       group = "media";

services/sonarr.nix

@@ -6,7 +6,6 @@
     # Sonarr
     services.sonarr = {
       enable = true;
-      openFirewall = true;
       dataDir = "/var/lib/sonarr";
       user = "sonarr";
       group = "media";