From ad9771d3392675fe99b263e1e3a63b66707327bb Mon Sep 17 00:00:00 2001
From: imxyy_soope_ <imxyy1soope1@gmail.com>
Date: Mon, 27 Jul 2026 22:21:37 +0800
Subject: [PATCH] server: podman: use nftables firewall driver

After `lpppsssy`, `networking.nat` now recreates table ip nat on each switch, evicting
netavark's published-port DNAT rules and breaking Caddy reverse proxies
to published container ports. Pin the nftables driver so rules live in
an isolated table inet netavark that NixOS never touches.
---
 hosts/imxyy-nix-server/docker.nix | 14 --------------
 hosts/imxyy-nix-server/podman.nix | 20 ++++++++++++++++++++
 2 files changed, 20 insertions(+), 14 deletions(-)
 delete mode 100644 hosts/imxyy-nix-server/docker.nix
 create mode 100644 hosts/imxyy-nix-server/podman.nix

diff --git a/hosts/imxyy-nix-server/docker.nix b/hosts/imxyy-nix-server/docker.nix
deleted file mode 100644
index 045d071..0000000
--- a/hosts/imxyy-nix-server/docker.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ lib, ... }:
-{
-  virtualisation.oci-containers.backend = lib.mkForce "podman";
-  virtualisation.podman = {
-    enable = true;
-    dockerCompat = true;
-    dockerSocket.enable = true;
-    defaultNetwork.settings.dns_enabled = true;
-  };
-  # avoid collision with dnsmasq
-  virtualisation.containers = {
-    containersConf.settings.network.dns_bind_port = 5353;
-  };
-}
diff --git a/hosts/imxyy-nix-server/podman.nix b/hosts/imxyy-nix-server/podman.nix
new file mode 100644
index 0000000..f0b6199
--- /dev/null
+++ b/hosts/imxyy-nix-server/podman.nix
@@ -0,0 +1,20 @@
+{ lib, ... }:
+{
+  virtualisation.oci-containers.backend = lib.mkForce "podman";
+  virtualisation.podman = {
+    enable = true;
+    dockerCompat = true;
+    dockerSocket.enable = true;
+    defaultNetwork.settings.dns_enabled = true;
+  };
+  virtualisation.containers = {
+    containersConf.settings.network = {
+      # avoid collision with dnsmasq
+      dns_bind_port = 5353;
+      # keep netavark rules in an isolated `table inet netavark` instead of the
+      # `table ip nat` that networking.nat recreates on each nixos-rebuild switch,
+      # which would otherwise evict podman's published-port DNAT rules.
+      firewall_driver = "nftables";
+    };
+  };
+}