From 3a7a4fb4501fffe6a7f55caadb2fd191c5045fbc Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Sat, 20 Sep 2025 14:07:36 +0800
Subject: [PATCH] nixos/podman: don't open ports for firewalld

---
 nixos/modules/virtualisation/podman/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/virtualisation/podman/default.nix b/nixos/modules/virtualisation/podman/default.nix
index 8145c099eead..5f01142b4a13 100644
--- a/nixos/modules/virtualisation/podman/default.nix
+++ b/nixos/modules/virtualisation/podman/default.nix
@@ -249,7 +249,9 @@ in
       };
 
       # containers cannot reach aardvark-dns otherwise
-      networking.firewall.interfaces.${network_interface}.allowedUDPPorts = lib.mkIf dns_enabled [ 53 ];
+      networking.firewall = lib.mkIf (config.networking.firewall.backend != "firewalld") {
+        interfaces.${network_interface}.allowedUDPPorts = lib.mkIf dns_enabled [ 53 ];
+      };
 
       virtualisation.containers = {
         enable = true; # Enable common /etc/containers configuration