# Quadlet network: private bridge for the open-notebook pair (rootless).
#
# Install path on dankclaw: ~/.config/containers/systemd/open-notebook.network
# Unit name: open-notebook-network.service (podman network name:
# systemd-open-notebook — quadlet prefixes "systemd-", so probe the runtime
# name, never the filename; see [[Container Network Namespaces]]).
#
# WHY A PRIVATE BRIDGE. The app reaches its database by container name
# (SURREAL_URL=ws://open-notebook-surrealdb:8000/rpc), and container DNS names
# resolve only on the network that owns them. Putting SurrealDB here instead of
# on dankclaw_default keeps the datastore reachable ONLY to the container that
# owns it: 8000 is not published (an unpublished port is refused outright from
# every other namespace anyway), and nothing else on the fleet-wide network can
# dial it with the root credentials. Same reasoning as the gitea and authentik
# database pairs.
#
# Kernel bridge, not slirp4netns: the 2026-08-22 open-webui incident (a dead
# per-container userspace helper left a container that accepted TCP and reset
# every request for two days, logging nothing). A bridge has no such helper.
#
# Subnet registry on dankclaw (rootless):
#   10.88.0.0/16  default "podman" bridge
#   10.89.0.0/24  gitea (systemd-gitea)
#   10.89.1.0/24  compose stack (dankclaw_default)
#   10.89.2.0/24  searxng (systemd-searxng)
#   10.89.3.0/24  open-webui (systemd-open-webui)
#   10.89.4.0/24  open-notebook (systemd-open-notebook)  <- this file
# Pinned so the container IPs stay deterministic across reboots, like the
# other pinned nets; 10.89.4.0/24 was the next unclaimed /24 in this registry.

[Network]
Driver=bridge
Subnet=10.89.4.0/24
Gateway=10.89.4.1