{ config, lib, pkgs, ...}:

{
  users.groups.media = {};

  #
  # Downloading movies
  services.radarr = {
    enable = true;
    openFirewall = false;
    dataDir = "/media/apps/radarr";
    group = "media";
  };

  services.caddy.virtualHosts."radarr.${config.homelab.domain}" = {
    useACMEHost = config.homelab.domain;
    extraConfig = ''
      # For tinyauth
      reverse_proxy http://localhost:7878 {
        header_up -X-Forwarded-For
      }
      import block_non_private_ips
      import tinyauth_forwarder *
    '';
  };

  #
  # Downloading shows
  services.sonarr = {
    enable = true;
    openFirewall = false;
    dataDir = "/media/apps/sonarr";
    group = "media";
  };

  services.caddy.virtualHosts."sonarr.${config.homelab.domain}" = {
    useACMEHost = config.homelab.domain;
    extraConfig = ''
      reverse_proxy http://localhost:8989 {
        header_up -X-Forwarded-For
      }
      import block_non_private_ips
      import tinyauth_forwarder *
    '';
  };

  #
  # Managing Torrent sources
  services.prowlarr = {
    enable = true;
    openFirewall = false;
    dataDir = "/media/apps/prowlarr";
  };

  services.caddy.virtualHosts."prowlarr.${config.homelab.domain}" = {
    useACMEHost = config.homelab.domain;
    extraConfig = ''
      reverse_proxy http://localhost:9696 {
        header_up -X-Forwarded-For
      }
      import tinyauth_forwarder *
      import block_non_private_ips
    '';
  };

  #
  # Downloading torrents
  services.deluge = {
    enable = true;
    dataDir = "/media/apps/deluge";
    web.enable = true;
    web.openFirewall = false;
    group = "media";
  };

  services.caddy.virtualHosts."deluge.${config.homelab.domain}" = {
    useACMEHost = config.homelab.domain;
    extraConfig = ''
      reverse_proxy http://localhost:8112 {
        header_up -X-Forwarded-For
      }
      import tinyauth_forwarder *
      import block_non_private_ips
    '';
  };

  # setup network samba share
  services.samba.settings = {
    "media" = {
      "path" = "/media/media";
      "valid users" = "@users";
      "force user" = "nobody";
      "public" = "no";
      "read only" = "yes";
    };
  };
}