{ config, ... }:
{
  networking.firewall.interfaces.wg0.allowedTCPPorts = [ 7878 8989 ];

  # download series
  services.sonarr = {
    enable = true;
    group = "media";
    user = "media";
  };

  # download movies
  services.radarr = {
    enable = true;
    group = "media";
    user = "media";
  };

  # better indexer apis
  services.prowlarr = {
    enable = true;
    #group = "media";
    #user = "media";
  };

  services.jellyseerr = {
    enable = true;
  };

  services.permown."/media/arr" = {
    owner = "media";
    group = "media";
    directory-mode = "770";
    file-mode = "770";
  };

  services.nginx.virtualHosts = {
    "radarr.${config.networking.hostName}.private" = {
      serverAliases = [ "radarr.ingolf-wagner.de" ];
      extraConfig = ''
        allow ${config.tinc.private.subnet};
        allow ${config.wireguard.wg0.subnet};
        deny all;
      '';
      locations."/" = {
        proxyPass = "http://localhost:7878";
        proxyWebsockets = true;
      };
    };
    "sonarr.${config.networking.hostName}.private" = {
      serverAliases = [ "sonarr.ingolf-wagner.de" ];
      extraConfig = ''
        allow ${config.tinc.private.subnet};
        allow ${config.wireguard.wg0.subnet};
        deny all;
      '';
      locations."/" = {
        proxyPass = "http://localhost:8989";
        proxyWebsockets = true;
      };
    };
    "prowlarr.${config.networking.hostName}.private" = {
      extraConfig = ''
        allow ${config.tinc.private.subnet};
        deny all;
      '';
      locations."/" = {
        proxyPass = "http://localhost:9696";
        proxyWebsockets = true;
      };
    };
    "jellyseerr.${config.networking.hostName}.private" = {
      extraConfig = ''
        allow ${config.tinc.private.subnet};
        deny all;
      '';
      locations."/" = {
        proxyPass = "http://localhost:${toString config.services.jellyseerr.port}";
        proxyWebsockets = true;
      };
    };
  };

}