{ config, lib, pkgs, ... }:

let cfg = config.sydnix.deertopia.slskd;
in {
  options = {
    sydnix.deertopia.slskd = {
      enable = lib.mkEnableOption "Soulseek";
    };
  };

  config = lib.mkIf cfg.enable {
    sydnix.sops.secrets.slskd-credentials = {};

    services.slskd = {
      enable = true;

      openFirewall = true;
      domain = null;
      environmentFile = "/run/secrets/slskd-credentials";

      settings = {
        shares.directories = [
          "/persist/vault/jellyfin/Music"
          "/persist/vault/jellyfin/Shows"
        ];
        # directories.downloads = "/persist/vault/jellyfin/Music";
      };
    };

    networking.firewall.allowedTCPPorts = [
      config.services.slskd.settings.web.port
    ];

    # HACK: Consult with Molly on idiomatic Unix permissions.
    users.users.${config.services.slskd.user}.extraGroups = [ "jellyfin" ];

    sydnix.deertopia.nginx.vhosts."slsk".vhost = {
      forceSSL = true;
      enableACME = true;
      locations."/" = {
        proxyWebsockets = true;
        proxyPass =
          let port = builtins.toString config.services.slskd.settings.web.port;
          in "http://localhost:${port}";
      };
    };
  };
}