{ pkgs, ... }:
let
  mediaGroup = "media";
in
{
  age.secrets.mullvad = {
    file = ../../../keys/mullvad;
    path = "/etc/wireguard/mullvad.conf";
  };

  networking.firewall.trustedInterfaces = [ "wg-selene" ];
  services.prowlarr.enable = true;

  services.transmission = {
    enable = true;
    user = "torrenter";
    group = mediaGroup;
    incomplete-dir-enabled = true;
    incomplete-dir = "${mediaDir}/torrents/.incomplete";
  };

  systemd.services.transmission.serviceConfig.IOSchedulingPriority = 7;

  services.radarr = {
    enable = true;
    group = mediaGroup;
    openFirewall = false;
  };

  environment.systemPackages = [
    pkgs.flood-for-transmission
  ];
}