{ config, ... }:

# Cinephage — indexer search + streaming/library manager. Runs the official
# container image, not upstream's nix flake module: its npmDepsHash is stale
# against its own package-lock.json, and a transitive dep hard-enforces pnpm,
# breaking the nix-sandboxed npm build regardless. Docker is the actually-
# maintained path. BETTER_AUTH_SECRET (paired sops secret in
# hosts/jupiter/secrets.nix) signs sessions/encrypts stored API keys — must
# be static, not app-generated, or losing it invalidates everything.
{
  virtualisation.oci-containers.containers.cinephage = {
    image = "ghcr.io/moldytaint/cinephage:latest";
    autoStart = true;
    # Host networking, not a published port: cinephage needs to reach
    # Prowlarr/SABnzbd on jupiter's own localhost (they're native systemd
    # services, not containers) — bridge-mode "localhost" would be the
    # container's own netns, not the host's.
    extraOptions = [ "--network=host" ];
    volumes = [
      "/mnt/data/AppData/cinephage:/config"
      "/mnt/data/HighSeas:/media"
      "/mnt/data/HighSeas/Downloads:/downloads"
    ];
    environment = {
      PUID = "1000";
      PGID = "100";   # darman:users — matches HighSeas' real on-disk ownership
      TZ = "Europe/Berlin";
      ORIGIN = "http://cinephage.jupiter.sol";
    };
    environmentFiles = [ config.sops.templates."cinephage.env".path ];
  };

  sops.templates."cinephage.env".content =
    "BETTER_AUTH_SECRET=${config.sops.placeholder.cinephage_better_auth_secret}";

  systemd.tmpfiles.rules = [
    "d /mnt/data/AppData/cinephage 0755 darman users -"
  ];
}