{ config, ... }:

# MediaManager — media request/library manager (module from the
# `mediamanager-nix` flake input, not nixpkgs). The paired sops secret
# (hosts/jupiter/secrets.nix) is required — without it the module mints a
# random token_secret every restart, logging everyone out; port 8010 since
# audiobookshelf already holds 8000.
{
  services.media-manager = {
    enable = true;
    dataDir = "/mnt/data/AppData/mediamanager";
    host = "0.0.0.0";
    port = 8010;
    postgres.enable = true;
    environmentFile = config.sops.templates."mediamanager.env".path;
    settings = {
      misc = {
        frontend_url = "http://mediamanager.jupiter.sol";
        # Point straight at the existing library instead of the empty
        # dirs under dataDir — group "users" needs write access (see
        # the chmod note below); files stay darman-owned.
        movie_directory = "/mnt/data/HighSeas/Movies";
        tv_directory = "/mnt/data/HighSeas/Shows";
        image_directory = "/mnt/data/HighSeas/images";
        torrent_directory = "/mnt/data/HighSeas/Downloads";
      };
      auth.admin_emails = [ "mail@erik-s.dev" ];
      # API keys are secret -> env vars via the sops template below, not here
      # (settings.* is rendered to a world-readable file in /nix/store).
      torrents.sabnzbd = {
        enabled = true;
        host = "http://localhost";
        port = 8085;
      };
      indexers.prowlarr = {
        enabled = true;
        url = "http://localhost:9696";
      };
    };
  };

  sops.templates."mediamanager.env".content = ''
    MEDIAMANAGER_AUTH__TOKEN_SECRET=${config.sops.placeholder.mediamanager_token_secret}
    MEDIAMANAGER_TORRENTS__SABNZBD__API_KEY=${config.sops.placeholder.sabnzbd_api_key}
    MEDIAMANAGER_INDEXERS__PROWLARR__API_KEY=${config.sops.placeholder.prowlarr_api_key}
  '';

  # HighSeas/{Movies,Shows,images,Downloads} are darman:users 755 (no group
  # write bit); media-manager is in "users" (below), and the dirs were
  # chmod g+w by hand once since this is pre-existing data, not something
  # tmpfiles owns.
  users.users.media-manager.extraGroups = [ "users" ];
}