{ config, ... }:

# Cinephage — indexer search + streaming/library manager. Runs the official
# container image, not upstream's nix flake module: their flake's
# npmDepsHash is stale against their own package-lock.json (fixed-output
# hash mismatch), and past that, a transitive dep's postinstall hard-enforces
# pnpm (`only-allow pnpm`), which fails under nix's network-sandboxed npm
# build regardless. Docker is their actually-maintained deployment path.
# Paired sops secret in hosts/jupiter/secrets.nix — BETTER_AUTH_SECRET signs
# sessions/encrypts stored API keys; losing it invalidates all sessions and
# makes saved keys unrecoverable, so it must be static, not app-generated.
{
  virtualisation.oci-containers.containers.cinephage = {
    image = "ghcr.io/moldytaint/cinephage:latest";
    autoStart = true;
    # Host networking, not a published port: cinephage needs to reach
    # Prowlarr/SABnzbd on jupiter's own localhost (they're native systemd
    # services, not containers) — bridge-mode "localhost" would be the
    # container's own netns, not the host's.
    extraOptions = [ "--network=host" ];
    volumes = [
      "/mnt/data/AppData/cinephage:/config"
      "/mnt/data/HighSeas:/media"
      "/mnt/data/HighSeas/Downloads:/downloads"
    ];
    environment = {
      PUID = "1000";
      PGID = "100";   # darman:users — matches HighSeas' real on-disk ownership
      TZ = "Europe/Berlin";
      ORIGIN = "http://cinephage.jupiter.sol";
    };
    environmentFiles = [ config.sops.templates."cinephage.env".path ];
  };

  sops.templates."cinephage.env".content =
    "BETTER_AUTH_SECRET=${config.sops.placeholder.cinephage_better_auth_secret}";

  systemd.tmpfiles.rules = [
    "d /mnt/data/AppData/cinephage 0755 darman users -"
  ];
}