{ ... }:

# SABnzbd — usenet downloader. Reuses the config migrated from the old
# ZimaOS docker stack (servers/API key/history already set up) by pointing
# straight at the real ini instead of generating a fresh NixOS-managed one.
# Runs as the module's default dedicated `sabnzbd` system user — after first
# deploy, chown the migrated config dir to it (see README/CLAUDE notes):
#   chown -R sabnzbd:sabnzbd /mnt/data/AppData/sabnzbd/config
{
  services.sabnzbd = {
    enable = true;
    configFile = "/mnt/data/AppData/sabnzbd/config/sabnzbd.ini";
    allowConfigWrite = true;   # real pre-existing state — let sabnzbd keep saving it
  };

  # Write access to the shared downloads dir (owned darman:users on disk).
  users.users.sabnzbd.extraGroups = [ "users" ];

  # SABnzbd hardcodes completed job folders to 0700 on every single job —
  # independent of the ini's `umask` setting (that only covers files
  # created during unpack, not the enclosing per-job dir). setgid on
  # Downloads keeps the *group* as "users", but group perm bits still come
  # back zeroed, locking out cinephage/mediamanager. Sweep it clean instead
  # of fighting SABnzbd's own behavior.
  systemd.services.fix-downloads-perms = {
    description = "Fix group perms SABnzbd resets on completed downloads";
    serviceConfig.Type = "oneshot";
    script = ''
      find /mnt/data/HighSeas/Downloads \
        ! -group users -exec chgrp users {} + 2>/dev/null || true
      find /mnt/data/HighSeas/Downloads -type d ! -perm -g+rwx \
        -exec chmod g+rwx {} + 2>/dev/null || true
      find /mnt/data/HighSeas/Downloads -type f ! -perm -g+rw \
        -exec chmod g+rw {} + 2>/dev/null || true
    '';
  };

  systemd.timers.fix-downloads-perms = {
    description = "Periodically fix group perms under HighSeas/Downloads";
    wantedBy = [ "timers.target" ];
    timerConfig = {
      OnBootSec = "1m";
      OnUnitActiveSec = "2m";
    };
  };
}