{ lib, ... }:

{
  services.jellyfin = {
    enable = true;
    dataDir = "/mnt/data/AppData/jellyfin";
    cacheDir = "/mnt/data/AppData/jellyfin/cache";
  };
  users.users.jellyfin.extraGroups = [ "users" ];

  # The upstream module hardcodes UMask=0077 — root cause of jellyfin writing
  # trickplay thumbnails into stray new show folders it invented itself,
  # owned jellyfin:jellyfin 700, invisible to every other service sharing
  # the library (cinephage, mediamanager, ...). New files/dirs it creates
  # from here on inherit group "users" (library roots are setgid, see the
  # one-time chmod g+s done by hand) and stay group-writable.
  systemd.services.jellyfin.serviceConfig.UMask = lib.mkForce "0002";
}