{
  lib,
  config,
  pkgs,
  ...
}: let
  cfg = config.services.vm_jellyfin;
in {
  options.services.vm_jellyfin = {
    enable = lib.mkEnableOption "Enable minimal config";
  };
  config = lib.mkIf cfg.enable {
    age.secrets = {
      cs-lapi-key = {
        file = ../../secrets/jellyfin-lapi-key.age;
        owner = "crowdsec";
      };
    };
    systemd.services.jellyfin.environment.LIBVA_DRIVER_NAME = "iHD";
    environment = {
      sessionVariables = { LIBVA_DRIVER_NAME = "iHD"; };
      systemPackages = with pkgs; [
        cifs-utils
      ];
    };
    # Intel Hardware Acceleration config
    hardware = {
      enableAllFirmware = true;
      intel-gpu-tools.enable = true;
      graphics = {
        enable = true;
        extraPackages = with pkgs; [
          intel-media-driver
          vaapiVdpau
          intel-compute-runtime # OpenCL filter support (hardware tonemapping and subtitle burn-in)
          intel-ocl
          vpl-gpu-rt # QSV on 11th gen or newer
        ];
        extraPackages32 = with pkgs.pkgsi686Linux; [
          intel-media-driver
        ];
      };
    };
    services = {
      crowdsec = {
        hub.collections = [
          "LePresidente/jellyfin"
        ];
        settings.lapi.credentialsFile = "${config.age.secrets.jellyfin-lapi-key.path}";
        localConfig = {
          acquisitions = [
            {
              source = "journalctl";
              journalctl_filter = [ "_SYSTEMD_UNIT=jellyfin.service" ];
              labels = {
                type = "syslog";
              };
            }
          ];
        };
      };
      jellyfin= {
        enable = true;
        user = "tbarnouin";
        openFirewall = true;
      };
    };
    fileSystems."/mnt/media" = {
      device = "192.168.1.125:/BIGDATA";
      fsType = "nfs";
      options = [
        "x-systemd.automount"
        "noauto"
      ];
    };
  };
}