{
  config,
  pkgs,
  lib,
  ...
}: let
  cfg = config.services.vm_nixarr;
in {
  options.services.vm_nixarr = {
    enable = lib.mkEnableOption "Enable minimal config";
  };
  config = lib.mkIf cfg.enable {
    age.secrets = {
      nixarr-lapi-key = {
        file = ../../secrets/nixarr-lapi-key.age;
        owner = "crowdsec";
      };
    };
    services = {
      crowdsec = {
        hub.collections = [
          "LePresidente/gitea"
        ];
        settings.lapi.credentialsFile = "${config.age.secrets.nixarr-lapi-key.path}";
        localConfig = {
          acquisitions = [
            {
              source = "journalctl";
              journalctl_filter = [ "_SYSTEMD_UNIT=radarr.service" ];
              labels = {
                type = "syslog";
              };
            }
          ];
        };
      };
      prowlarr = {
        enable = true;
        openFirewall = true;
      };
      bazarr = {
        enable = true;
        openFirewall = true;
      };
      sonarr = {
        enable = true;
        openFirewall = true;
      };
      radarr = {
        enable = true;
        openFirewall = true;
      };
      jellyseerr = {
        enable = true;
        openFirewall = true;
      };
    };
    networking.firewall.allowedTCPPorts = [3000];
  };
}