{
  config,
  pkgs,
  lib,
  ...
}: let
  cfg = config.services.vm_nixarr;
in {
  options.services.vm_nixarr = {
    enable = lib.mkEnableOption "Enable minimal config";
  };
  config = lib.mkIf cfg.enable {
    age.secrets = {
      nixarr-lapi-key = {
        file = ../../secrets/nixarr-lapi-key.age;
        owner = "crowdsec";
      };
      nixarr-radarr-apiKeyFile = {
        file = ../../secrets/nixarr-radarr-apiKeyFile.age;
        owner = "exportarr";
        group = "users";
      };
      nixarr-prowlarr-apiKeyFile = {
        file = ../../secrets/nixarr-prowlarr-apiKeyFile.age;
        owner = "exportarr";
        group = "users";
      };
      nixarr-bazarr-apiKeyFile = {
        file = ../../secrets/nixarr-bazarr-apiKeyFile.age;
        owner = "exportarr";
        group = "users";
      };
      nixarr-sonarr-apiKeyFile = {
        file = ../../secrets/nixarr-sonarr-apiKeyFile.age;
        owner = "exportarr";
        group = "users";
      };
    };
    users.users.exportarr = {
      isNormalUser = true;
      extraGroups = ["users"];
    };
    fileSystems."/downloads" = {
      device = "192.168.1.125:/BIGDATA";
      fsType = "nfs";
      options = [
        "x-systemd.automount"
        "noauto"
      ];
    };
    services = {
      crowdsec = {
        hub.collections = [
          "LePresidente/gitea"
        ];
        settings.lapi.credentialsFile = "${config.age.secrets.nixarr-lapi-key.path}";
        localConfig = {
          acquisitions = [
            {
              source = "journalctl";
              journalctl_filter = [ "_SYSTEMD_UNIT=radarr.service" ];
              labels = {
                type = "syslog";
              };
            }
          ];
        };
      };
      prowlarr = {
        enable = true;
        openFirewall = true;
      };
      bazarr = {
        enable = true;
        openFirewall = true;
      };
      sonarr = {
        enable = true;
        openFirewall = true;
      };
      radarr = {
        enable = true;
        openFirewall = true;
      };
      jellyseerr = {
        enable = true;
        openFirewall = true;
      };
      prometheus.exporters = {
        exportarr-prowlarr = {
          enable = true;
          apiKeyFile = "${config.age.secrets.nixarr-prowlarr-apiKeyFile.path}";
          openFirewall = true;
        };
        exportarr-bazarr = {
          enable = true;
          apiKeyFile = "${config.age.secrets.nixarr-bazarr-apiKeyFile.path}";
          openFirewall = true;
        };
        exportarr-sonarr = {
          enable = true;
          apiKeyFile = "${config.age.secrets.nixarr-sonarr-apiKeyFile.path}";
          openFirewall = true;
        };
        exportarr-radarr = {
          enable = true;
          apiKeyFile = "${config.age.secrets.nixarr-radarr-apiKeyFile.path}";
          openFirewall = true;
        };
      };
    };
    networking = {
      firewall.allowedTCPPorts = [3000 9708];
      extraHosts = ''
        188.114.96.2 www.yggtorrent.top
        188.114.97.2 www.yggtorrent.top
      '';
    };
  };
}