{ pkgs, lib, config, ... }:
with lib;
let
  cfg = config.services.jellyfin;
  extraGroups = [
    "users"
    "audio"
    "video"
    "disk"
    "power"
    "plugdev"
  ] ++ lib.optionals config.hardware.raspberry-pi.enable [
    "i2c"
    "spi"
  ];
in
{
  imports = [
    (import ../../../../lib/genSslCert.nix {
      name = "jellyfin";
      inherit (cfg) dataDir user;
      domain = "pi0.odie.home.arpa";
      wantedBy = [ "jellyfin.service" ];
      Before = [ "jellyfin.service" ];
    })
  ];
  options = {
    services.jellyfin.domain = mkOption {
      type = types.str;
      default = "localhost";
    };
  };
  config = {
    services.jellyfin = {
      enable = true;
      openFirewall = true;
      dataDir = "/media/net/svartalbenheim/media_config/data/jellyfin";
      cacheDir = "/media/net/svartalbenheim/media_config/cache/jellyfin";
    };
    users.users.jellyfin = {
      inherit extraGroups;
    };
    networking.firewall = {
      allowedUDPPorts = [ 1900 ];
      allowedTCPPorts = [ 8920 ];
    };

    security.pki.certificates = [
      ''
        -----BEGIN CERTIFICATE-----
        MIIFGzCCAwOgAwIBAgIUNHajISouQmW1yBoODpk3Yd6tXs4wDQYJKoZIhvcNAQEL
        BQAwHTEbMBkGA1UEAwwScGkwLm9kaWUuaG9tZS5hcnBhMB4XDTI1MDExMDA3Mjg1
        NFoXDTI1MDIwOTA3Mjg1NFowHTEbMBkGA1UEAwwScGkwLm9kaWUuaG9tZS5hcnBh
        MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAzn4txPhKVq/mrHpyICkl
        yFw0gTPZ/wUdnvUu8r9IZu5UjNgygyHN1H5x5T+XSDxbGNjtNZLxLMlCIKPbVFhx
        JJLdDuAbeVZ/Et69az3RtLgJ93uyL6B8xD4N0GuPNwz0UhqCNcp+NlljmntFaONa
        rH0J4A9TnJfbVAcMlXs13v9WNP0qTrcAdLjmYp3Bhfp5Vugtf7J3z4xaLXX4MQzQ
        CNXixB1jDmiy3nespCQAIwHIiMqLXI8MP7UiMcKglH4UB2rf1wv67Bgl7DLo+KzZ
        fU/eD9EdssZ+4pYbRxf6WMKi8wSw+4QfxF9Flv9jDn+cqt1drgcr2GdvzsAPg0Ab
        HTCmgRJv7VyZr0p6o6pYLugXzEiOXEk2ClD+wJmCZQv6yHI47CnGgAxIG5FFVwvc
        94lk06nKLfURdeEXaG/36BDKpdZNI58StYwUFl65BXi07MimObCaJ18T8m6JpaSl
        u/GhKDH00ryoPxUwDjLNTqt2Fb/wYX+rKhLmjqkkba+FtBjlwr7WtlspFtsPTLvb
        mCiQWGN2VWeXk0mBEXMIgN6ECiFlBtc0wZGlALFao++GDME45o+swNr9HJMxKQpr
        QlOWRDxHean6Fl8SRCtGM5XmclNeCBuu/lAC9nBI0d10dipG2R+lltwQqu5aXuNP
        9M43J6ANP5C6vR/PopyTqC8CAwEAAaNTMFEwHQYDVR0OBBYEFND5BOssGEusttif
        GncLz2BlEqUMMB8GA1UdIwQYMBaAFND5BOssGEusttifGncLz2BlEqUMMA8GA1Ud
        EwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggIBAIRIDQ07MySPXOPyAYNxF1Mz
        2+MyM3N8YKIZy6I6bQ9xK8u6FIyBtfxVqd3c9sDa1aam2etmbpe32GT0oQilr3EQ
        eBh9MPCSLHtfIT2MCmUFx9y+ygCRsO1hMSnlQpVOKt4HbU+3Bg/iV8eBQlAsYuzK
        BWzvmMM95uhiB0l/7QRjse71tG1kOCc8b6/LpQms2kSmJ0x3JEF9FRscACdE11ek
        mdqTbY0SEw+LEGg7yECg9O8iG4nRTsAbyb78GuXOGeoeEPAgyAF7Iwn488lSyb4f
        zXvU66aSyP0kTWh7JgKK1iU7ecvUkhCFNtswb5CTuADlhA6ravkvaQk6fZAGRAx0
        uV8mhKwM3+xktIKEsNvSPCjNSSsj+dN3Vv74Sbu8oeOZ+jT1/jP5yorRIsahpqIM
        fGMYgdJ62A20MpDKdObdZsoPIN1KaKk6tuW2TjNO4HmcEDBpyIX7vi3Pkq4/+9VR
        4lfJt2xqsL7XAAJCIuY122SZGLn9m9K6E+4irzOjmdow3CPSYuvUBvTMh2DyxBWU
        zkVpmGkad4e+xpBelm1RV2jzWg0x7FAkr4DGCws3Pq6G0AhsOv4OpVmmvAxAlQOe
        4keAD5gL9bCYywH33Y2ccCB42BNwd6HmiDBsmli++szUoOlFUjQIKQ/6S2H+pw/S
        UHQ+hpji7ZS9AH4oeHIG
        -----END CERTIFICATE-----
      ''
    ];
  };
}