{ pkgs, ... }:
let
  acmeDomain = "thegeneralist01.com";
  domain = "internal.${acmeDomain}";

  ssl = {
    forceSSL = true;
    quic = true;
    useACMEHost = domain;
  };
in
{
  environment.systemPackages = with pkgs; [
    jellyfin
    jellyfin-web
    jellyfin-ffmpeg
  ];

  services.jellyfin = {
    enable = true;
    package = pkgs.jellyfin;
    group = "jellyfin";
    user = "jellyfin";

    cacheDir  = "/mnt/usb/services/jellyfin/cache";
    dataDir   = "/mnt/usb/services/jellyfin/data/data";
    configDir = "/mnt/usb/services/jellyfin/data/config";
    logDir    = "/mnt/usb/services/jellyfin/data/log";
  };

  systemd.services.jellyfin = {
    requires = [ "jellyfin-data-ownership.service" ];
    after = [ "jellyfin-data-ownership.service" ];
  };

  systemd.services.jellyfin-data-ownership = {
    description = "Prepare persisted Jellyfin state";
    unitConfig.RequiresMountsFor = [ "/mnt/usb/services/jellyfin" ];
    before = [ "jellyfin.service" ];
    serviceConfig.Type = "oneshot";
    script = ''
      marker=/mnt/usb/services/jellyfin/.nixos-ownership-v1
      if [ ! -e "$marker" ]; then
        ${pkgs.coreutils}/bin/chown -R jellyfin:jellyfin /mnt/usb/services/jellyfin
        ${pkgs.coreutils}/bin/touch "$marker"
        ${pkgs.coreutils}/bin/chown jellyfin:jellyfin "$marker"
      fi
    '';
  };

  services.nginx.virtualHosts.${domain} = ssl // {
    listen = [
      {
        addr = "100.108.125.63";
        port = 443;
        ssl = true;
      }
      {
        addr = "100.108.125.63";
        port = 80;
      }
    ];

    locations."/" = {
      proxyPass = "http://127.0.0.1:8096";
      recommendedProxySettings = true;
      extraConfig = ''
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

        # tell nginx not to buffer the response. send it as it comes.
        proxy_buffering off;

        # give jellyfin plenty of time to transcode
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
      '';
    };
  };
}