{
  lib,
  pkgs,
  config,
  ...
}: let
  jellyfinPort = 8096;
  dlanPort = 1900;
in {
  imports = [
    ./proxy.nix
    ./fail2ban.nix
    ./impermanence.nix
  ];

  options.services.jellyfin = {
    media_directory = lib.mkOption {
      type = lib.types.str;
      description = "directory jellyfin media will be hosted at";
      default = "/srv/jellyfin/media";
    };
  };

  config = lib.mkIf config.services.jellyfin.enable {
    environment.systemPackages = [
      pkgs.jellyfin
      pkgs.jellyfin-web
      pkgs.jellyfin-ffmpeg
    ];

    networking.firewall.allowedTCPPorts = [jellyfinPort dlanPort];

    systemd.tmpfiles.rules = [
      "d ${config.services.jellyfin.media_directory} 2770 jellyfin jellyfin_media"
      "A ${config.services.jellyfin.media_directory} -    -        -               - u:jellyfin:rwX,g:jellyfin_media:rwX,o::-"
    ];
  };
}