{ config, pkgs, ... }:

{
  age.secrets = {
    transmission-rpc-password = {
      file = ../../../secrets/transmission-rpc-password.age;
      mode = "0400";
    };
  };

  users.groups.mediamanagers = {
    gid = 646000020;
    members = [ "transmission" "lidarr" ];
  };
  services.lidarr.group = "mediamanagers";
  services.transmission = {
    enable = true;
    group = "mediamanagers";
    settings = {
      download-dir = "/srv/data/download";
      incomplete-dir = "/srv/data/download/.incomplete";
      incomplete-dir-enabled = false;

      # being a leech
      speed-limit-up = 20;
      ratio-limit = 0.01;
      idle-seeding-limit = 1;
      speed-limit-up-enabled = true;
      ratio-limit-enabled = true;
      idle-seeding-limit-enabled = true;

      utp-enabled = false;
      rpc-bind-address = "0.0.0.0";
      rpc-whitelist = "127.0.0.1,::1,10.100.0.1,10.100.0.*,10.100.1.*,10.100.3.*";
      rpc-authentication-required = true;
    };
    credentialsFile = config.age.secrets.transmission-rpc-password.path;
  };

  networking.firewall.interfaces.tungsten.allowedTCPPorts = [ 9091 ];
}