{ config, secrets, ... }:
{
  sops.secrets.autobrr = {
    sopsFile = "${secrets}/autobrr.yaml";
    key = "key";
    format = "yaml";
  };

  services.nginx = {
    virtualHosts."autobrr.donsz.nl" = {
      forceSSL = true;
      http2 = true;
      enableACME = true;

      locations."/" = {
        proxyPass = "http://${config.services.autobrr.settings.host}:${toString config.services.autobrr.settings.port}";
      };
    };
  };

  # oauth access to the service
  services.oauth2-proxy.nginx.virtualHosts."autobrr.donsz.nl" = {
    allowed_groups = [ "torrent" ];
  };

  # vpnNamespaces.mullvad.portMappings = [
  #   {
  #     from = config.services.autobrr.settings.port;
  #     to = config.services.autobrr.settings.port;
  #   }
  # ];
  # vpnNamespaces.mullvad.openVPNPorts = [
  #   {
  #     # irc port
  #     port = 7021;
  #     protocol = "both";
  #   }
  # ];
  # systemd.services.autobrr.vpnConfinement = {
  #   enable = true;
  #   vpnNamespace = "mullvad";
  # };

  services.autobrr = {
    enable = true;
    settings = {
      logLevel = "DEBUG";
      checkForUpdates = false;
      host = "localhost";
      port = 11012;
    };
    secretFile = config.sops.secrets.autobrr.path;
  };
}