{ config, pkgs, lib, ... }:
let
  # SAB rejects requests whose Host header isn't in host_whitelist. We need:
  #   - sabnzbd.nordhammer.it (the nginx-fronted public path)
  #   - 127.0.0.1 + localhost (so Sonarr/Radarr can hit SAB locally via
  #     arr-interconnect without hitting "Hostname verification failed")
  patchConfig = pkgs.writeShellScript "sabnzbd-patch-config" ''
    CONFIG=/var/lib/sabnzbd/sabnzbd.ini
    WHITELIST="sabnzbd.nordhammer.it,127.0.0.1,localhost"
    # Completed downloads must land on the setgid, group-writable pool dir
    # (see tmpfiles below), NOT sabnzbd's default /var/lib/sabnzbd/Downloads/
    # complete which is 0755 — there Sonarr/Radarr (group media) can copy the
    # file out but can't delete the source, so imports fail-loop forever with
    # "Permission denied" and thrash the mergerfs pool. permissions=0775 makes
    # sabnzbd force group-write on completed files/dirs so the *arrs can remove
    # them after import.
    COMPLETE_DIR="/mnt/storage/usenet/downloads"
    PERMISSIONS="0775"

    if [ ! -f "$CONFIG" ]; then
      printf '[misc]\nhost_whitelist = %s\nport = 8085\ncomplete_dir = %s\npermissions = %s\n' \
        "$WHITELIST" "$COMPLETE_DIR" "$PERMISSIONS" > "$CONFIG"
      exit 0
    fi

    # Idempotently set a key in the [misc] section (create or replace).
    set_misc() {
      key="$1"; val="$2"
      if ${pkgs.gnugrep}/bin/grep -q "^$key" "$CONFIG"; then
        ${pkgs.gnused}/bin/sed -i "s|^$key =.*|$key = $val|" "$CONFIG"
      else
        ${pkgs.gnused}/bin/sed -i "/^\[misc\]/a $key = $val" "$CONFIG"
      fi
    }

    set_misc host_whitelist "$WHITELIST"
    set_misc complete_dir   "$COMPLETE_DIR"
    set_misc permissions    "$PERMISSIONS"
  '';
in
{
  config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {

    users.users.sabnzbd = {
      isSystemUser = true;
      group = "media";
      extraGroups = [ "media" ];
    };

    systemd.tmpfiles.rules = [
      "d /var/lib/sabnzbd 0755 sabnzbd media -"
      "Z /var/lib/sabnzbd 0755 sabnzbd media -"
      "d /mnt/storage/usenet/downloads 2775 sabnzbd media -"
      "Z /mnt/storage/usenet/downloads 2775 sabnzbd media -"
      "d /mnt/storage/usenet/incomplete 2775 sabnzbd media -"
      "Z /mnt/storage/usenet/incomplete 2775 sabnzbd media -"
    ];

    systemd.services.sabnzbd = {
      description = "SABnzbd usenet downloader";
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
      serviceConfig = {
        Type = "simple";
        User = "sabnzbd";
        Group = "media";
        ExecStartPre = patchConfig;
        ExecStart = "${pkgs.sabnzbd}/bin/sabnzbd --config-file /var/lib/sabnzbd/sabnzbd.ini --server 127.0.0.1:8085";
        Restart = "on-failure";
        UMask = "0002";
        NoNewPrivileges = true;
        PrivateTmp = true;
        ProtectSystem = "strict";
        ProtectHome = false;
        ReadWritePaths = [
          "/var/lib/sabnzbd"
          "/mnt/storage/usenet"
        ];
        WorkingDirectory = "/var/lib/sabnzbd";
      };
    };
  };
}