#prowlarr.nix
{ config, pkgs, lib, ... }:
{
  config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
    
    # Disable built-in auth — Authelia handles it at the reverse proxy
    systemd.services.prowlarr.preStart = lib.mkAfter ''
      config_file="/var/lib/prowlarr/config.xml"
      if [ -f "$config_file" ]; then
        sed -i 's|<AuthenticationMethod>.*</AuthenticationMethod>|<AuthenticationMethod>None</AuthenticationMethod>|' "$config_file"
      fi
    '';

    # Prowlarr
    services.prowlarr = {
      enable = true;
      openFirewall = true;
      dataDir = "/var/lib/prowlarr";
    };
  };
}