# services/bazarr.nix
{ config, pkgs, lib, ... }:
{
  config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
    
    # Bazarr
    services.bazarr = {
      enable = true;
      openFirewall = true;  # Opens port 7878
      dataDir = "/var/lib/bazarr";
      user = "bazarr";
      group = "media";
    };

    # Disable built-in auth — Authelia handles it at the reverse proxy
    systemd.services.bazarr.preStart = lib.mkAfter ''
      config_file="/var/lib/bazarr/config/config.ini"
      if [ -f "$config_file" ]; then
        sed -i 's/^type = .*/type = none/' "$config_file"
      fi
    '';

    # Ensure subtitles written by bazarr are group-writable
    systemd.services.bazarr.serviceConfig.UMask = lib.mkForce "0002";
    
    users.users.bazarr = {
      isSystemUser = true;
      group = "media";
      extraGroups = [ "media" ];
    };
  };
}