{ ... }:

let
  DestDir = "/srv/media/incoming";
in
{
  systemd.tmpfiles.rules = [
    "d ${DestDir} 0775 nzbget nzbget"
  ];

  # Several low risk credentials are included.
  services.nzbget = {
    enable = true;
    # Settings are passed as command line flags and not written to the config
    # file. They will not show up in the web UI.
    settings = {
      inherit DestDir;
      AppendCategoryDir = false;
      # Also accepts a named pipe path, but wasn't able to set the permissions
      # correctly. Trying socket activation failed with EADDRINUSE.
      ControlIP = "::1";
      ControlPassword = "";

      "Server1.Host" = "secure.news.thecubenet.com";
      "Server1.Port" = "563";
      "Server1.Encryption" = "yes";
      "Server1.Connections" = "20";
      "Server1.Username" = "spanommers+thecubenet99524";
      "Server1.Password" = "Wua8Dn57i3";

      "Server2.Host" = "secure.news.thecubenet.com";
      "Server2.Port" = "563";
      "Server2.Encryption" = "yes";
      "Server2.Connections" = "20";
      "Server2.Username" = "spanommers+thecubenet99525";
      "Server2.Password" = "YWt4x47g9r";
      "Server2.Level" = 1;

      "Feed1.Name" = "nzbfinder";
      "Feed1.URL" = "https://nzbfinder.ws/rss/cart?dl=1&api_token=59f0e1aa3f25da0b76fee712a9ee0a16&del=1";
      "Feed1.Interval" = "0";
    };
  };

  services.nginx.virtualHosts."ng.mou.fo" = {
    enableACME = true;
    forceSSL = true;
    locations."/".proxyPass = "http://[::1]:6789";
  };

  services.oauth2_proxy.nginx.virtualHosts = [ "ng.mou.fo" ];
}