{ config, ... }: {
	# Secrets
	sops.secrets.slskd-env = { sopsFile = ./resources/secrets/slskd.yaml; key = "env-file"; };

	# Container
	containers.slskd = let
		home = "/var/lib/slskd";
		download-dir = "${home}/complete";
		incomplete-dir = "${home}/incomplete";
	in {
		autoStart = true;
		privateNetwork = true;
		hostBridge = "br-lan0";
		localMacAddress = "02:00:00:00:01:51";
		ephemeral = true;

		# Download dirs, shared with transmission's media tree, plus a
		# read-only mount of the whole library for Soulseek sharing
		bindMounts = {
			"${download-dir}" = {
				hostPath = "/media/ingens/media/dls/slskd/complete";
				isReadOnly = false;
			};
			"${incomplete-dir}" = {
				hostPath = "/media/ingens/media/dls/slskd/incomplete";
				isReadOnly = false;
			};
			"/srv" = {
				hostPath = "/media/ingens/media/dls/slskd/srv";
				isReadOnly = false;
			};
			"/media/ingens/media" = {
				hostPath = "/media/ingens/media";
				isReadOnly = true;
			};
		};

		# Bind secrets
		bindMounts."/run/secrets/slskd.env" = {
			hostPath = config.sops.secrets.slskd-env.path;
			isReadOnly = true;
		};

		config = { lib, config, pkgs, ... }: {
			# Network
			networking = {
				enableIPv6 = false;  # Prevent ip leaks
				firewall.allowedTCPPorts = [ 80 50300 ];  # Web ui + soulseek listen port tcp
				firewall.allowedUDPPorts = [ 50300 ];  # soulseek listen port udp
				# DHCP (see transmission.nix)
				interfaces.eth0.useDHCP = true;
				dhcpcd.extraConfig = ''
					interface eth0
					static routers=192.168.1.9
					static domain_name_servers=9.9.9.9 1.1.1.1
				'';
			};

			# slskd
			services.slskd = {
				enable = true;
				environmentFile = "/run/secrets/slskd.env";
				settings = {
					directories = {
						downloads = download-dir;
						incomplete = incomplete-dir;
					};
					shares.directories = [ "/srv" ];
					transfers = {
						upload.slots = 5;
						upload.speed_limit = 0;
						download.slots = 5;
						download.speed_limit = 0;
					};
					flags.no_version_check = true;
				};
			};
			users.users.slskd = {
				uid = 1000;  # UID is not set otherwise
				home = lib.mkForce "/var/lib/slskd";  # Prevent errors with dotnet
			};

			# Reverse proxy
			services.caddy = {
				enable = true;
				virtualHosts.":80".extraConfig = ''
					reverse_proxy localhost:5030
				'';
			};

			system.stateVersion = "26.05";
		};
	};
}