{
  self,
  config,
  lib,
  pkgs,
  ...
}:

with self.lib.nginx;
{
  services.slskd = {
    enable = true;
    package = pkgs.callPackage ./slsk_package.nix { };

    environmentFile = "/etc/secrets/slskd.env";
    domain = null;

    group = "media";

    settings = {
      remote_file_management = true;

      directories = {
        downloads = "/mnt/media/soulseek/downloads";
        incomplete = "/mnt/media/soulseek/incomplete";
      };

      permissions = {
        file = {
          mode = "664";
        };
      };

      soulseek = {
        listen_ip_address = "0.0.0.0";
        listen_port = 50300;
      };

      shares = {
        directories = [ "[Music]/mnt/media/Music" ];
        cache = {
          storage_mode = "memory";
          workers = 4;
          retention = 10080; # 1 week
        };
      };

      global = {
        upload = {
          slots = 20;
          speed_limit = 250000; # kibibytes
        };
        download = {
          slots = 500;
          speed_limit = 250000;
        };
      };

      groups = {
        user_defined = {
          buddies = {
            upload = {
              priority = 500;
              strategy = "roundrobin";
              slots = 100;
              speed_limit = 750000;
            };
            members = [ "thecumzone" ];
          };
        };
      };

      web = {
        authentication = {
          disabled = true;
        };

        socket = "/run/slskd/web.sock";
      };

      filters = {
        search = {
          request = [
            "^.{1,2}$" # discard any requests shorter than 3 characters
          ];
        };
      };

      retention = {
        search = 1440; # 2 day
        transfers = {
          upload = {
            succeeded = 1440; # 2 day
            errored = 30;
            cancelled = 5;
          };
          download = {
            succeeded = 1440; # 2 day
            errored = 20160; # 2 weeks
            cancelled = 5;
          };
        };
        logs = 180; # days
      };
    };
  };

  systemd.services.slskd = {
    bindsTo = [ "wireguard-torrent.service" ];
    after = [ "wireguard-torrent.service" ];
    unitConfig.JoinsNamespaceOf = "netns@torrent.service";
    postStart = ''
      echo "fixing web socket permissions"
      while [ ! -S "${config.services.slskd.settings.web.socket}" ]; do echo "waiting"; sleep 1; done
      echo "found socket"
      chmod a+rw ${config.services.slskd.settings.web.socket}; 
      echo "fixed web socket permissions"
    '';
    serviceConfig = {
      PrivateNetwork = true;
      UMask = "002";

      ProtectSystem = lib.mkForce "full";
    };
  };

  services.nginx = {
    enable = true;
    virtualHosts = {
      "slsk.media.cocaine.farm" = proxyDomainAuth "media.cocaine.farm" "http://unix:/run/slskd/web.sock";
    };
  };

  secrets = {
    slskd = {
      source = ../../secrets/slskd.env;
      dest = "/etc/secrets/slskd.env";
    };
  };
}