{ config, lib, ... }: let domain = "htbaz.giugl.io"; in { services.bazarr = { enable = true; group = "media"; }; architect.vhost.${domain} = with config.architect.networks; { dnsInterfaces = [ "lan" "wireguard" "tailscale" ]; locations."/" = { port = 6767; deny = [ lan.devices.router.address ]; allow = [ lan.net wireguard.net tailscale.net ]; }; }; users.groups.media.members = [ "bazarr" ]; }