{ config, lib, ... }:

let
  domain = "htbaz.giugl.io";
in
{
  services.bazarr = {
    enable = true;
    group = "media";
  };

  architect.vhost.${domain} = with config.architect.networks; {
    dnsInterfaces = [ "lan" "wireguard" "tailscale" ];
    locations."/" = {
      port = 6767;
      deny = [ lan.devices.router.address ];
      allow = [
        lan.net
        wireguard.net
        tailscale.net
      ];
    };
  };

  users.groups.media.members = [ "bazarr" ];
}