{
  config,
  inputs,
  lib,
  libNginx,
  this,
  ...
}:
with lib;
let
  cfg = config.nixfiles.modules.prowlarr;

  port = 9696;
in
{
  options.nixfiles.modules.prowlarr = {
    enable = mkEnableOption "Prowlarr";

    domain = mkOption {
      description = "Domain name sans protocol scheme.";
      type = with types; str;
      default = "prowlarr.${config.networking.domain}";
    };
  };

  config = mkIf cfg.enable {
    # secrets.prowlarr-api-key.file = "${inputs.self}/secrets/prowlarr-api-key";

    ark.directories = [ "/var/lib/private/prowlarr" ];

    nixfiles.modules.nginx = {
      enable = true;
      upstreams.prowlarr.servers."127.0.0.1:${toString port}" = { };
      virtualHosts.${cfg.domain} = {
        locations."/".proxyPass = "http://prowlarr";
        extraConfig = libNginx.config.internalOnly;
      };
    };

    services = {
      prowlarr.enable = true;

      prometheus.exporters.exportarr-prowlarr = {
        enable = true;
        url = "http://127.0.0.1";
        port = port + 10000;
        apiKeyFile = config.secrets.lidarr-api-key.path;
        listenAddress = this.wireguard.ipv4.address;
        environment = {
          PROWLARR__BACKFILL = "true";
          PROWLARR__BACKFILL_DATE_SINCE = "2025-01-01";
        };
      };
    };

    topology = with cfg; {
      nodes.${this.hostname}.services.prowlarr = {
        name = "Prowlarr";
        icon = "${inputs.homelab-svg-assets}/assets/prowlarr.svg";
        info = domain;
        details.listen.text = "127.0.0.1:${toString port}";
      };
    };
  };
}