{
  pkgs,
  config,
  lib,
  service_configs,
  username,
  ...
}:
{
  users.groups."music" = { };

  services.slskd = {
    enable = true;
    domain = null; # null so we don't use nginx reverse proxy
    environmentFile = ../secrets/slskd_env;

    settings = {
      web = {
        port = service_configs.ports.soulseek_web;
      };
      soulseek = {
        # description = "smth idk";
        listen_port = service_configs.ports.soulseek_listen;
      };

      shares = {
        directories = [ service_configs.music_dir ];
      };

      global = {
        download = {
          slots = 10;
          speed_limit = 1000;
        };
        upload = {
          slots = 10;
          speed_limit = 1000;
        };
      };
    };
  };

  users.users.${config.services.slskd.user}.extraGroups = [ "music" ];
  users.users.${config.services.jellyfin.user}.extraGroups = [ "music" ];

  systemd.tmpfiles.rules = [
    "d ${service_configs.music_dir} 0750 ${username} music"
    "d ${service_configs.music_dir} 0750 ${username} music"
  ];

  services.caddy.virtualHosts."soulseek.${service_configs.https.domain}".extraConfig = ''
    # tls internal
    ${builtins.readFile ../secrets/caddy_auth}
    reverse_proxy :${builtins.toString config.services.slskd.settings.web.port}
  '';
}