{
  pkgs,
  config,
  lib,
  service_configs,
  username,
  ...
}:
let
  slskd_env = "/etc/slskd_env";
in
{
  imports = [
    (lib.serviceMountDeps "slskd" [
      service_configs.slskd.base
      service_configs.slskd.downloads
      service_configs.slskd.incomplete
    ])
    (lib.serviceDependZpool "slskd" service_configs.zpool_ssds)
    (lib.serviceDependZpool "slskd" service_configs.zpool_hdds)
  ];

  users.groups."music" = { };

  system.activationScripts = {
    "skskd_env".text = ''
      #!/bin/sh
      rm -fr ${slskd_env} || true
      cp ${../secrets/slskd_env} ${slskd_env}
      chmod 0500 ${slskd_env}
      chown ${config.services.slskd.user}:${config.services.slskd.group} ${slskd_env}
    '';
  };

  services.slskd = {
    enable = true;
    domain = null; # null so we don't use nginx reverse proxy
    environmentFile = slskd_env;

    settings = {
      web = {
        port = service_configs.ports.soulseek_web;
      };
      soulseek = {
        # description = "smth idk";
        listen_port = service_configs.ports.soulseek_listen;
      };

      shares = {
        directories = [ service_configs.music_dir ];
      };

      global = {
        download = {
          slots = -1;
          speed_limit = -1;
        };
        upload = {
          slots = 4;
          speed_limit = 2000;
        };
      };
    };
  };

  users.users.${config.services.slskd.user}.extraGroups = [ "music" ];
  users.users.${config.services.jellyfin.user}.extraGroups = [ "music" ];
  users.users.${username}.extraGroups = [ "music" ];

  systemd.tmpfiles.rules = [
    "d ${service_configs.music_dir} 0750 ${username} music"
    "d ${service_configs.slskd.base} 0750 ${config.services.slskd.user} ${config.services.slskd.group}"
    "d ${service_configs.slskd.downloads} 0750 ${config.services.slskd.user} music"
    "d ${service_configs.slskd.incomplete} 0750 ${config.services.slskd.user} music"
  ];

  # doesn't work with auth????
  services.caddy.virtualHosts."soulseek.${service_configs.https.domain}".extraConfig = ''
    reverse_proxy :${builtins.toString config.services.slskd.settings.web.port}
  '';
}