{ config, pkgs, ... }:

let
  qbitBase = {
    image = "ghcr.io/linuxserver/qbittorrent:latest";
    pull = "always";
    environment = {
      PUID = "600";
      PGID = "100";
      TZ = "America/New_York";
    };
  };

  vars = import ../vars.nix;
  #docker_path = vars.primary_docker;
  torr_path = vars.primary_torr;
  qbit_path = "${torr_path}/qbit";
  qbitvpn_path = "${torr_path}/qbitvpn";
  qbitperm_path = "${torr_path}/qbitperm";
in
{

  virtualisation.oci-containers.containers = {
    qbit = qbitBase // {
      # webui port is 8082, torr port is 29432
      environment = qbitBase.environment // {
        WEBUI_PORT = "8082";
        TORRENTING_PORT = "29432";
      };
      volumes = [
        "${qbit_path}/config:/config" # move from docker/qbit to qbit_path
        "${torr_path}/data/:/data"
        "/etc/localtime:/etc/localtime:ro"
      ];
      networks = [ "host" ];
      ports = [
        "8082:8082"
        "29432:29432"
        "29432:29432/udp"
      ];
      extraOptions = [
        "--dns=9.9.9.9"
      ];
    };
    qbitVPN = qbitBase // {
      # webui port is 8081, torr port is 39274
      networks = [
        "container:gluetun-qbit"
      ];
      environment = qbitBase.environment // {
        WEBUI_PORT = "8081";
      };
      dependsOn = [ "gluetun-qbit" ];
      volumes = [
        "${qbitvpn_path}/config:/config"
        "${torr_path}/data:/data"
        "/etc/localtime:/etc/localtime:ro"
      ];
    };
    qbitPerm = qbitBase // {
      # webui port is 8083, torr port is 29434
      networks = [
        "container:gluetun-qbit"
      ];
      environment = qbitBase.environment // {
        WEBUI_PORT = "8083";
      };
      dependsOn = [ "gluetun-qbit" ];
      volumes = [
        "${qbitperm_path}/config:/config"
        "${torr_path}/data:/data"
        "/etc/localtime:/etc/localtime:ro"
      ];
    };
    gluetun-qbit = {
      image = "qmcgaw/gluetun:v3";
      capabilities = {
        NET_ADMIN = true;
      };
      devices = [
        "/dev/net/tun:/dev/net/tun"
      ];
      ports = [
        # qbitvpn
        "8081:8081"
        "39274:39274"
        "39274:39274/udp"

        # qbitperm
        "8083:8083"
        "29433:24933/udp"
      ];
      environment = {
        TZ = "America/New_York";
        # SOPS prep
      };
      environmentFiles = [
        config.sops.secrets."docker/gluetun".path
      ];
    };
  };

  sops.secrets = {
    "docker/gluetun" = {
      owner = "docker-service";
      restartUnits = [ "docker-gluetun-qbit.service" ];
    };
  };
}