{
  lib,
  pkgs,
  me,
  unstablePkgs,
  auxiliaryPkgs,
  ...
}:

let
  inherit (pkgs) dockerTools mediainfo;
  inherit (auxiliaryPkgs) common;

  flood = unstablePkgs.flood;

  torrentLocalPort = 2018;
  torrentWebLocalPort = 2019;
  torrentDir = "/srv/torrent";

  floodImage = dockerTools.streamLayeredImage {
    name = "flood";
    tag = flood.version;
    fromImage = common.alpine.base;
    contents = [ flood mediainfo ];
  };
in
{
  foundation.services.torrent-webui = {
    image = floodImage;

    ports = [ torrentWebLocalPort ];

    volumes = [
      [
        "${torrentDir}/download"
        "/download"
      ]
    ];

    entrypoint = lib.getExe flood;
    cmd = [
      "--host" "0.0.0.0"
      "--port" "${toString torrentWebLocalPort}"
      "--rundir" "${torrentDir}/flood"
      "--auth" "none"

      # pick one according to which is running!
      # "--qburl" "http://${me.tailscale.ip}:${toString torrentLocalPort}"
      # "--qbuser" "admin"
      # "--qbpass" "admin"
      "--trurl" "http://${me.tailscale.ip}:${toString torrentLocalPort}/transmission/rpc"
      "--truser" "admin"
      "--trpass" "admin"
    ];
  };

  services.nginx.virtualHosts."bt.rnrd.fyi" = {
    useACMEHost = "rnrd.fyi";
    forceSSL = true;
    listenAddresses = [ me.tailscale.ip ];
    locations."/" = {
      proxyPass = "http://127.0.0.1:${toString torrentWebLocalPort}/";
      recommendedProxySettings = true;
    };
  };
}