{ lib, mediaStackPaths, ... }:
{
  services.prowlarr = {
    enable = true;
    dataDir = mediaStackPaths.prowlarrDataDir;
  };

  users.groups.prowlarr = { };
  users.users.prowlarr = {
    isSystemUser = true;
    group = "prowlarr";
    extraGroups = [ "media" ];
  };

  systemd.services.prowlarr.serviceConfig.ReadWritePaths = lib.mkAfter [
    mediaStackPaths.prowlarrDataDir
  ];

  networking.firewall.allowedTCPPorts = [ 9696 ];
}