{ lib, mediaStackPaths, ... }:
{
  services.radarr = {
    enable = true;
    dataDir = mediaStackPaths.radarrDataDir;
  };

  users.groups.radarr = { };
  users.users.radarr = {
    isSystemUser = true;
    group = "radarr";
    extraGroups = [ "media" ];
  };

  systemd.services.radarr.serviceConfig.ReadWritePaths = lib.mkAfter [
    mediaStackPaths.radarrDataDir
  ];

  networking.firewall.allowedTCPPorts = [ 7878 ];
}