# DDRM Flask backend (Widevine / PlayReady decrypt). Extension URL: http://<host>:58239
{ pkgs, inputs, ... }:
{
  services.ddrm-media-server = {
    enable = true;
    port = 58239;
    listenAddress = "0.0.0.0";
    openFirewall = true;
    package = inputs.ddrm.packages.${pkgs.stdenv.hostPlatform.system}.default;
    # State: /var/lib/ddrm-media (venv + configs + CDMs on first run — needs network for pip).
  };
}