{ ... }:
{
  # Radarr (movie automation). UI: http://<host>:7878
  services.radarr.enable = true;

  # Keep permissions aligned with Jellyfin (/var/lib/media via group `media`).
  users.groups.radarr = { };
  users.users.radarr = {
    isSystemUser = true;
    group = "radarr";
    extraGroups = [ "media" ];
  };

  networking.firewall.allowedTCPPorts = [ 7878 ];
}