{ lib, ... }:
{
  # Prowlarr (indexer manager). UI: http://<host>:9696
  # Data dir is /var/lib/prowlarr (see systemd unit ExecStart -data=…), not ~/.config/Prowlarr.
  services.prowlarr.enable = true;

  # Useful when Prowlarr/Sonarr/Radarr need to write into shared areas (downloads, etc.).
  users.groups.prowlarr = { };
  users.users.prowlarr = {
    isSystemUser = true;
    group = "prowlarr";
    extraGroups = [ "media" ];
  };

  systemd.services.prowlarr.preStart = lib.mkBefore ''
    mkdir -p /var/lib/prowlarr/Definitions/Custom
    ln -sf ${./prowlarr/torrent9-custom.yml} /var/lib/prowlarr/Definitions/Custom/torrent9-custom.yml
  '';

  networking.firewall.allowedTCPPorts = [ 9696 ];
}