{
  config,
  lib,
  pkgs,
  ...
}:
let
  inherit (config.networking) domain fqdn;
  inherit (import ../../data) homenet tailnet;

  cfg = config.services.transmission;
  storeDir = "/data/transmission";
in
{
  services.transmission = {
    enable = true;
    openPeerPorts = true;
    webHome = pkgs.trgui-ng-web;
    performanceNetParameters = true;

    settings = {
      utp-enabled = false;

      download-dir = "${storeDir}/complete";
      incomplete-dir = "${storeDir}/downloads";
      incomplete-dir-enabled = false;
      watch-dir = "${storeDir}/watch";
      watch-dir-enabled = true;
      trash-original-torrent-files = false;

      rpc-bind-address = "[::1]";
      rpc-whitelist-enabled = false;
      rpc-host-whitelist-enabled = false;
    };
  };
  systemd.services.transmission = {
    serviceConfig = {
      LimitNOFILE = 524288;
    };
  };

  systemd.tmpfiles.rules = [
    "d ${storeDir} 0755 ${cfg.user} ${cfg.group}"
    "d ${cfg.settings.download-dir} 0755 ${cfg.user} ${cfg.group}"
    "d ${cfg.settings.incomplete-dir} 0755 ${cfg.user} ${cfg.group}"
    "d ${cfg.settings.watch-dir} 0777 ${cfg.user} ${cfg.group}"
  ];

  services.caddy.virtualHosts =
    let
      upstream = ''
        reverse_proxy [::1]:${toString cfg.settings.rpc-port}
      '';
    in
    {
      "bt.${tailnet}" = {
        extraConfig = ''
          bind tailscale/bt
          tls {
            get_certificate tailscale
          }
          ${upstream}
        '';
      };
    };
}