{
  config,
  lib,
  ...
}:
let
  inherit (config.networking) domain fqdn;
  inherit (import ../../../data) homenet tailnet;
  navidromeUpstream =
    let
      navidrome = config.services.navidrome.settings;
    in
    ''
      reverse_proxy ${navidrome.Address}:${toString navidrome.Port}
    '';
in
{
  services.navidrome = {
    enable = true;
    settings = {
      MusicFolder = "/srv/music/library";

      Agents = "listenbrainz,deezer";

      AutoTranscodeDownload = true;
      DefaultTheme = "Auto";
      EnableMediaFileCoverArt = false;
      PreferSortTags = true;
      TranscodingCacheSize = "1GiB";

      Subsonic.AppendAlbumVersion = false;
      Scanner = {
        ScanOnStartup = false;
      };
    };
  };

  services.caddy.virtualHosts = {
    "music.${domain}" = {
      extraConfig = ''
        ${lib.optionalString (domain == homenet) ''
          tls {
            issuer internal {
              ca home
            }
          }
        ''}
        ${navidromeUpstream}
      '';
    };
    "music.${tailnet}" = {
      extraConfig = ''
        bind tailscale/music
        tls {
          get_certificate tailscale
        }
        ${navidromeUpstream}
      '';
    };
  };

  services.dnsmasq.settings.cname = [
    "music.${domain},${fqdn}"
  ];
}