{ config, ... }:
let
  account = config.repo.account;
in
{
  flake.modules.nixos.deluge =
    { config, pkgs, ... }:
    {
      sops.secrets.deluge-auth-file = {
        owner = config.services.deluge.user;
        group = config.services.deluge.group;
        mode = "0400";
        restartUnits = [ "deluged.service" ];
      };

      services.deluge = {
        enable = true;
        declarative = true;
        openFirewall = true;
        authFile = config.sops.secrets.deluge-auth-file.path;

        config = {
          download_location = "${account.homeDirectory}/torrents/.incomplete";
          move_completed = true;
          move_completed_path = "${account.homeDirectory}/torrents";
          listen_ports = [
            43864
            43864
          ];
          random_port = false;
        };
      };

      home-manager.users.${account.name}.home.packages = [ pkgs.deluge ];

      users.users.${account.name}.extraGroups = [ config.services.deluge.group ];
    };
}