{
  pkgs,
  config,
  ...
}: {
  clan.core.vars.generators."nixarr-sonarr" = {
    prompts.password = {
      type = "hidden";
      persist = true;
      description = "Leave empty to generate automatically";
    };

    files.password.deploy = false;

    runtimeInputs = [
      pkgs.coreutils
      pkgs.xkcdpass
    ];

    script = ''
      prompt_value="$(cat "$prompts/password")"
      if [[ -n "''${prompt_value-}" ]]; then
        echo "$prompt_value" | tr -d "\n" > "$out"/password
      else
        xkcdpass --numwords 4 --delimiter - --count 1 | tr -d "\n" > "$out"/password
      fi
    '';
  };
  nixarr.sonarr = {
    # NOTE: cannot set password so just set the generated one manually
    enable = true;
  };
  services.nginx.virtualHosts."sonarr.moritz.place" = {
    forceSSL = true;
    useACMEHost = "any.moritz.place";
    locations."/" = {
      proxyPass = "http://127.0.0.1:8989";
    };
  };
  fileSystems."/mnt/ds_tv" = {
    device = "//192.168.0.2/media/tv";
    fsType = "cifs";
    options = let
      # this line prevents hanging on network split
      automount_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
    in ["${automount_opts},credentials=${config.clan.core.vars.generators.nixarr-ds-share.files.config.path},gid=${builtins.toString config.users.groups.media.gid},uid=${builtins.toString config.users.users.sonarr.uid}"];
  };
}