{
  config,
  lib,
  pkgs,
  ...
}: {
  nixarr.jellyfin = {
    # NOTE: cannot set password so just set the generated one manually
    enable = true;
  };
  services.nginx.virtualHosts."jellyfin.moritz.place" = {
    forceSSL = true;
    useACMEHost = "any.moritz.place";
    locations."/" = {
      proxyPass = "http://127.0.0.1:8096";
    };
  };
  # 1. enable vaapi on OS-level
  systemd.services.jellyfin.environment.LIBVA_DRIVER_NAME = "iHD"; # Or "i965" if using older driver
  environment.sessionVariables = {LIBVA_DRIVER_NAME = "iHD";}; # Same here
  hardware.graphics = {
    enable = true;
    extraPackages = with pkgs; [
      intel-media-driver # For Broadwell (2014) or newer processors. LIBVA_DRIVER_NAME=iHD
      libva-vdpau-driver # Previously vaapiVdpau
      intel-compute-runtime # OpenCL filter support (hardware tonemapping and subtitle burn-in)
      vpl-gpu-rt # QSV on 11th gen or newer
      intel-ocl # OpenCL support
    ];
  };
  nixpkgs.config.allowUnfreePredicate = pkg:
    builtins.elem (lib.getName pkg) [
      "intel-ocl"
    ];

  clan.core.vars.generators."nixarr-ds-share".prompts.config = {
    type = "multiline";
    persist = true;
  };

  fileSystems."/mnt/ds_media" = {
    device = "//192.168.0.2/media/";
    fsType = "cifs";
    options = let
      # this line prevents hanging on network split
      automount_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
    in ["${automount_opts},credentials=${config.clan.core.vars.generators.nixarr-ds-share.files.config.path},gid=${builtins.toString config.users.groups.media.gid}"];
  };
}