{
  pkgs,
  config,
  lib,
  service_configs,
  username,
  ...
}:
{
  imports = [
    (lib.serviceMountWithZpool "slskd" "" [
      service_configs.slskd.base
      service_configs.slskd.downloads
      service_configs.slskd.incomplete
    ])
    (lib.serviceFilePerms "slskd" [
      "Z ${service_configs.music_dir} 0750 ${username} music"
      "Z ${service_configs.slskd.base} 0750 ${config.services.slskd.user} ${config.services.slskd.group}"
      "Z ${service_configs.slskd.downloads} 0750 ${config.services.slskd.user} music"
      "Z ${service_configs.slskd.incomplete} 0750 ${config.services.slskd.user} music"
    ])
    (lib.mkCaddyReverseProxy {
      subdomain = "soulseek";
      port = service_configs.ports.private.soulseek_web.port;
    })
  ];

  users.groups."music" = { };

  services.slskd = {
    enable = true;
    domain = null; # null so we don't use nginx reverse proxy
    environmentFile = config.age.secrets.slskd_env.path;

    settings = {
      web = {
        port = service_configs.ports.private.soulseek_web.port;
      };
      soulseek = {
        # description = "smth idk";
        listen_port = service_configs.ports.public.soulseek_listen.port;
      };

      shares = {
        directories = [ service_configs.music_dir ];
        # rescan daily so files retagged/re-encoded on disk don't drift out
        # of sync with the shared index (avoids sending stale sizes to peers)
        cache.retention = 1440;
      };

      global = {
        download = {
          slots = -1;
          speed_limit = -1;
        };
        upload = {
          slots = 4;
          speed_limit = 2000;
        };
      };
    };
  };

  users.users.${config.services.slskd.user}.extraGroups = [ "music" ];
  users.users.${config.services.jellyfin.user}.extraGroups = [ "music" ];
  users.users.${username}.extraGroups = [ "music" ];

  networking.firewall.allowedTCPPorts = [
    service_configs.ports.public.soulseek_listen.port
  ];
}