{
  pkgs,
  config,
  lib,
  service_configs,
  username,
  ...
}:
{
  imports = [
    (lib.serviceMountWithZpool "slskd" "" [
      service_configs.slskd.base
      service_configs.slskd.downloads
      service_configs.slskd.incomplete
    ])
    (lib.serviceFilePerms "slskd" [
      "Z ${service_configs.music_dir} 0750 ${username} music"
      "Z ${service_configs.slskd.base} 0750 ${config.services.slskd.user} ${config.services.slskd.group}"
      "Z ${service_configs.slskd.downloads} 0750 ${config.services.slskd.user} music"
      "Z ${service_configs.slskd.incomplete} 0750 ${config.services.slskd.user} music"
    ])
  ];

  users.groups."music" = { };

  services.slskd = {
    enable = true;
    domain = null; # null so we don't use nginx reverse proxy
    environmentFile = config.age.secrets.slskd_env.path;

    settings = {
      web = {
        port = service_configs.ports.soulseek_web;
      };
      soulseek = {
        # description = "smth idk";
        listen_port = service_configs.ports.soulseek_listen;
      };

      shares = {
        directories = [ service_configs.music_dir ];
      };

      global = {
        download = {
          slots = -1;
          speed_limit = -1;
        };
        upload = {
          slots = 4;
          speed_limit = 2000;
        };
      };
    };
  };

  users.users.${config.services.slskd.user}.extraGroups = [ "music" ];
  users.users.${config.services.jellyfin.user}.extraGroups = [ "music" ];
  users.users.${username}.extraGroups = [ "music" ];

  # doesn't work with auth????
  services.caddy.virtualHosts."soulseek.${service_configs.https.domain}".extraConfig = ''
    reverse_proxy :${builtins.toString config.services.slskd.settings.web.port}
  '';

  networking.firewall.allowedTCPPorts = [
    service_configs.ports.soulseek_listen
  ];
}