{
  pkgs,
  config,
  service_configs,
  lib,
  ...
}:
let
  radarrConfig = "${service_configs.radarr.dataDir}/config.xml";
  sonarrConfig = "${service_configs.sonarr.dataDir}/config.xml";
  configPath = "/var/lib/recyclarr/config.json";

  # Runs as root (via + prefix) after the NixOS module writes config.json.
  # Extracts API keys from radarr/sonarr config.xml and injects them via jq.
  injectApiKeys = pkgs.writeShellScript "recyclarr-inject-api-keys" ''
    RADARR_KEY=$(${lib.getExe pkgs.gnugrep} -oP '(?<=<ApiKey>)[^<]+' ${radarrConfig})
    SONARR_KEY=$(${lib.getExe pkgs.gnugrep} -oP '(?<=<ApiKey>)[^<]+' ${sonarrConfig})
    ${pkgs.jq}/bin/jq \
      --arg rk "$RADARR_KEY" \
      --arg sk "$SONARR_KEY" \
      '.radarr.movies.api_key = $rk | .sonarr.series.api_key = $sk' \
      ${configPath} > ${configPath}.tmp
    mv ${configPath}.tmp ${configPath}
    chown recyclarr:recyclarr ${configPath}
  '';
in
{
  imports = [
    (lib.serviceMountWithZpool "recyclarr" service_configs.zpool_ssds [
      service_configs.recyclarr.dataDir
    ])
  ];

  systemd.tmpfiles.rules = [
    "d ${service_configs.recyclarr.dataDir} 0755 recyclarr recyclarr -"
  ];

  services.recyclarr = {
    enable = true;
    command = "sync";
    schedule = "daily";
    user = "recyclarr";
    group = "recyclarr";

    configuration = {
      radarr.movies = {
        base_url = "http://localhost:${builtins.toString service_configs.ports.radarr}";

        include = [
          { template = "radarr-quality-definition-movie"; }
          { template = "radarr-quality-profile-remux-web-2160p"; }
          { template = "radarr-custom-formats-remux-web-2160p"; }
        ];

        quality_profiles = [
          {
            name = "Remux + WEB 2160p";
            min_format_score = 0;
            reset_unmatched_scores = {
              enabled = true;
            };
            upgrade = {
              allowed = true;
              until_quality = "Remux-2160p";
              until_score = 10000;
            };
            quality_sort = "top";
            qualities = [
              { name = "Remux-2160p"; }
              {
                name = "WEB 2160p";
                qualities = [
                  "WEBDL-2160p"
                  "WEBRip-2160p"
                ];
              }
              { name = "Remux-1080p"; }
              { name = "Bluray-1080p"; }
              {
                name = "WEB 1080p";
                qualities = [
                  "WEBDL-1080p"
                  "WEBRip-1080p"
                ];
              }
              { name = "HDTV-1080p"; }
            ];
          }
        ];

        custom_formats = [
          # Upscaled
          {
            trash_ids = [ "bfd8eb01832d646a0a89c4deb46f8564" ];
            assign_scores_to = [
              {
                name = "Remux + WEB 2160p";
                score = -10000;
              }
            ];
          }
          # x265 (HD) - override template -10000 penalty
          {
            trash_ids = [ "dc98083864ea246d05a42df0d05f81cc" ];
            assign_scores_to = [
              {
                name = "Remux + WEB 2160p";
                score = 0;
              }
            ];
          }
          # x265 (no HDR/DV) - override template -10000 penalty
          {
            trash_ids = [ "839bea857ed2c0a8e084f3cbdbd65ecb" ];
            assign_scores_to = [
              {
                name = "Remux + WEB 2160p";
                score = 0;
              }
            ];
          }
        ];
      };

      sonarr.series = {
        base_url = "http://localhost:${builtins.toString service_configs.ports.sonarr}";

        include = [
          { template = "sonarr-quality-definition-series"; }
          { template = "sonarr-v4-quality-profile-web-2160p"; }
          { template = "sonarr-v4-custom-formats-web-2160p"; }
        ];

        quality_profiles = [
          {
            name = "WEB-2160p";
            min_format_score = 0;
            reset_unmatched_scores = {
              enabled = true;
            };
            upgrade = {
              allowed = true;
              until_quality = "WEB 2160p";
              until_score = 10000;
            };
            quality_sort = "top";
            qualities = [
              {
                name = "WEB 2160p";
                qualities = [
                  "WEBDL-2160p"
                  "WEBRip-2160p"
                ];
              }
              { name = "Bluray-1080p Remux"; }
              { name = "Bluray-1080p"; }
              {
                name = "WEB 1080p";
                qualities = [
                  "WEBDL-1080p"
                  "WEBRip-1080p"
                ];
              }
              { name = "HDTV-1080p"; }
            ];
          }
        ];

        custom_formats = [
          # Upscaled
          {
            trash_ids = [ "23297a736ca77c0fc8e70f8edd7ee56c" ];
            assign_scores_to = [
              {
                name = "WEB-2160p";
                score = -10000;
              }
            ];
          }
          # x265 (HD) - override template -10000 penalty
          {
            trash_ids = [ "47435ece6b99a0b477caf360e79ba0bb" ];
            assign_scores_to = [
              {
                name = "WEB-2160p";
                score = 0;
              }
            ];
          }
          # x265 (no HDR/DV) - override template -10000 penalty
          {
            trash_ids = [ "9b64dff695c2115facf1b6ea59c9bd07" ];
            assign_scores_to = [
              {
                name = "WEB-2160p";
                score = 0;
              }
            ];
          }
        ];
      };
    };
  };

  # Add secrets generation before recyclarr runs
  systemd.services.recyclarr = {
    after = [
      "network-online.target"
      "radarr.service"
      "sonarr.service"
    ];
    wants = [ "network-online.target" ];
    serviceConfig.ExecStartPre = [ "+${injectApiKeys}" ];
  };
}