server-config/services/jellyfin/jellyfin-qbittorrent-monitor.nix

{
  pkgs,
  service_configs,
  config,
  lib,
  ...
}:
let
  webhookPlugin = import ./jellyfin-webhook-plugin.nix { inherit pkgs lib; };
  jellyfinPort = service_configs.ports.private.jellyfin.port;
  webhookPort = service_configs.ports.private.jellyfin_qbittorrent_monitor_webhook.port;
in
lib.mkIf config.services.jellyfin.enable {
  # Materialise the Jellyfin Webhook plugin into Jellyfin's plugins dir before
  # Jellyfin starts. Jellyfin rewrites meta.json at runtime, so a read-only
  # nix-store symlink would EACCES -- we copy instead.
  #
  # `wantedBy = [ "jellyfin.service" ]` alone is insufficient on initial rollout:
  # if jellyfin is already running at activation time, systemd won't start the
  # oneshot until the next jellyfin restart. `restartTriggers` on jellyfin pinned
  # to the plugin package + install script forces that restart whenever either
  # changes, which invokes this unit via the `before`/`wantedBy` chain.
  systemd.services.jellyfin-webhook-install = {
    before = [ "jellyfin.service" ];
    wantedBy = [ "jellyfin.service" ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      User = config.services.jellyfin.user;
      Group = config.services.jellyfin.group;
      ExecStart = webhookPlugin.mkInstallScript {
        pluginsDir = "${config.services.jellyfin.dataDir}/plugins";
      };
    };
  };

  systemd.services.jellyfin.restartTriggers = [
    webhookPlugin.package
    (webhookPlugin.mkInstallScript {
      pluginsDir = "${config.services.jellyfin.dataDir}/plugins";
    })
  ];

  # After Jellyfin starts, POST the plugin configuration so the webhook
  # targets the monitor's receiver. Idempotent; runs on every boot.
  systemd.services.jellyfin-webhook-configure = {
    after = [ "jellyfin.service" ];
    wants = [ "jellyfin.service" ];
    before = [ "jellyfin-qbittorrent-monitor.service" ];
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      DynamicUser = true;
      LoadCredential = "jellyfin-api-key:${config.age.secrets.jellyfin-api-key.path}";
      ExecStart = webhookPlugin.mkConfigureScript {
        jellyfinUrl = "http://127.0.0.1:${toString jellyfinPort}";
        webhooks = [
          {
            name = "qBittorrent Monitor";
            uri = "http://127.0.0.1:${toString webhookPort}/";
            notificationTypes = [
              "PlaybackStart"
              "PlaybackProgress"
              "PlaybackStop"
            ];
          }
        ];
      };
    };
  };

  systemd.services."jellyfin-qbittorrent-monitor" = {
    description = "Monitor Jellyfin streaming and control qBittorrent rate limits";
    after = [
      "network.target"
      "jellyfin.service"
      "qbittorrent.service"
      "jellyfin-webhook-configure.service"
    ];
    wants = [ "jellyfin-webhook-configure.service" ];
    wantedBy = [ "multi-user.target" ];

    serviceConfig = {
      Type = "simple";
      ExecStart = pkgs.writeShellScript "jellyfin-monitor-start" ''
        export JELLYFIN_API_KEY=$(cat $CREDENTIALS_DIRECTORY/jellyfin-api-key)
        exec ${
          pkgs.python3.withPackages (ps: with ps; [ requests ])
        }/bin/python ${./jellyfin-qbittorrent-monitor.py}
      '';
      Restart = "always";
      RestartSec = "10s";

      # Security hardening
      DynamicUser = true;
      NoNewPrivileges = true;
      ProtectSystem = "strict";
      ProtectHome = true;
      ProtectKernelTunables = true;
      ProtectKernelModules = true;
      ProtectControlGroups = true;
      MemoryDenyWriteExecute = true;
      RestrictRealtime = true;
      RestrictSUIDSGID = true;
      RemoveIPC = true;

      # Load credentials from agenix secrets
      LoadCredential = "jellyfin-api-key:${config.age.secrets.jellyfin-api-key.path}";
    };

    environment = {
      JELLYFIN_URL = "http://localhost:${builtins.toString jellyfinPort}";
      QBITTORRENT_URL = "http://${config.vpnNamespaces.wg.namespaceAddress}:${builtins.toString service_configs.ports.private.torrent.port}";
      CHECK_INTERVAL = "30";
      # Bandwidth budget configuration
      TOTAL_BANDWIDTH_BUDGET = "30000000"; # 30 Mbps in bits per second
      SERVICE_BUFFER = "5000000"; # 5 Mbps reserved for other services (bps)
      DEFAULT_STREAM_BITRATE = "10000000"; # 10 Mbps fallback when bitrate unknown (bps)
      MIN_TORRENT_SPEED = "100"; # KB/s - below this, pause torrents instead
      STREAM_BITRATE_HEADROOM = "1.1"; # multiplier per stream for bitrate fluctuations
      # Webhook receiver: Jellyfin Webhook plugin POSTs events here to throttle immediately.
      WEBHOOK_BIND = "127.0.0.1";
      WEBHOOK_PORT = toString webhookPort;
    };
  };
}