{ config, containerCfg, pkgs, lib, builder, name, ... }:
let 
  serverCfg = config.syscfg.server;
  image = pkgs.dockerTools.streamLayeredImage {
    name = pkgs.transmission_4.name;
    tag = pkgs.transmission_4.version;
    contents = [ pkgs.cacert ];
    config = {
        Cmd = [ "${pkgs.transmission_4}/bin/transmission-daemon" "--foreground" "--config-dir" "/config" ];
        ExposedPorts = {
            "9091/tcp" = {};
            "51413/tcp" = {}; "51413/udp" = {};
        };
    };
  };
in {
  runtime = {
    paths = [{
        path = "${serverCfg.path.config.path}/transmission";
        owner = "1000:1000";
        mode = "0755";
      }];

    containers = {
      server = builder.mkContainer {
        authentik = true;
        subdomain = containerCfg.subdomain;
        subpath = containerCfg.subpath;
        imageStream = image;
        port = 9091;
        
        extraEnv = {
          PUID = "1000";
          PGID = "1000";
          WHITELIST = "";# 127.0.0.1,::1,10.*";
          # HOST_WHITELIST = "traefik-server,authentik-server,authentik-worker";
        };

        overrides = {
          volumes = [
            "${serverCfg.path.dlComplete.path}:/downloads/complete"
            "${serverCfg.path.dlIncomplete.path}:/downloads/incomplete"
            "${serverCfg.path.config.path}/transmission:/config"
          ];
        };
      };
    };


    setup = {
      trigger = "server";
      envFile = [ config.sops.secrets."CUSTOM".path ];
      script = pkgs.writeShellScript "setup" ''

        ${pkgs.gettext}/bin/envsubst < "${../data/transmission/settings.json}" > "${serverCfg.path.config.path}/transmission/config/settings.json"
      '';
    };
  };
}
