{
  pkgs,
  config,
  lib,
  ...
}:
let
  cfg = config.aux.system.services.airsonic;
in
{
  options = {
    aux.system.services.airsonic = {
      autostart = lib.mkEnableOption (lib.mdDoc "Automatically starts Airsonic at boot.");
      enable = lib.mkEnableOption (lib.mdDoc "Enables Airsonic Advanced media streaming service.");
      home = lib.mkOption {
        default = "";
        type = lib.types.str;
        description = "Where to store Airsonic's files";
      };
      domain = lib.mkOption {
        default = "";
        type = lib.types.str;
        description = "The root domain that Airsonic will be hosted on.";
        example = "example.com";
      };
      url = lib.mkOption {
        default = "";
        type = lib.types.str;
        description = "The complete URL where Airsonic is hosted.";
        example = "https://forgejo.example.com";
      };
    };
  };

  config = lib.mkIf cfg.enable {
    aux.system.users.media.enable = true;
    users.users.airsonic.extraGroups = [ "media" ];

    services = {
      nginx.virtualHosts."${cfg.url}" = {
        useACMEHost = cfg.domain;
        forceSSL = true;
        locations."/" = {
          proxyPass = "http://127.0.0.1:4040";
          proxyWebsockets = true;
          extraConfig = ''
            # Taken from https://airsonic.github.io/docs/proxy/nginx/
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
            proxy_set_header X-Forwarded-Host  $host;
            proxy_set_header Host              $host;
            proxy_max_temp_file_size           0;
            proxy_ssl_server_name on;
            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' www.gstatic.com; img-src 'self' *.akamaized.net; style-src 'self' 'unsafe-inline' fonts.googleapis.com; font-src 'self' fonts.gstatic.com; frame-src 'self'; object-src 'none'";
          '';
        };
      };

      airsonic = {
        enable = true;
        war = "${
          (pkgs.callPackage ../../packages/airsonic-advanced.nix { inherit lib; })
        }/webapps/airsonic.war";
        port = 4040;
        jre = pkgs.jdk17;
        jvmOptions = [
          "-Dserver.use-forward-headers=true"
          "-Xmx4G" # Increase Java heap size to 4GB
        ];
      } // lib.optionalAttrs (cfg.home != "") { home = cfg.home; };
    };

    systemd.services.nginx.wants = [ config.systemd.services.airsonic.name ];
    # Disable autostart if configured
    systemd.services.airsonic = lib.mkIf (!cfg.autostart) { wantedBy = lib.mkForce [ ]; };
  };
}