{
  pkgs,
  lib,
  config,
  inputs,
  ...
}:
{
  imports = [ ./containers/jackett.nix ];

  languages.rust.enable = true;

  git-hooks.hooks = {
    clippy = {
      enable = true;
      settings.allFeatures = true;
    };
    treefmt.enable = true;
  };

  treefmt = {
    enable = true;
    config.programs = {
      nixfmt.enable = true;
      rustfmt.enable = true;
    };
  };

  packages = with pkgs; [
    git
    just
    protobuf
    buf
    grpcurl

    # Protobuf generators
    protoc-gen-prost-crate
    protoc-gen-prost-serde
    protoc-gen-tonic
    protoc-gen-prost

    # torad VPN mode (--wireguard-config): pasta creates the unprivileged
    # namespace, wireguard-go is the userspace datapath, `ip` configures the
    # tunnel. See tora/devenv.nix for why wireguard-tools is not needed.
    passt
    wireguard-go
    iproute2

    opencode
  ];

  services.postgres = {
    enable = true;
    initialDatabases = [
      {
        name = "music_agregator";
        schema = ./db/schema.sql;
      }
    ];
  };

  # torad downloads into dev/downloads/<torrent_name>/ and moves finished
  # torrents to dev/downloads/completed/<torrent_name>/ on completion.
  # musicfs scans only the completed/ subtree so it never sees partially
  # written files.
  processes.torad.exec = lib.mkForce ''
    mkdir -p "$PWD/dev/downloads"
    ${config.outputs.torad}/bin/torad \
      --socket "$TORAD_SOCKET" \
      --pid-file "$TORAD_PID_FILE" \
      --download-dir "$PWD/dev/downloads"
  '';

  processes.musicfs.exec = lib.mkForce ''
    mkdir -p "$PWD/dev/downloads/completed" /tmp/dev-music
    ${config.outputs.musicfs}/bin/musicfs \
      --source "$PWD/dev/downloads/completed" \
      --mountpoint /tmp/dev-music \
      --database "postgresql://fujin@localhost/musicfs?host=$PGHOST"
  '';
}