{
  config,
  lib,
  pkgs,
  ...
}:
with lib; let
  cfg = config.nixarr;

  # Helper to determine if an exporter should be enabled
  shouldEnableExporter = service:
    cfg.${service}.enable
    && (cfg.${service}.exporter.enable == null || cfg.${service}.exporter.enable);
in {
  imports = [../lib/api-keys.nix];

  options = {
    nixarr = {
      exporters = {
        enable = mkEnableOption "Enable Prometheus exporters for all supported nixarr services";
      };

      sonarr.exporter = {
        enable = mkOption {
          type = types.nullOr types.bool;
          default = null;
          description = ''
            Whether to enable the Sonarr Prometheus exporter.
            - null: enable if exporters.enable is true and sonarr service is enabled (default)
            - true: force enable if exporters.enable is true
            - false: always disable
          '';
        };
        port = mkOption {
          type = types.port;
          default = 9707;
          description = "Port for Sonarr metrics";
        };
        listenAddr = mkOption {
          type = types.str;
          default = "0.0.0.0";
          description = ''
            Address for Sonarr exporter to listen on.
          '';
        };
      };
      radarr.exporter = {
        enable = mkOption {
          type = types.nullOr types.bool;
          default = null;
          description = ''
            Whether to enable the Radarr Prometheus exporter.
            - null: enable if exporters.enable is true and radarr service is enabled (default)
            - true: force enable if exporters.enable is true
            - false: always disable
          '';
        };
        port = mkOption {
          type = types.port;
          default = 9708;
          description = "Port for Radarr metrics";
        };
        listenAddr = mkOption {
          type = types.str;
          default = "0.0.0.0";
          description = ''
            Address for Radarr exporter to listen on.
          '';
        };
      };
      lidarr.exporter = {
        enable = mkOption {
          type = types.nullOr types.bool;
          default = null;
          description = ''
            Whether to enable the Lidarr Prometheus exporter.
            - null: enable if exporters.enable is true and lidarr service is enabled (default)
            - true: force enable if exporters.enable is true
            - false: always disable
          '';
        };
        port = mkOption {
          type = types.port;
          default = 9709;
          description = "Port for Lidarr metrics";
        };
        listenAddr = mkOption {
          type = types.str;
          default = "0.0.0.0";
          description = ''
            Address for Lidarr exporter to listen on.
          '';
        };
      };
      readarr.exporter = {
        enable = mkOption {
          type = types.nullOr types.bool;
          default = null;
          description = ''
            Whether to enable the Readarr Prometheus exporter.
            - null: enable if exporters.enable is true and readarr service is enabled (default)
            - true: force enable if exporters.enable is true
            - false: always disable
          '';
        };
        port = mkOption {
          type = types.port;
          default = 9710;
          description = "Port for Readarr metrics";
        };
        listenAddr = mkOption {
          type = types.str;
          default = "0.0.0.0";
          description = ''
            Address for Readarr exporter to listen on.
          '';
        };
      };
      prowlarr.exporter = {
        enable = mkOption {
          type = types.nullOr types.bool;
          default = null;
          description = ''
            Whether to enable the Prowlarr Prometheus exporter.
            - null: enable if exporters.enable is true and prowlarr service is enabled (default)
            - true: force enable if exporters.enable is true
            - false: always disable
          '';
        };
        port = mkOption {
          type = types.port;
          default = 9711;
          description = "Port for Prowlarr metrics";
        };
        listenAddr = mkOption {
          type = types.str;
          default = "0.0.0.0";
          description = ''
            Address for Prowlarr exporter to listen on.
          '';
        };
      };
      bazarr.exporter = {
        enable = mkOption {
          type = types.nullOr types.bool;
          default = null;
          description = ''
            Whether to enable the Bazarr Prometheus exporter.
            - null: enable if exporters.enable is true and bazarr service is enabled (default)
            - true: force enable if exporters.enable is true
            - false: always disable
          '';
        };
        port = mkOption {
          type = types.port;
          default = 9712;
          description = "Port for Bazarr metrics";
        };
        listenAddr = mkOption {
          type = types.str;
          default = "0.0.0.0";
          description = ''
            Address for Bazarr exporter to listen on.
          '';
        };
      };
    };
  };

  config = mkIf (cfg.enable && cfg.exporters.enable) {
    # Configure Prometheus exporters
    services.prometheus = {
      exporters = {
        # Enable exportarr for each supported service if it's enabled
        exportarr-sonarr = mkIf (shouldEnableExporter "sonarr") {
          enable = true;
          url = "http://127.0.0.1:8989";
          apiKeyFile = "${cfg.stateDir}/api-keys/sonarr.key";
          port = cfg.sonarr.exporter.port;
          listenAddress = cfg.sonarr.exporter.listenAddr;
          openFirewall = true;
        };

        exportarr-radarr = mkIf (shouldEnableExporter "radarr") {
          enable = true;
          url = "http://127.0.0.1:7878";
          apiKeyFile = "${cfg.stateDir}/api-keys/radarr.key";
          port = cfg.radarr.exporter.port;
          listenAddress = cfg.radarr.exporter.listenAddr;
          openFirewall = true;
        };

        exportarr-lidarr = mkIf (shouldEnableExporter "lidarr") {
          enable = true;
          url = "http://127.0.0.1:8686";
          apiKeyFile = "${cfg.stateDir}/api-keys/lidarr.key";
          port = cfg.lidarr.exporter.port;
          listenAddress = cfg.lidarr.exporter.listenAddr;
          openFirewall = true;
        };

        exportarr-readarr = mkIf (shouldEnableExporter "readarr") {
          enable = true;
          url = "http://127.0.0.1:8787";
          apiKeyFile = "${cfg.stateDir}/api-keys/readarr.key";
          port = cfg.readarr.exporter.port;
          listenAddress = cfg.readarr.exporter.listenAddr;
          openFirewall = true;
        };

        exportarr-prowlarr = mkIf (shouldEnableExporter "prowlarr") {
          enable = true;
          url = "http://127.0.0.1:9696";
          apiKeyFile = "${cfg.stateDir}/api-keys/prowlarr.key";
          port = cfg.prowlarr.exporter.port;
          listenAddress = cfg.prowlarr.exporter.listenAddr;
          openFirewall = true;
        };

        # exportarr-bazarr = mkIf (shouldEnableExporter "bazarr") {
        #   enable = true;
        #   url = "http://127.0.0.1:6767";
        #   apiKeyFile = "${cfg.stateDir}/api-keys/bazarr.key";
        #   port = cfg.bazarr.exporter.port; # 9712;
        #   openFirewall = true;
        # };
      };
    };

    # Add systemd services for VPN-confined exporters
    systemd.services = mkMerge [
      {
        "prometheus-exportarr-sonarr-exporter" = mkIf (shouldEnableExporter "sonarr") {
          after = ["sonarr-api-key.service"];
          requires = ["sonarr-api-key.service"];
          serviceConfig.SupplementaryGroups = ["sonarr-api"];
        };
        "prometheus-exportarr-radarr-exporter" = mkIf (shouldEnableExporter "radarr") {
          after = ["radarr-api-key.service"];
          requires = ["radarr-api-key.service"];
          serviceConfig.SupplementaryGroups = ["radarr-api"];
        };
        "prometheus-exportarr-lidarr-exporter" = mkIf (shouldEnableExporter "lidarr") {
          after = ["lidarr-api-key.service"];
          requires = ["lidarr-api-key.service"];
          serviceConfig.SupplementaryGroups = ["lidarr-api"];
        };
        "prometheus-exportarr-readarr-exporter" = mkIf (shouldEnableExporter "readarr") {
          after = ["readarr-api-key.service"];
          requires = ["readarr-api-key.service"];
          serviceConfig.SupplementaryGroups = ["readarr-api"];
        };
        "prometheus-exportarr-prowlarr-exporter" = mkIf (shouldEnableExporter "prowlarr") {
          after = ["prowlarr-api-key.service"];
          requires = ["prowlarr-api-key.service"];
          serviceConfig.SupplementaryGroups = ["prowlarr-api"];
        };
        # "prometheus-exportarr-bazarr-exporter" = mkIf (shouldEnableExporter "bazarr") {
        #   after = ["bazarr-api-key.service"];
        #   requires = ["bazarr-api-key.service"];
        #   serviceConfig.SupplementaryGroups = ["bazarr-api"];
        # };
      }
    ];
  };
}