job "deluge" {
  group "deluge" {
    network {
      mode = "bridge"
      port "http" {
        to = 8112
      }
    }

    task "wireguard" {
      driver = "docker"

      lifecycle {
        hook    = "prestart"
        sidecar = true
      }

      config {
        image      = "thrnz/docker-wireguard-pia:latest"
        privileged = true
        ports      = ["http"]
      }

      env {
        LOC           = "aus_melbourne"
        LOCAL_NETWORK = "192.168.1.0/24"
        # PORT_FORWARDING = "1" # TODO: Find a way to tell deluge the forwarded port, the wireguard container outputs it /pia-shared/port.dat
      }

      template {
        data        = <<EOH
USER="{{ with nomadVar "nomad/jobs/deluge" }}{{ .pia_user }}{{ end }}"
PASS="{{ with nomadVar "nomad/jobs/deluge" }}{{ .pia_pass }}{{ end }}"
EOH
        destination = "secrets/pia.env"
        env         = true # Load the file as environment variables
      }

      resources {
        cpu    = 50
        memory = 32
      }
    }


    # Service for Traefik (external ingress)
    service {
      name = "deluge"
      port = "http"

      tags = [
        "traefik.enable=true",
        "traefik.http.routers.deluge.middlewares=auth@file",
      ]

      check {
        type     = "http"
        path     = "/"
        interval = "10s"
        timeout  = "2s"
      }
    }

    # Service for Consul Connect (internal mesh communication)
    service {
      name         = "deluge-api"
      port         = "http"
      address_mode = "alloc" # Use allocation IP for Connect as the sidecar can't access the host's published port (hairpin/loopback NAT issue)

      # tags = [
      #   "traefik.enable=false",
      # ]

      connect {
        sidecar_service {
          //tags = ["traefik.enable=false"]
        }
      }

      check {
        type     = "http"
        path     = "/"
        interval = "10s"
        timeout  = "2s"
      }
    }

    task "deluge" {
      driver = "docker"

      config {
        image        = "lscr.io/linuxserver/deluge:latest"
        network_mode = "container:wireguard-${NOMAD_ALLOC_ID}" # Share namespace with VPN
      }

      env {
        PUID = "1000"
        PGID = "1000"
        TZ   = "Australia/Melbourne"
      }

      volume_mount {
        volume      = "unraid_appdata_deluge"
        destination = "/config"
        read_only   = false
      }

      volume_mount {
        volume      = "unraid_media_deluge"
        destination = "/data/downloads"
        read_only   = false
      }

      resources {
        cpu        = 400
        memory     = 2048
        memory_max = 3000
      }
    }

    volume "unraid_appdata_deluge" {
      type            = "csi"
      read_only       = false
      source          = "unraid_appdata_deluge"
      access_mode     = "single-node-writer"
      attachment_mode = "file-system"

      mount_options {
        mount_flags = ["uid=1000", "gid=1000"]
      }
    }

    volume "unraid_media_deluge" {
      type            = "csi"
      read_only       = false
      source          = "unraid_media_deluge"
      access_mode     = "single-node-writer"
      attachment_mode = "file-system"

      mount_options {
        mount_flags = ["uid=1000", "gid=1000"]
      }
    }
  }
}