job "prowlarr" {
  group "prowlarr" {
    network {
      mode = "bridge"
      port "http" {
        to = 9696
      }
    }

    service {
      connect {
        sidecar_service {
          proxy {
            upstreams {
              destination_name = "postgres"
              local_bind_port  = 5432
            }
            upstreams {
              destination_name = "sonarr-api"
              local_bind_port  = 8989
            }
          }
        }
      }
    }

    service {
      name = "prowlarr"
      port = "http"

      tags = [
        "traefik.enable=true",
        "traefik.http.routers.prowlarr.middlewares=auth@file",
      ]

      check {
        type     = "http"
        path     = "/"
        interval = "10s"
        timeout  = "2s"
      }
    }

    service {
      name         = "prowlarr-api"
      port         = "http"
      address_mode = "alloc" # Use allocation IP for Connect as the sidecar can't access the host's published port (hairpin/loopback NAT issue)

      connect {
        sidecar_service {}
      }

      check {
        type     = "http"
        path     = "/"
        interval = "10s"
        timeout  = "2s"
      }
    }

    task "prowlarr" {
      driver = "docker"

      config {
        image = "lscr.io/linuxserver/prowlarr:latest"
        ports = ["http"]
      }

      env {
        PUID = 1000
        PGID = 1000
        TZ   = "Australia/Melbourne"

        # https://wiki.servarr.com/prowlarr/postgres-setup

        # Disable internal auth to use Traefik + Authelia
        PROWLARR__AUTH__REQUIRED = "Enabled"
        PROWLARR__AUTH__METHOD   = "External"

        PROWLARR__POSTGRES__USER   = "prowlarr"
        PROWLARR__POSTGRES__HOST   = "localhost"
        PROWLARR__POSTGRES__PORT   = "5432"
        PROWLARR__POSTGRES__MAINDB = "prowlarr-main"
        PROWLARR__POSTGRES__LOGDB  = "prowlarr-log"
      }

      volume_mount {
        volume      = "unraid_appdata_prowlarr"
        destination = "/config"
        read_only   = false
      }

      resources {
        cpu    = 150
        memory = 512
      }

      template {
        data        = <<EOH
PROWLARR__POSTGRES__PASSWORD="{{ with nomadVar "nomad/jobs/prowlarr" }}{{ .database_pw }}{{ end }}"
EOH
        destination = "secrets/db.env"
        env         = true # Load the file as environment variables
      }
    }

    volume "unraid_appdata_prowlarr" {
      type            = "csi"
      read_only       = false
      source          = "unraid_appdata_prowlarr"
      access_mode     = "single-node-writer"
      attachment_mode = "file-system"

      mount_options {
        mount_flags = ["uid=1000", "gid=1000"]
      }
    }
  }
}