diff --git a/modules/nixos/deluge.nix b/modules/nixos/deluge.nix
new file mode 100644
index 00000000..1b4349ed
--- /dev/null
+++ b/modules/nixos/deluge.nix
@@ -0,0 +1,33 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (lib.options) mkOption;
+  inherit (lib.modules) mkIf mkMerge;
+  cfg = config.services.deluge;
+in {
+  options.services.deluge = with lib.types; {
+    downloadDir = mkOption {
+      type = path;
+      default = cfg.dataDir + "/Downloads";
+    };
+    completedDir = mkOption {
+      type = nullOr path;
+      default = null;
+    };
+  };
+  config = {
+    services.deluge = {
+      config = mkMerge [
+        {
+          download_location = cfg.downloadDir;
+          move_completed = cfg.completedDir != null;
+        }
+        (mkIf (cfg.completedDir != null) {
+          move_completed_path = cfg.completedDir;
+        })
+      ];
+    };
+  };
+}
diff --git a/modules/nixos/jackett.nix b/modules/nixos/jackett.nix
new file mode 100644
index 00000000..c9bad731
--- /dev/null
+++ b/modules/nixos/jackett.nix
@@ -0,0 +1,14 @@
+{
+  lib,
+  ...
+}: let
+  inherit (lib.options) mkOption;
+in {
+  options.services.jackett = with lib.types; {
+    port = mkOption {
+      type = port;
+      default = 9117;
+      readOnly = true;
+    };
+  };
+}
diff --git a/modules/nixos/mediatomb.nix b/modules/nixos/mediatomb.nix
index 53f54749..0e562cff 100644
--- a/modules/nixos/mediatomb.nix
+++ b/modules/nixos/mediatomb.nix
@@ -24,7 +24,7 @@
     };
     config = {
       paths = let
-        paths = map (path: "${config.path}/media/${path}") config.subdirectories;
+        paths = map (path: "${config.path}/${path}") config.subdirectories;
         path = singleton config.path;
       in mkOptionDefault (if config.subdirectories != null then paths else path);
       recursive = mkDefault true;
diff --git a/modules/nixos/radarr.nix b/modules/nixos/radarr.nix
new file mode 100644
index 00000000..3bb13553
--- /dev/null
+++ b/modules/nixos/radarr.nix
@@ -0,0 +1,14 @@
+{
+  lib,
+  ...
+}: let
+  inherit (lib.options) mkOption;
+in {
+  options.services.radarr = with lib.types; {
+    port = mkOption {
+      type = port;
+      default = 7878;
+      readOnly = true;
+    };
+  };
+}
diff --git a/modules/nixos/sonarr.nix b/modules/nixos/sonarr.nix
new file mode 100644
index 00000000..b4d88a78
--- /dev/null
+++ b/modules/nixos/sonarr.nix
@@ -0,0 +1,14 @@
+{
+  lib,
+  ...
+}: let
+  inherit (lib.options) mkOption;
+in {
+  options.services.sonarr = with lib.types; {
+    port = mkOption {
+      type = port;
+      default = 8989;
+      readOnly = true;
+    };
+  };
+}
diff --git a/nixos/access/bazarr.nix b/nixos/access/bazarr.nix
new file mode 100644
index 00000000..49734cb2
--- /dev/null
+++ b/nixos/access/bazarr.nix
@@ -0,0 +1,38 @@
+{
+  config,
+  lib,
+}: let
+  inherit (lib.modules) mkIf mkDefault mkOptionDefault;
+  cfg = config.services.bazarr;
+  access = config.services.nginx.access.bazarr;
+  proxyPass = mkDefault "https://${access.host}:${toString access.port}";
+  locations = {
+    "/" = {
+      inherit proxyPass;
+    };
+  };
+in {
+  options.services.nginx.access.bazarr = with lib.types; {
+    host = mkOption {
+      type = str;
+    };
+    domain = mkOption {
+      type = str;
+      default = "bazarr.${config.networking.domain}";
+    };
+    port = mkOption {
+      type = port;
+    };
+  };
+  config.services.nginx = {
+    access.bazarr = mkIf cfg.enable {
+      host = mkOptionDefault "localhost";
+      port = mkOptionDefault cfg.listenPort;
+    };
+    virtualHosts = {
+      ${access.domain} = {
+        inherit locations;
+      };
+    };
+  };
+}
diff --git a/nixos/access/jackett.nix b/nixos/access/jackett.nix
new file mode 100644
index 00000000..d285ee27
--- /dev/null
+++ b/nixos/access/jackett.nix
@@ -0,0 +1,38 @@
+{
+  config,
+  lib,
+}: let
+  inherit (lib.modules) mkIf mkDefault mkOptionDefault;
+  cfg = config.services.jackett;
+  access = config.services.nginx.access.jackett;
+  proxyPass = mkDefault "https://${access.host}:${toString access.port}";
+  locations = {
+    "/" = {
+      inherit proxyPass;
+    };
+  };
+in {
+  options.services.nginx.access.jackett = with lib.types; {
+    host = mkOption {
+      type = str;
+    };
+    domain = mkOption {
+      type = str;
+      default = "jackett.${config.networking.domain}";
+    };
+    port = mkOption {
+      type = port;
+      default = cfg.port;
+    };
+  };
+  config.services.nginx = {
+    access.jackett = mkIf cfg.enable {
+      host = mkOptionDefault "localhost";
+    };
+    virtualHosts = {
+      ${access.domain} = {
+        inherit locations;
+      };
+    };
+  };
+}
diff --git a/nixos/access/kanidm.nix b/nixos/access/kanidm.nix
index 3e8e2eaa..dff4f928 100644
--- a/nixos/access/kanidm.nix
+++ b/nixos/access/kanidm.nix
@@ -18,7 +18,7 @@ let
     "/" = {
       inherit proxyPass;
     };
-    "=/ca.pem" = {
+    "=/ca.pem" = mkIf cfg.server.unencrypted.enable {
       alias = "${cfg.server.unencrypted.package.ca}";
     };
   };
diff --git a/nixos/access/ombi.nix b/nixos/access/ombi.nix
new file mode 100644
index 00000000..9df495a2
--- /dev/null
+++ b/nixos/access/ombi.nix
@@ -0,0 +1,38 @@
+{
+  config,
+  lib,
+}: let
+  inherit (lib.modules) mkIf mkDefault mkOptionDefault;
+  cfg = config.services.ombi;
+  access = config.services.nginx.access.ombi;
+  proxyPass = mkDefault "https://${access.host}:${toString access.port}";
+  locations = {
+    "/" = {
+      inherit proxyPass;
+    };
+  };
+in {
+  options.services.nginx.access.ombi = with lib.types; {
+    host = mkOption {
+      type = str;
+    };
+    domain = mkOption {
+      type = str;
+      default = "ombi.${config.networking.domain}";
+    };
+    port = mkOption {
+      type = port;
+    };
+  };
+  config.services.nginx = {
+    access.ombi = mkIf cfg.enable {
+      host = mkOptionDefault "localhost";
+      port = mkOptionDefault cfg.port;
+    };
+    virtualHosts = {
+      ${access.domain} = {
+        inherit locations;
+      };
+    };
+  };
+}
diff --git a/nixos/access/radarr.nix b/nixos/access/radarr.nix
new file mode 100644
index 00000000..5bf865c0
--- /dev/null
+++ b/nixos/access/radarr.nix
@@ -0,0 +1,38 @@
+{
+  config,
+  lib,
+}: let
+  inherit (lib.modules) mkIf mkDefault mkOptionDefault;
+  cfg = config.services.radarr;
+  access = config.services.nginx.access.radarr;
+  proxyPass = mkDefault "https://${access.host}:${toString access.port}";
+  locations = {
+    "/" = {
+      inherit proxyPass;
+    };
+  };
+in {
+  options.services.nginx.access.radarr = with lib.types; {
+    host = mkOption {
+      type = str;
+    };
+    domain = mkOption {
+      type = str;
+      default = "radarr.${config.networking.domain}";
+    };
+    port = mkOption {
+      type = port;
+      default = cfg.port;
+    };
+  };
+  config.services.nginx = {
+    access.radarr = mkIf cfg.enable {
+      host = mkOptionDefault "localhost";
+    };
+    virtualHosts = {
+      ${access.domain} = {
+        inherit locations;
+      };
+    };
+  };
+}
diff --git a/nixos/access/sonarr.nix b/nixos/access/sonarr.nix
new file mode 100644
index 00000000..fbb0012d
--- /dev/null
+++ b/nixos/access/sonarr.nix
@@ -0,0 +1,38 @@
+{
+  config,
+  lib,
+}: let
+  inherit (lib.modules) mkIf mkDefault mkOptionDefault;
+  cfg = config.services.sonarr;
+  access = config.services.nginx.access.sonarr;
+  proxyPass = mkDefault "https://${access.host}:${toString access.port}";
+  locations = {
+    "/" = {
+      inherit proxyPass;
+    };
+  };
+in {
+  options.services.nginx.access.sonarr = with lib.types; {
+    host = mkOption {
+      type = str;
+    };
+    domain = mkOption {
+      type = str;
+      default = "sonarr.${config.networking.domain}";
+    };
+    port = mkOption {
+      type = port;
+      default = cfg.port;
+    };
+  };
+  config.services.nginx = {
+    access.sonarr = mkIf cfg.enable {
+      host = mkOptionDefault "localhost";
+    };
+    virtualHosts = {
+      ${access.domain} = {
+        inherit locations;
+      };
+    };
+  };
+}
diff --git a/nixos/access/tautulli.nix b/nixos/access/tautulli.nix
new file mode 100644
index 00000000..11a33da3
--- /dev/null
+++ b/nixos/access/tautulli.nix
@@ -0,0 +1,38 @@
+{
+  config,
+  lib,
+}: let
+  inherit (lib.modules) mkIf mkDefault mkOptionDefault;
+  cfg = config.services.tautulli;
+  access = config.services.nginx.access.tautulli;
+  proxyPass = mkDefault "https://${access.host}:${toString access.port}";
+  locations = {
+    "/" = {
+      inherit proxyPass;
+    };
+  };
+in {
+  options.services.nginx.access.tautulli = with lib.types; {
+    host = mkOption {
+      type = str;
+    };
+    domain = mkOption {
+      type = str;
+      default = "tautulli.${config.networking.domain}";
+    };
+    port = mkOption {
+      type = port;
+    };
+  };
+  config.services.nginx = {
+    access.tautulli = mkIf cfg.enable {
+      host = mkOptionDefault "localhost";
+      port = mkOptionDefault cfg.port;
+    };
+    virtualHosts = {
+      ${access.domain} = {
+        inherit locations;
+      };
+    };
+  };
+}
diff --git a/nixos/bazarr.nix b/nixos/bazarr.nix
index 97a9528b..d3a94eef 100644
--- a/nixos/bazarr.nix
+++ b/nixos/bazarr.nix
@@ -1,12 +1,11 @@
-{config, ...}: {
-  services = {
-    bazarr = {
-      enable = true;
-      listenPort = 6767;
-    };
-
-    nginx.virtualHosts."bazarr.gensokyo.zone" = {
-      locations."/".proxyPass = "http://localhost:${toString config.services.bazarr.listenPort}";
-    };
+{
+  lib,
+  ...
+}: let
+  inherit (lib.modules) mkDefault;
+in {
+  services.bazarr = {
+    enable = mkDefault true;
+    listenPort = mkDefault 6767;
   };
 }
diff --git a/nixos/deluge.nix b/nixos/deluge.nix
index 36c77c44..b8e51344 100644
--- a/nixos/deluge.nix
+++ b/nixos/deluge.nix
@@ -17,7 +17,7 @@ in {
     declarative = mkDefault true;
     openFirewall = mkDefault true;
     web = {
-      enable = true;
+      enable = mkDefault true;
     };
     config = {
       max_upload_speed = 10.0;
@@ -27,7 +27,7 @@ in {
       max_active_limit = 100;
       max_active_downloading = 75;
       max_upload_slots_global = 25;
-      max_active_seeding = 1;
+      max_active_seeding = 8;
       allow_remote = true;
       daemon_port = 58846;
       listen_ports = [6881 6889];
@@ -37,24 +37,24 @@ in {
   };
 
   services.mediatomb.mediaDirectories = let
-    downloadLocation = cfg.config.download_location or (cfg.dataDir + "/Downloads");
-    parent = builtins.dirOf downloadLocation;
-    hasCompletedSubdir = cfg.config.move_completed or false && hasPrefix parent cfg.config.move_completed_path;
-    completedSubdir = removePrefix parent cfg.config.move_completed_path;
-    downloadDir = if hasCompletedSubdir then {
+    inherit (cfg) downloadDir completedDir;
+    parent = builtins.dirOf downloadDir;
+    hasCompletedSubdir = completedDir != null && hasPrefix parent completedDir;
+    completedSubdir = removePrefix parent completedDir;
+    download = if hasCompletedSubdir then {
       path = parent;
       subdirectories = [
-        (builtins.baseNameOf downloadLocation)
+        (builtins.baseNameOf downloadDir)
         completedSubdir
       ];
     } else {
-      path = downloadLocation;
+      path = downloadDir;
     };
-    completedDir = {
+    completed = {
       path = cfg.config.move_completed_path;
     };
   in mkIf cfg.enable (mkAfter [
-    downloadDir
-    (mkIf (cfg.config.move_completed or false && !hasCompletedSubdir) completedDir)
+    download
+    (mkIf (completedDir != null && !hasCompletedSubdir) completed)
   ]);
 }
diff --git a/nixos/jackett.nix b/nixos/jackett.nix
index ddc1ebb7..b5101591 100644
--- a/nixos/jackett.nix
+++ b/nixos/jackett.nix
@@ -1,11 +1,5 @@
 _: {
-  services = {
-    jackett = {
-      enable = true;
-    };
-    nginx.virtualHosts."jackett.gensokyo.zone" = {
-      locations."/".proxyPass = "http://localhost:9117/";
-    };
+  services.jackett = {
+    enable = true;
   };
-  # Port 9117
 }
diff --git a/nixos/ombi.nix b/nixos/ombi.nix
index 09b6d8bf..8b0956c3 100644
--- a/nixos/ombi.nix
+++ b/nixos/ombi.nix
@@ -1,11 +1,11 @@
-{config, ...}: {
-  services = {
-    ombi = {
-      enable = true;
-      port = 5000;
-    };
-    nginx.virtualHosts."ombi.gensokyo.zone" = {
-      locations."/".proxyPass = "http://localhost:${toString config.services.ombi.port}";
-    };
+{
+  lib,
+  ...
+}: let
+  inherit (lib.modules) mkDefault;
+in {
+  services.ombi = {
+    enable = mkDefault true;
+    port = mkDefault 5000;
   };
 }
diff --git a/nixos/radarr.nix b/nixos/radarr.nix
index a5eda25d..462c44e2 100644
--- a/nixos/radarr.nix
+++ b/nixos/radarr.nix
@@ -1,12 +1,5 @@
 _: {
-  services = {
-    radarr = {
-      enable = true;
-    };
-    nginx.virtualHosts."radarr.gensokyo.zone" = {
-      locations."/".proxyPass = "http://localhost:7878";
-    };
+  services.radarr = {
+    enable = true;
   };
-
-  # Port 7878
 }
diff --git a/nixos/sonarr.nix b/nixos/sonarr.nix
index 2db3f4a4..30bd2848 100644
--- a/nixos/sonarr.nix
+++ b/nixos/sonarr.nix
@@ -1,13 +1,5 @@
 _: {
-  services = {
-    sonarr = {
-      enable = true;
-    };
-
-    nginx.virtualHosts."sonarr.gensokyo.zone" = {
-      locations."/".proxyPass = "http://localhost:8989";
-    };
+  services.sonarr = {
+    enable = true;
   };
-
-  # Port 8989
 }
diff --git a/nixos/tautulli.nix b/nixos/tautulli.nix
index 81258659..fcdaad15 100644
--- a/nixos/tautulli.nix
+++ b/nixos/tautulli.nix
@@ -1,20 +1,8 @@
-{config, lib, ...}: let
-  inherit (lib.modules) mkIf;
-  cfg = config.services.tautulli;
+{lib, ...}: let
+  inherit (lib.modules) mkDefault;
 in {
-  services = {
-    tautulli = {
-      enable = true;
-      port = 8181;
-    };
-
-    nginx.virtualHosts = {
-      "tautulli.${config.networking.domain}" = {
-        locations."/".proxyPass = "http://localhost:${toString cfg.port}";
-      };
-      "tautulli.local.${config.networking.domain}" = mkIf cfg.openFirewall {
-        locations."/".proxyPass = "http://localhost:${toString cfg.port}";
-      };
-    };
+  services.tautulli = {
+    enable = mkDefault true;
+    port = mkDefault 8181;
   };
 }
diff --git a/systems/mediabox/nixos.nix b/systems/mediabox/nixos.nix
index d78fb7c9..4c9990d8 100644
--- a/systems/mediabox/nixos.nix
+++ b/systems/mediabox/nixos.nix
@@ -4,8 +4,23 @@
   lib,
   pkgs,
   ...
-}: {
-  imports = with meta; [
+}: let
+  inherit (lib.modules) mkIf mkMerge;
+  inherit (lib.attrsets) mapAttrs mapAttrsToList;
+  inherit (lib.strings) removePrefix;
+  inherit (config.services) deluge plex tautulli ombi sonarr radarr bazarr jackett cloudflared;
+  kyuuto = "/mnt/kyuuto-media";
+  kyuuto-library = kyuuto + "/library";
+  plexLibrary = {
+    "/mnt/Anime".hostPath = kyuuto-library + "/anime";
+    "/mnt/Shows".hostPath = kyuuto-library + "/tv";
+    "/mnt/Movies".hostPath = kyuuto-library + "/movies";
+    "/mnt/Music".hostPath = kyuuto-library + "/music";
+  };
+in {
+  imports = let
+    inherit (meta) nixos;
+  in [
     nixos.reisen-ct
     nixos.sops
     nixos.nginx
@@ -27,7 +42,7 @@
   ];
 
   sops.secrets.cloudflare_mediabox_tunnel = {
-    owner = config.services.cloudflared.user;
+    owner = cloudflared.user;
   };
 
   services.cloudflared = let
@@ -37,33 +52,34 @@
       default = "http_status:404";
       credentialsFile = config.sops.secrets.cloudflare_mediabox_tunnel.path;
       ingress = {
-        "tautulli.gensokyo.zone".service = "http://localhost:${toString config.services.tautulli.port}";
-        "ombi.gensokyo.zone".service = "http://localhost:${toString config.services.ombi.port}";
-        "sonarr.gensokyo.zone".service = "http://localhost:8989";
-        "radarr.gensokyo.zone".service = "http://localhost:7878";
-        "bazarr.gensokyo.zone".service = "http://localhost:6767";
-        "jackett.gensokyo.zone".service = "http://localhost:9117";
-        "deluge.gensokyo.zone".service = "http://localhost:${toString config.services.deluge.web.port}";
+        "tautulli.gensokyo.zone".service = "http://localhost:${toString tautulli.port}";
+        "ombi.gensokyo.zone".service = "http://localhost:${toString ombi.port}";
+        "sonarr.gensokyo.zone".service = "http://localhost:${toString sonarr.port}";
+        "radarr.gensokyo.zone".service = "http://localhost:${toString radarr.port}";
+        "bazarr.gensokyo.zone".service = "http://localhost:${toString bazarr.listenPort}";
+        "jackett.gensokyo.zone".service = "http://localhost:${toString jackett.port}";
+        "deluge.gensokyo.zone".service = "http://localhost:${toString deluge.web.port}";
       };
     };
   };
 
   services.mediatomb = {
     serverName = "tewi";
-    mediaDirectories = [
-      rec {
-        path = "/mnt/Anime";
-        mountPoint = path;
-      }
-      rec {
-        path = "/mnt/Shows";
-        mountPoint = path;
-      }
-      rec {
-        path = "/mnt/Movies";
-        mountPoint = path;
-      }
-    ];
+    mediaDirectories = let
+      mkLibraryDir = dir: {
+        path = kyuuto-library + "/${dir}";
+        mountPoint = kyuuto-library;
+      };
+      libraryDir = {
+        path = kyuuto-library;
+        mountPoint = kyuuto-library;
+        subdirectories =
+          mapAttrsToList (_: { hostPath, ... }:
+            removePrefix "${kyuuto-library}/" hostPath
+          ) plexLibrary
+          ++ [ "tlmc" "music-raw" ];
+      };
+    in [ libraryDir ] ++ map mkLibraryDir [ "tlmc" "music-raw" "lewd" ];
   };
 
   hardware.opengl = {
@@ -71,6 +87,36 @@
     extraPackages = with pkgs; [ mesa.drivers vaapiVdpau libvdpau-va-gl ];
   };
 
+  fileSystems = let
+    bind = {
+      fsType = "none";
+      options = [ "bind" "nofail" ];
+    };
+    fsPlex = mapAttrs (_: { hostPath, ... }: mkMerge [
+      bind
+      {
+        device = hostPath;
+      }
+    ]) plexLibrary;
+    fsDeluge = {
+      "${deluge.downloadDir}" = mkIf deluge.enable (mkMerge [ bind {
+        device = kyuuto + "/downloads/deluge/download";
+      } ]);
+    };
+  in mkMerge [
+    fsPlex
+    (mkIf deluge.enable fsDeluge)
+  ];
+
+  systemd.services.deluged = mkIf deluge.enable {
+    unitConfig.RequiresMountsFor = [
+      "${deluge.downloadDir}"
+    ];
+  };
+  systemd.services.plex = mkIf plex.enable {
+    unitConfig.RequiresMountsFor = mapAttrsToList (path: _: path) plexLibrary;
+  };
+
   systemd.network.networks.eth0 = {
     name = "eth0";
     matchConfig = {