{
  pkgs,
  lib,
  config,
  inputs,
  ...
}: {
  # Define VPN network namespace
  vpnNamespaces.wg0 = {
    enable = true;
    wireguardConfigFile = "${config.age.secrets.wg0.path}";
    accessibleFrom = [
      "10.0.0.0/24"
    ];
    portMappings = [
      {
        from = 9091;
        to = 9091;
      }
    ];
    openVPNPorts = [
      {
        port = 51413;
        protocol = "both";
      }
    ];
  };

  systemd.services.transmission = {
    vpnConfinement = {
      enable = true;
      vpnNamespace = "wg0";
    };

    wants = ["wg0.service"];
    after = ["wg0.service"];
    partOf = ["wg0.service"];
    serviceConfig = {
      Restart = "always";
      RestartSec = 5;
    };
  };

  services.transmission = {
    enable = true;
    settings = {
      "rpc-bind-address" = "0.0.0.0"; # Bind RPC/WebUI to VPN network namespace address
      "rpc-whitelist-enabled" = false;
      "rpc-whitelist" = "10.0.0.*,127.0.0.1";
      download-dir = "/mnt/media/downloads";
      incomplete-dir-enabled = false;
    };
  };

  age.secrets.wg0 = {
    file = ../../secrets/wg0.age;
    path = "/run/secrets/wg0.conf";
  };
}