{
  pkgs,
  ...
}:

{
  systemd.services.vps1-tunnel = {
    enable = true;
    description = "vps1.mesh.vimium.net SSH tunnel";
    after = [
      "network-online.target"
      "jellyfin.service"
    ];
    wants = [ "network-online.target" ];
    serviceConfig = {
      Type = "simple";
      ExecStart = pkgs.lib.mkForce ''
        ${pkgs.openssh}/bin/ssh \
          -NT \
          -o ExitOnForwardFailure=yes \
          -o ServerAliveInterval=60 \
          -o TCPKeepAlive=no \
          -i %h/.ssh/id_jellyfin \
          -R localhost:8000:localhost:8000 \
          -R localhost:8001:localhost:8001 \
          jellyfin@vps1.mesh.vimium.net
      '';
      Restart = "always";
      RestartSec = 20;
    };
    wantedBy = [ "default.target" ];
  };
}