diff --git a/common/constants.nix b/common/constants.nix
index 999696e..5dc64bd 100644
--- a/common/constants.nix
+++ b/common/constants.nix
@@ -26,6 +26,7 @@ with lib; {
     port = mkOption {
       type = types.attrsOf types.port;
       default = {
+        aria2 = 30206;
         conduit = 29800;
         forgejo = 47674;
         headscale = 27327;
diff --git a/common/secrets.yaml b/common/secrets.yaml
index 732fe01..9dfcb81 100644
--- a/common/secrets.yaml
+++ b/common/secrets.yaml
@@ -1,3 +1,4 @@
+aria2: ENC[AES256_GCM,data:wXS/Qgbu3bc9YDwVLCz+EIm8yMl8Un8XPwMv,iv:6j/mRhbA+Ps/8pvfmx0CYH2/iqxcG+roi50Gr6hC3SI=,tag:TK6D/9nmM76ODPH1irbREg==,type:str]
 users:
     macronova:
         password: ENC[AES256_GCM,data:o3WtsW7x9wy+gtl8UiT/s5q7F7Ym4q/CGvTy5Hl6FfvaEhbC/GPHQKVbz0MmRF3WV7Oq3jNxdryxWgXcd+WSCHoThNRIh/B4ZpLePD9Yi7Bf6trEYGWMdQM1Qx9pET7FaEBVOJC8eg+Ca4b/cASo53iuim6wzw==,iv:dbypWZHIXhl1kSnyiqW6R/O4NZb7u0R9X+tYpCKEMw4=,tag:bgCiGaH7EVfu7Sox0vulug==,type:str]
@@ -34,8 +35,8 @@ sops:
             TG5mYWd3MnI5TlZiNXBjb0JJY3BvN0EKUd0ldQPe0/zdHjsmKEUhH7xkpO4nLfd5
             fnTk1jGonJg+t+TqLLg/YYKlcNkgExWaIZ7wrd0RVKXOeC2BtM/wzQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-12-07T05:17:46Z"
-    mac: ENC[AES256_GCM,data:yToqS0DMtXj92+012wkWItDGegJT+3MAIhMfiDkqn2G8AGsNadv6YXpR21Un5ZSZNyw3RGuRTvu5o0OT4ocV6IdJxAtxmZpteC6n4BMbm/NMDWw9LwXlNUrftJ3an4BLLtmPrY8nCa5ZTnMeWs0NI2CwPQmVBLEgHsbIJaK5Ly0=,iv:3xhueBREYHMW6vJWoYrRVcQIXn8yBt5eW4VT5wFEzvo=,tag:9yV3ncwTsa8J8yBv98VxbA==,type:str]
+    lastmodified: "2024-04-12T19:57:18Z"
+    mac: ENC[AES256_GCM,data:UWQjLPmS8B5zcYdYZH/JBvqH1VTkC6shfq464h4HP2BvVfmQHzbXT5OWUC33xuxLit3EuAYfZT2elUuTn0vFKHRyNef2S1jz0bRroPlMvCXGfc1f2XOvtoEApuS88DkyzIBn7l7EAZo+ExDR4uYmzfEdHFgFzSRR2Mns94kUHi4=,iv:mbwITDN5WhFf2NAr9n/T/D01HHfLNnZmF6MLyQDE+mI=,tag:ovjO0x/Bsg3/JSY09mpzow==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.1
diff --git a/linux/nebula/jellyfin.nix b/linux/nebula/jellyfin.nix
index d70eb33..5793791 100644
--- a/linux/nebula/jellyfin.nix
+++ b/linux/nebula/jellyfin.nix
@@ -1,20 +1,39 @@
 { config, ... }:
 
+let
+  const = config.constants;
+  ports = const.port;
+  usr = const.userName;
+in
 {
   hardware.opengl.enable = true;
 
-  services = let const = config.constants; in {
+  services = {
+    aria2 = {
+      enable = true;
+      extraArguments = "--rpc-listen-all";
+      rpcListenPort = ports.aria2;
+      rpcSecretFile = config.sops.secrets.aria2.path;
+    };
     jellyfin = {
       enable = true;
-      user = const.userName;
+      user = usr;
     };
     jellyseerr = {
       enable = true;
-      port = const.port.jellyseerr;
+      port = ports.jellyseerr;
     };
     radarr = {
       enable = true;
-      user = const.userName;
+      user = usr;
+    };
+    sonarr = {
+      enable = true;
+      user = usr;
     };
   };
+
+  sops.secrets.aria2 = { };
+
+  users.users.${usr}.extraGroups = [ config.systemd.services.aria2.serviceConfig.Group ];
 }