diff --git a/configurations/camelot/jellyfin.nix b/configurations/camelot/jellyfin.nix
index a7deadb..3b5b92e 100644
--- a/configurations/camelot/jellyfin.nix
+++ b/configurations/camelot/jellyfin.nix
@@ -1,5 +1,6 @@
 { extraInfo, pkgs, ... }:
 {
+  users.groups.media = { };
   services.jellyfin.enable = true;
   services.nginx.virtualHosts.${extraInfo.jellyfinURI} = {
     enableACME = true;
@@ -20,23 +21,32 @@
   services.sonarr = {
     enable = true;
     openFirewall = true;
+    group = "media";
   };
 
   services.radarr = {
     enable = true;
     openFirewall = true;
+    group = "media";
+  };
+
+  services.bazarr = {
+    enable = true;
+    openFirewall = true;
+    group = "media";
   };
 
   # Torrent client
   services.deluge = {
     enable = true;
     web.enable = true;
+    group = "media";
   };
 
   systemd.services.deluged.bindsTo = [ "wireguard-wg1.service" ];
   systemd.services.deluged.requires = [ "network-online.target" ];
   systemd.services.deluged.serviceConfig.NetworkNamespacePath = "/var/run/netns/wg1ns";
-  systemd.services.deluged.serviceConfig.PrivateNetwork = false;
+  systemd.services.deluged.serviceConfig.PrivateNetwork = true;
 
   systemd.sockets.deluged-proxy = {
     description = "Socket for deluge-web to deluged in network namespace";