{ me, lib, auxiliaryPkgs, ... }:

let
  # todo: move this to a utils package
  capitalize = str:
    with builtins;
    lib.toUpper (substring 0 1 str) + substring 1 (-1) str;

  user = "mel";
in
{
  services.sunshine = {
    enable = true;
    autoStart = true;
    capSysAdmin = true;
    openFirewall = true;

    settings = {
      sunshine_name = capitalize me.name;

      # note: these are the settings for wolfram and it's intel arc b570 gpu
      # in particular, should be adjusted for different setups when used!
      adapter_name = "/dev/dri/renderD128"; # primary card should be located here
      encoder = "vaapi"; # or "qsv" is quicksync is better supported
      av1_mode = 2;

      # no need for encryption since we are going through a secure network anyway
      lan_encryption_mode = 0;
      wan_encryption_mode = 0;
      origin_web_ui_allowed = "wan"; # allow access everywhere
    };

    applications = {
      env = {
        # give sunshine access to binaries (we can install stuff into .local/bin if we want)
        PATH = "$(PATH):/run/current-system/sw/bin:/etc/profiles/per-user/${user}/bin:$(HOME)/.local/bin";
      };

      apps = [
        {
          name = "MoonDeckStream";
          cmd = "${auxiliaryPkgs.moondeck-buddy}/bin/MoonDeckStream";
          exclude-global-prep-cmd = "false";
          elevated = "false";
        }
        # + default applications, desktop, low-res desktop, steam big picture
      ];
    };
  };

  # configuration for moondeck-buddy for a nicer integration with the steam deck

  home-manager.users.${user} =
    { inputs, config, ... }:
    {
      # start moondeck-buddy automatically
      xdg.autostart = {
        enable = true;
        entries = with auxiliaryPkgs; [
          "${moondeck-buddy}/share/applications/MoonDeckBuddy.desktop"
        ];
      };
    };

  networking.firewall.allowedTCPPorts = [ 59999 ]; # port for moondeck-buddy
}