{
  config,
  pkgs,
  lib,
  ...
}: let
  inherit (lib) mkIf mkEnableOption getExe;
  cfg = config.desktop.niri;
in {
  options = {
    desktop.niri.enable =
      mkEnableOption "enable niri desktop";
  };
  config = mkIf cfg.enable {
    sound.pipewire.enable = true;
    programs.niri.enable = true; # wayland compositor in rust
    environment.systemPackages = with pkgs; [
      brightnessctl
      gcr_4
    ];
    fonts.fontDir.enable = true;
    security.pam = {
      services.gtklock = {};
      loginLimits = [
        {
          domain = "@users";
          item = "rtprio";
          type = "-";
          value = 1;
        }
      ];
    };
    services = {
      gnome.gnome-keyring.enable = true;
      udisks2.enable = true;
      dbus = {
        apparmor = "enabled";
        implementation = "broker";
      };
    };
    programs = {
      dconf.enable = true;
      seahorse.enable = true;
    };
    xdg.portal = {
      enable = true;
      extraPortals = with pkgs; [
        xdg-desktop-portal-gnome
        xdg-desktop-portal-gtk
      ];
      config.common = {
        default = ["gnome" "gtk"];
        "org.freedesktop.impl.portal.Secret" = ["gnome-keyring"];
      };
    };
    programs.regreet.enable = true;
    services.greetd = {
      enable = true;
      vt = 6;
      settings = {
        default_session = {
          command = "${pkgs.cage}/bin/cage -s -m last -- ${getExe pkgs.greetd.regreet}";
        };
        initial_session = {
          user = "user";
          command = "${pkgs.niri}/bin/niri-session";
        };
      };
    };
  };
}