# roles/thin-client/session/desktop.nix
#
# KDE Plasma 6 on Wayland, SDDM display manager.
# Q6 decisions: Wayland, no autologin, Full-HD uniform monitors.
{
  config,
  lib,
  pkgs,
  ...
}: let
  inherit (lib) mkIf;
  cfg = config.az.tc;
in {
  config = mkIf cfg.enable {
    # Xserver base — required for keyboard config even on Wayland.
    services.xserver.enable = true;

    services.displayManager = {
      sddm = {
        enable = true;
        wayland.enable = true;
        autoNumlock = true;
        settings = {
          Theme = {
            # Branded theme set in branding.nix
            CursorTheme = "breeze_cursors";
          };
          Autologin = {
            # Explicitly disabled — multi-user machine.
            User = "";
            Session = "";
          };
        };
      };
      defaultSession = "plasma";
    };

    services.desktopManager.plasma6 = {
      enable = true;
    };

    # Wayland portal for screen capture (RustDesk + OBS).
    xdg.portal = {
      enable = true;
      extraPortals = [
        pkgs.kdePackages.xdg-desktop-portal-kde
      ];
      config.common.default = ["kde"];
    };

    # PipeWire for audio (RustDesk/OBS/Chrome all consume it).
    security.rtkit.enable = true;

    # German keyboard layout
    services.xserver.xkb = {
      layout = "de";
      variant = "";
      options = "eurosign:e";
    };

    # Essential KDE/PIM utilities users expect
    environment.plasma6.excludePackages = with pkgs.kdePackages; [
      konsole
      elisa
      khelpcenter
    ];

    environment.systemPackages = with pkgs; [
      # Thin-client baseline utilities
      kitty
      ark
      kdePackages.kcalc
      kdePackages.spectacle
      kdePackages.filelight
    ];

    # Firewall UI helper (KDE) — optional but useful for support staff
    # networking.firewall is configured in network/firewall.nix
  };
}