{
  mainUser,
  inputs,
  getFlakePkg',
  lib,
  pkgs,
  config,
  ...
}:
let
  niri = (getFlakePkg' inputs.niri "niri-unstable");
  xwayland-satellite = (getFlakePkg' inputs.niri "xwayland-satellite-unstable");
  inherit (config) rice;
in
{

  imports = [
    inputs.niri.nixosModules.niri
    inputs.niri-tag.nixosModules.niri-tag
    inputs.niri-s76.nixosModules.default
  ];

  user.desktops.niri = {
    enable = true;
    config =
      let
        template = builtins.readFile ./niri.kdl;
        baseConfig =
          with rice;
          lib.replaceStrings
            [
              "%CURSOR%"
              "%ROUNDING%"
              "%GAPS%"
              "%BORDER%"
              "%ACTIVE%"
              "%INACTIVE%"
              "%SATELLITE%"
            ]
            [
              cursor.name
              (toString borders.rounding)
              (toString borders.gaps)
              (toString borders.thickness)
              palette.shortHex.bright.yellow
              palette.shortHex.normal.white
              (lib.getExe xwayland-satellite)
            ]
            template;
      in
      baseConfig;
  };

  user.packages = [
    niri
    xwayland-satellite
  ];

  services.greetd = {
    enable = true;
    restart = false;
    settings =
      let
        session = {
          command =
            let
              niri-session-direct = pkgs.writeShellScript "niri-session-direct" ''
                systemctl --user import-environment
                dbus-update-activation-environment --all
                exec ${lib.getExe niri} --session
              '';
            in
            "${niri-session-direct}";
          user = "${mainUser}";
        };
      in
      {
        default_session = session;
        initial_session = session;
      };
  };

  programs.niri = {
    enable = true;
    package = niri;
  };

  services.niri-tag = {
    enable = true;
    prepopulate = 10;
    strict = true;
    scratchpads = {
      "chrome-listen.lobotomise.me__-Default" = 99;
      "Bitwarden" = 101;
    };
  };

  services.niri-s76-bridge.enable = true;

  # niri runs directly from greetd (session-1.scope), not as a user service
  systemd.user.services.niri.wantedBy = lib.mkForce [ ];
  systemd.user.services.niri.enable = lib.mkForce false;

}