{
  pkgs,
  config,
  lib,
  ...
}:
with lib;
mkIf (elem "kodi" config.machine.services) {
  users.extraUsers.kodi.isNormalUser = true;
  services.cage = {
    enable = true;
    user = "kodi";
    program =
      let
        kodi = pkgs.kodi-wayland.withPackages (
          kodiPackages: with kodiPackages; [
            netflix
            sponsorblock
            vfs-libarchive
            vfs-rar
            vfs-sftp
            youtube
          ]
        );
      in
      "${kodi}/bin/kodi-standalone";
  };
  # allow remote control
  networking.firewall = {
    allowedTCPPorts = [ 8080 ];
    allowedUDPPorts = [ 8080 ];
  };
}