{ config, pkgs, lib, ... }:

{
  # === KVM / QEMU / libvirt — Windows VM for WGU Guardian browser ===

  # Enable KVM — kernel module + group
  boot.kernelModules = [ "kvm-amd" "kvm-intel" ];
  boot.extraModulePackages = [ ];

  # libvirt daemon
  virtualisation.libvirtd = {
    enable = true;
    qemu.swtpm.enable = true;  # TPM emulation (required for Windows 11)
  };

  # User in libvirt group (manages VMs without sudo)
  users.users.sscoble.extraGroups = [ "libvirtd" ];

  environment.systemPackages = with pkgs; [
    # VM manager (GUI — launch from rofi)
    virt-manager
    virt-viewer                     # Spice client (better than virt-manager's built-in)
    spice-gtk                       # Spice protocol (clipboard, USB, audio)

    # Software TPM
    swtpm

    # Guest tools
    spice-vdagent                   # Clipboard sync, auto-resize
  ];

  # Enable Spice USB redirection service
  services.spice-vdagentd.enable = true;

  # Firewall: allow VNC/Spice from localhost only (safe for guest display)
  networking.firewall.allowedTCPPorts = [ ];
  networking.firewall.allowedUDPPorts = [ ];
}