{ flake, config, lib, ... }:
let caskPresent = cask: builtins.elem cask config.homebrew.casks;
in {
  # https://docs.brew.sh/Shell-Completion#configuring-completions-in-fish
  # for some reason if the Fish completions are added at the end of `fish_complete_path` they don't
  # seem to work, but they do work if added at the start.
  programs.fish.interactiveShellInit = ''
    if test -d (brew --prefix)"/share/fish/completions"
      set -p fish_complete_path (brew --prefix)/share/fish/completions
    end
    if test -d (brew --prefix)"/share/fish/vendor_completions.d"
      set -p fish_complete_path (brew --prefix)/share/fish/vendor_completions.d
    end
  '';

  homebrew.enable = flake.inputs.homebrew-enabled.value;
  homebrew.onActivation.autoUpdate = true;
  homebrew.onActivation.upgrade = true;
  homebrew.onActivation.cleanup = "uninstall";
  homebrew.global.brewfile = true;

  homebrew.taps = [ "homebrew/cask-versions" "homebrew/services" ];

  homebrew.masApps = {
    Bitwarden = 1352778147;
    "Draw Things" = 6444050820;
    GrandPerspective = 1111570163;
    Reeder = 1529448980;
    Tailscale = 1475387142;
    Xcode = 497799835;
  };

  homebrew.caskArgs.no_quarantine = true;
  homebrew.casks = [
    # system tools
    "alfred"
    # "bartender" -> dozer
    "dozer"
    "itsycal"
    "knockknock"
    "lulu"
    "protonvpn"
    # "rectangle" -> yabai
    "secretive"
    "shortcat"
    "stay"
    "utm"
    "yabai"

    # "tools for thought"
    "anytype"

    # design
    "krita"
    "macsvg"

    # browsers
    "arc"
    "firefox"
    "orion"

    # messaging apps
    "signal"

    # editors and IDEs
    "lapce"
    "zed"

    # terminal emulators
    "warp"

    # peripheral tools
    "logi-options-plus"
    "qflipper"
    "remarkable"
    "via"
  ];

  # TODO: figure out `brew shellenv` settings
  # environment.variables = {
  #   HOMEBREW_PREFIX = "";
  #   HOMEBREW_CELLAR = "";
  #   HOMEBREW_REPOSITORY = "";
  # };
  # environment.systemPath = [ ];

  # configure ssh to use secretive's agent
  # TODO: move to module?
  home-manager.users.${flake.config.people.me} =
    lib.mkIf (caskPresent "secretive" && config ? home-manager) (let
      socket =
        "${config.home.homeDirectory}/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh";
    in {
      home.sessionVariables.SSH_AUTH_SOCK = socket;
      programs.ssh.matchBlocks = {
        "*".extraOptions = { IdentityAgent = socket; };
      };
    });
}