{ ... }:
{
  _class = "clan.service";
  manifest.name = "pulse-stream";
  manifest.description = "stream audio to attached speakers";
  manifest.categories = [ "System" ];

  roles.default = {
    interface =
      { lib, ... }:
      {
        options.client-ip-ranges = lib.mkOption {
          type = lib.types.listOf lib.types.str;
          description = "ip subnets permitted to stream to the server";
          default = [ ];
        };
      };
    perInstance =
      {
        roles,
        settings,
        ...
      }:
      {
        nixosModule =
          { ... }:
          {
            services.pulseaudio = {
              enable = true;
              systemWide = true;
              tcp = {
                enable = true;
                anonymousClients.allowedIpRanges = settings.client-ip-ranges;
                anonymousClients.allowAll = true;
              };
              zeroconf.publish.enable = true;
            };
            networking.firewall.allowedTCPPorts = [ 4713 ];
          };
      };
  };
}