{
  config,
  lib,
  pkgs,
  ...
}:
lib.mkIf config.services.xmrig.enable {
  systemd.services.xmrig-auto-pause = {
    description = "Auto-pause xmrig when other services need CPU";
    after = [ "xmrig.service" ];
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      ExecStart = "${pkgs.python3}/bin/python3 ${./xmrig-auto-pause.py}";
      Restart = "always";
      RestartSec = "10s";
      NoNewPrivileges = true;
      ProtectHome = true;
      ProtectSystem = "strict";
      PrivateTmp = true;
      RestrictAddressFamilies = [
        "AF_UNIX" # systemctl talks to systemd over D-Bus unix socket
      ];
      MemoryDenyWriteExecute = true;
      StateDirectory = "xmrig-auto-pause";
    };
    environment = {
      POLL_INTERVAL = "3";
      GRACE_PERIOD = "15";
      # This server's background services (qbittorrent, monero, bazarr, etc.)
      # produce 5-14% non-nice CPU during normal operation. Thresholds must
      # sit above that noise floor.
      CPU_STOP_THRESHOLD = "40";
      CPU_RESUME_THRESHOLD = "30";
      STARTUP_COOLDOWN = "10";
      STATE_DIR = "/var/lib/xmrig-auto-pause";
    };
  };
}