{ pkgs, inputs, ... }:
let
  pittUsername = "amm503";
  portal = "portal-palo.pitt.edu";

  # Backup CLI: run `pitt-vpn` to connect via openconnect (extra args forwarded).
  # openconnect needs root to create the tun device, hence sudo.
  pitt-vpn = pkgs.writeShellScriptBin "pitt-vpn" ''
    exec sudo ${pkgs.openconnect}/bin/openconnect \
      --protocol=gp \
      --user=${pittUsername} \
      ${portal} "$@"
  '';
in
{
  home.packages = [
    inputs.globalprotect-openconnect.packages.${pkgs.stdenv.hostPlatform.system}.default
    pkgs.openconnect
    pitt-vpn
  ];
}