{
  pkgs,
  lib,
  ...
}:
let
  kb = 1000;
  mb = 1000 * kb;
  gb = 1000 * mb;
in
{
  nix = {
    package = pkgs.lix;
    settings = {
      cores = lib.mkDefault 0;
      use-xdg-base-directories = true;
      keep-outputs = true;
      warn-dirty = false;

      # https://jackson.dev/post/nix-reasonable-defaults/
      connect-timeout = 5;
      min-free = 128 * mb;
      max-free = 1 * gb;
      fallback = true;

      trusted-substituters = [
        "https://nix-community.cachix.org"
        "https://cache.lix.systems"
        "https://binarycache.alin.ovh"
      ];
      trusted-public-keys = [
        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
        "binarycache.alin.ovh:ZwqO3XMuajPictjwih8OY2+RXnOKpjZEZFHJjGSxAI4="
        "cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o="
      ];

      experimental-features = [
        "nix-command"
        "flakes"
      ];
    };

    gc = {
      automatic = lib.mkDefault true;
      options = lib.mkDefault "--delete-older-than 14d";
    };
  };

  services.angrr = {
    enable = true;
    period = "30d";
    ownedOnly = false;
  };
}