{
  pkgs,
  lib,
  ...
}:
{
  imports = [
    ./configuration/nix.nix
    ./fonts.nix
  ];
  services.nix-daemon = {
    enableSocketListener = false;
  };

  # with optimisation enabled, macOS has a tendency to report the opaque
  # filenames in /nix/store/.links as the binary when requesting
  # permissions such as incoming network connections
  nix.optimise.automatic = false;

  environment.profiles =
    with lib;
    mkMerge [
      (mkOrder 800 [ "\${XDG_STATE_HOME:-$HOME/.local/state}/nix/profile" ])
      [
        "/run/current-system/sw"
        "/nix/var/nix/profiles/default"
      ]
    ];

  nix = {
    settings.extra-platforms = "aarch64-darwin x86_64-darwin";

    settings.trusted-users = [ "@admin" ];
  };

  nixpkgs.config = {
    allowUnfree = true;
  };

  services.lorri.enable = true;
  launchd.user.agents.lorri-notify = {
    path = with pkgs; [
      gnugrep
      jq
      lorri
      terminal-notifier
    ];
    script =
      let
        jqFile = ''
          (
            (.Started?   | values | ["starting", .nix_file]),
            (.Completed? | values | ["complete", .nix_file]),
            (.Failure?   | values | ["failed", .nix_file])
          )
          | @tsv
        '';
      in
      ''
        set -euo pipefail
        lorri info --shell-file . | grep -q 'Lorri Daemon Status:.*running'
        lorri internal stream-events --kind live \
          | jq --unbuffered -r '${jqFile}' \
          | while IFS=$'\t' read -r status nixFile icon; do
              nixFile=$(dirname ''${nixFile#$HOME/})
              terminal-notifier -group "lorri-$nixFile-$status" -title "Lorri" \
                -subtitle "Build $status" -message "$nixFile" \
                -ignoreDnD
              sh -c "sleep 1 && terminal-notifier -remove \"lorri-$nixFile-$status\""
            done
      '';
    serviceConfig = {
      RunAtLoad = true;
    };
  };

  launchd.daemons.limit-maxfiles = {
    serviceConfig = {
      Label = "limit-maxfiles";
      RunAtLoad = true;
      ProgramArguments = [
        "launchctl"
        "limit"
        "maxfiles"
        "64000"
        "52428"
      ];
    };
  };

  environment.systemPackages = with pkgs; [
    watch
    coreutils-prefixed
    iproute2mac
  ];

  networking.applicationFirewall = {
    enable = true;
    allowSigned = true;
    allowSignedApp = false; # stop socketfilterfw issuing >300GiB disk reads over 16h
  };

  services.dnsmasq = {
    enable = true;
    bind = "::1";
    port = 5553;
    addresses = {
      localhost = "::1";
      test = "::1";
    };
  };

  homebrew = {
    enable = true;
    enableFishIntegration = true;
    casks = [
      "loop"
      "flashspace"
    ];
    brews = [
      {
        name = "HernandoR/zbrew/zbrew";
        postinstall = "\${HOMEBREW_PREFIX}/opt/zbrew/bin/zb init";
        trusted = true;
      }
      "lunchy-go"
    ];
  };

  # Display Wi-Fi network ID and SSID in `ipconfig getsummary en0`
  # For LaunchBar's Speedtest action (uses `networkQuality`)
  system.activationScripts.ipconfig-setverbose.text = ''
    echo "configuring ipconfig verbosity..." > &2
    ipconfig setverbose 1
  '';
}