{
  config,
  lib,
  pkgs,
  ...
}:
let
  hostname = "smrk";
  domain = "alin.ovh";
in
{
  imports = [
    ../settings/configuration/nix-linux.nix
  ];
  system.stateVersion = "25.11";

  time.timeZone = "Europe/Berlin";
  i18n.defaultLocale = "en_GB.UTF-8";

  environment.homeBinInPath = true;
  environment.localBinInPath = true;
  environment.systemPackages = with pkgs; [
    cifs-utils
    lsof
    pdns
    litecli
    knot-dns

    nixpkgs-review
    nix-output-monitor
  ];

  services.openssh = {
    enable = true;
    settings = {
      AcceptEnv = [
        "LANG"
        "LC_*"
        "TERM_PROGRAM"
      ];
    };
  };
  services.sshguard = {
    enable = true;
  };

  programs.htop = {
    enable = true;
    settings = {
      header_margin = 0;
      tree_view = true;
      hide_userland_threads = true;
      hide_kernel_threads = true;
    };
  };

  programs.vim.defaultEditor = false;
  programs.neovim = {
    enable = true;
    defaultEditor = true;
    viAlias = true;
    vimAlias = true;
  };

  networking = {
    hostName = hostname;
    domain = domain;

    nameservers = [
      "2606:4700:4700::1111"
      "2606:4700:4700::1001"
      "1.1.1.1"
      "1.0.0.1"
    ];

    firewall = {
      enable = true;
      allowPing = true;
      pingLimit = "--limit 60/minute --limit-burst 30";
      logRefusedConnections = false;
      allowedTCPPorts = [
        22
        80
        443
      ];
      allowedUDPPorts = [
        443
      ];
      trustedInterfaces = [
        "tailscale0"
      ];
    };
  };

  nix = {
    settings = {
      max-jobs = 4;
    };
    gc = {
      dates = "08:15";
    };
    optimise = {
      automatic = true;
      dates = [ "02:30" ];
    };
  };

  services.tailscale = {
    enable = true;
    openFirewall = true;
    extraUpFlags = [ "--accept-routes" ];
    extraSetFlags = [
      "--advertise-exit-node"
    ];
    useRoutingFeatures = "both";
  };
  users.defaultUserShell = config.programs.fish.package;
  programs.fish = {
    enable = true;
    package = pkgs.fishMinimal;
    interactiveShellInit = ''
      set --universal fish_greeting ""
    '';
  };
  users.users.root = {
    openssh.authorizedKeys.keys = [
      "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHYUyDdw92TNXguAxcmcmZmn/7ECGdRp6ckjxU+5zCw3BCnsS5+xEvHBVnnFdJRoH2XpfMeJjE+fi67zFVhlbn4= root@secretive.marvin"
    ];
  };
  users.users.alin = {
    extraGroups = [
      "wheel"
      "caddy"
      "docker"
      "podman"
      "laminar"
    ];
    isNormalUser = true;
    home = "/home/alin";
    createHome = true;

    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFp1R7ls50vzyCx8pZAwGepQUuos0ogewkIioiW1uMup alin@prefect"
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII8VIII+598QOBxi/52O1Kb19RdUdX0aZmS1/dNoyqc5 alan@hetzner.strongbox"
      "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBENXbdPPOq0mA+9bPklpUkikvIXjCEKE5IRwNPNMr5/Ta1J/ND737fexCjEb7YPoAJtaf0gD/JThQQi/RxDTvy4= alin@alin.ovh"
    ];
  };
  users.users.nixremote = {
    shell = "/bin/sh";
    isNormalUser = true;
    home = "/var/lib/nixremote/";
    createHome = true;
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPKGzXGgFm/4Da2KNl1wb7TC2YOu/baP/2eFVBaJY0Wq root@marvin"
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIy9jFioBvV0JA0lc+De2N+vDOABGHgCECW6vkD33CE4 sourcehut"
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIII7sWEwsm8JZiJ0LUnjSt0Kg1RXypG6p5AzP/R2n5ca actions@github.com"
    ];
  };
  programs.git = {
    enable = true;
    package = pkgs.gitMinimal;
    config = {
      advice = {
        detachedHead = false;
        mergeConflict = false;
      };
    };
  };

  services.syncthing = {
    enable = true;
    dataDir = "/var/lib/syncthing";
    configDir = "/var/lib/syncthing";
    guiAddress = "[::]:8384";
    openDefaultPorts = true;
    overrideDevices = false;
    overrideFolders = false;
  };
}