{
  config,
  pkgs,
  ...
}:
let
  tsnet = "fin-marlin.ts.net";
in
{
  imports = [
    ../settings/darwin.nix
    ../settings/dev.nix
    ../settings/programs/shell.nix
    ../settings/programs/base.nix
  ];

  local.web = {
    enable = true;
    projectRoot = "/Users/alan/projects";
  };

  system.primaryUser = "alan";
  system.primaryUserHome = "/Users/alan";
  users.users."${config.system.primaryUser}".openssh.authorizedKeys.keys = [
    "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJVREjPey2TOIPzfYJoG9yIR4Rui7tNJK2QIKa+pbgsyXg31hhPIw37LRRIic+l53mW8eahHxX3Y1IeTjcMw8IU= alan@marvin"
  ];

  services.openssh.extraConfig = ''
    PermitUserEnvironment yes
    AcceptEnv TERM_PROGRAM
  '';

  networking = {
    hostName = "marvin";
    localHostName = "Paranoid-Android";
  };

  services.caddy = {
    user = "root";
    group = "wheel";
    virtualHosts = {
      "${config.networking.hostName}.${tsnet}" = {
        logFormat = "output discard";
        extraConfig = ''
          reverse_proxy http://localhost:1234 {
            transport http {
              dial_timeout 1s
              compression off
            }
          }
        '';
      };
    };
  };

  services.redis = {
    enable = true;
    bind = "127.0.0.1 ::1";
    extraConfig = ''
      save ""
    '';
  };

  services.tailscale = {
    enable = true;
  };
  environment.etc."resolver/ts.net".text = ''
    nameserver fd7a:115c:a1e0::53
  '';
  environment.etc."resolver/home.arpa".text = ''
    nameserver fe80::3e7c:3fff:fe31:3e40
    nameserver fd7a:115c:a1e0::53
  '';

  environment.shells = with pkgs; [
    fish
    "/Users/alan/.local/state/nix/profile/bin/fish"
  ];

  environment.variables.LANG = "en_GB.UTF-8";

  # Used for backwards compatibility, please read the changelog before changing.
  # $ darwin-rebuild changelog
  system.stateVersion = 4;
  ids.gids.nixbld = 350;

  # You should generally set this to the total number of logical cores in your system.
  # $ sysctl -n hw.ncpu
  nix.settings = {
    max-jobs = 4;
    cores = 8;
  };

  nix = {
    distributedBuilds = true;
    buildMachines = [
      {
        protocol = "ssh-ng";
        sshUser = "nixremote";
        hostName = "linde";
        system = "aarch64-linux";
        maxJobs = 2;
        speedFactor = 1;
        supportedFeatures = [ "kvm" ];
      }
    ];
  };

  nix.linux-builder = {
    enable = false;
    systems = [
      "x86_64-linux"
      "aarch64-linux"
    ];
    speedFactor = 8;
  };

  nix-rosetta-builder = {
    enable = false;
    memory = "32GiB";
    onDemand = true;
    onDemandLingerMinutes = 180;
  };
}