{
  config,
  pkgs,
  ...
}:
let
  hostName = "r5";
  domain = "home.arpa";

  wan = "wan0";
  bridge = "br0";
in
{
  imports = [
    ../roles/home.nix
    ../roles/server.nix
    ../roles/router.nix
    ../roles/bandwidth-test.nix
    ../roles/dynamic-dns.nix
    ../roles/exit-node.nix
    ../roles/syncthing.nix
    ../roles/tailscale-subnet-router.nix
    ../roles/uptime-monitor.nix
    ../roles/video-library.nix
    ../roles/music-library/all.nix
    ../roles/webserver/local-ca.nix
    ../roles/webserver/reverse-proxy.nix
    ../settings/services/searchix.nix
    ../settings/hardware/usb-serial-tty.nix
  ];
  age.secrets = {
    acme.file = ../../secrets/acme.age;
    syncthing.file = ../../secrets/syncthing.age;
  };

  services.getty.autologinUser = "root";
  systemd.services."autovt@tty1".enable = false;

  nanopi.network.r8125 = true;
  networking = {
    inherit domain hostName;
    # see ../roles/router.nix for remaining settings
    nat = {
      externalInterface = wan;
      internalInterfaces = [ bridge ];
    };
    bridges = {
      br0 = {
        interfaces = [
          "lan1"
          "lan2"
        ];
      };
    };
  };

  services.dnsmasq.settings.cname = [
    "searchix.${domain},${hostName}.${domain}"
  ];
  services.searchix.settings.web = {
    listenAddress = "::";
    baseURL = "https://searchix.${domain}/";
  };
  services.caddy.virtualHosts = {
    "searchix.${domain}" = {
      serverAliases = [ "searchix.ovh" ];
      extraConfig = ''
        tls {
          issuer internal {
            ca home
          }
        }
        encode
        reverse_proxy localhost:${toString config.services.searchix.settings.web.port} {
          health_uri /health
          health_status 2xx
          health_interval 10s
          health_timeout 1s
          health_fails 2
        }
      '';
    };
  };

  systemd.network.networks = {
    "40-${wan}" = {
      matchConfig.Name = wan;
      linkConfig = {
        RequiredFamilyForOnline = "both";
      };
    };
  };

  environment.systemPackages = with pkgs; [
    file
    tree
    knot-dns
  ];

  users.users.alin = {
    isNormalUser = true;
    extraGroups = [ "wheel" ];
    openssh.authorizedKeys.keys = [
      "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBENXbdPPOq0mA+9bPklpUkikvIXjCEKE5IRwNPNMr5/Ta1J/ND737fexCjEb7YPoAJtaf0gD/JThQQi/RxDTvy4= alin@secretive.marvin.local"
    ];
  };

  boot.blacklistedKernelModules = [
    "rtc_rk808" # has no battery, prefer the hym8563
  ];
  boot.kernelModules = [
    # this RTC supposedly has a battery
    "rtc_hym8563"
  ];

  services.ntp = {
    enable = true;
    servers = [
      "nixos.pool.ntp.org"
    ];
  };

  system.stateVersion = "25.11";
}