@@ -0,0 +1,166 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+let
+  hostName = "r5";
+  domain = "home.arpa";
+  tailnet = "fin-marlin.ts.net";
+in
+{
+  imports = [
+    ../settings/configuration/nix-linux.nix
+  ];
+  age.secrets = {
+    acme.file = ../../secrets/acme.age;
+    syncthing.file = ../../secrets/syncthing.age;
+  };
+
+  networking = {
+    useDHCP = true;
+    inherit domain hostName;
+    hosts = {
+      "fd7a:115c:a1e0::53" = [
+        "tailscale"
+        "ts"
+      ];
+      "192.168.100.1" = [
+        "modem"
+        "pyur"
+      ];
+    };
+    nameservers = [
+      "9.9.9.11"
+      "149.112.112.11"
+      "2620:fe::11"
+      "2620:fe::fe:11"
+    ];
+    nftables.enable = true;
+  };
+  systemd.network = {
+    enable = true;
+  };
+  services.resolved = {
+    enable = true;
+    extraConfig = ''
+      DNS =
+      LLMNR = false
+      MulticastDNS = true
+    '';
+  };
+
+  services.openssh.openFirewall = true;
+
+  services.tailscale = {
+    enable = true;
+  };
+
+  time.timeZone = "Europe/Berlin";
+  i18n.defaultLocale = "en_GB.UTF-8";
+
+  programs.vim.defaultEditor = false;
+  programs.neovim = {
+    enable = true;
+    defaultEditor = true;
+    vimAlias = true;
+    viAlias = true;
+  };
+
+  environment.systemPackages = with pkgs; [
+    file
+    tree
+    lsof
+    knot-dns
+  ];
+
+  programs.fish.enable = true;
+  users.defaultUserShell = pkgs.fish;
+
+  users.users.alin = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+    openssh.authorizedKeys.keys = [
+      "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBENXbdPPOq0mA+9bPklpUkikvIXjCEKE5IRwNPNMr5/Ta1J/ND737fexCjEb7YPoAJtaf0gD/JThQQi/RxDTvy4= alin@secretive.marvin.local"
+    ];
+  };
+
+  users.users.root = {
+    openssh.authorizedKeys.keys = [
+      "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHYUyDdw92TNXguAxcmcmZmn/7ECGdRp6ckjxU+5zCw3BCnsS5+xEvHBVnnFdJRoH2XpfMeJjE+fi67zFVhlbn4= root@secretive.marvin.local"
+    ];
+  };
+
+  services.caddy = {
+    enable = true;
+    globalConfig = ''
+      pki {
+        ca home {
+          name "Home CA"
+        }
+      }
+    '';
+    virtualHosts = {
+      "${hostName}.${domain}" = {
+        serverAliases = [ "${hostName}.${tailnet}" ];
+        extraConfig = ''
+          tls {
+            issuer internal {
+              ca home
+            }
+          }
+          root /var/lib/caddy/ca
+          file_server browse
+        '';
+      };
+      "ca.${domain}" = {
+        extraConfig = ''
+          tls {
+            issuer internal {
+              ca home
+            }
+          }
+          acme_server {
+            allow {
+              domains *.test *.${domain}
+            }
+          }
+        '';
+      };
+    };
+  };
+
+  nix = {
+    settings = {
+      max-jobs = 2;
+      builders-use-substitutes = true;
+    };
+  };
+
+  system.autoUpgrade = {
+    enable = lib.mkForce false;
+    dates = "04:15";
+    randomizedDelaySec = "59 min";
+    flake = "git+https://git.alin.ovh/nixfiles";
+    allowReboot = true;
+    rebootWindow = {
+      lower = "01:00";
+      upper = "06:00";
+    };
+  };
+
+  services.timesyncd.enable = false;
+  services.chrony = {
+    enable = true;
+    extraConfig = ''
+      rtcdevice /dev/rtc0
+      rtcfile /var/lib/chrony/rtc
+      rtcautotrim 30
+
+      allow 10.0.0.0/8
+      allow fd12:d04f:65d:42::0/56
+    '';
+  };
+
+  system.stateVersion = "25.11";
+}