{
  config,
  pkgs,
  inputs,
  ...
}:

{
  nix.settings.experimental-features = [
    "nix-command"
    "flakes"
  ];

  # garbage collection
  nix.gc = {
    automatic = true;
    dates = "weekly";
    options = "--delete-older-than 30d";
  };

  nix.optimise.automatic = true;
  nixpkgs.config.allowUnfree = true;

  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  boot.kernelPackages = pkgs.linuxPackages_latest;

  users.defaultUserShell = pkgs.fish;
  users.users.djai = {
    isNormalUser = true;
    description = "djai";
    extraGroups = [
      "docker"
      "networkmanager"
      "video"
      "wheel"
    ];
  };

  # TODO: figure out what we want to do w firewall
  # networking.firewall.enable = false;
  networking.networkmanager.enable = true;
  programs.nix-ld.enable = true;
  services.upower.enable = true;
  virtualisation.docker.enable = true;

  environment.systemPackages = with pkgs; [
    git
    wget
    vim
  ];

  # TODO: use home-manager
  # home-manager = {
  #   useGlobalPkgs = true;
  #   useUserPackages = true;
  #   extraSpecialArgs = { inherit inputs; };
  #   # Move a file home-manager would overwrite aside instead of failing.
  #   backupFileExtension = "backup";
  #
  #   users.djai = {
  #     home.stateVersion = "26.05";
  #     programs.home-manager.enable = true;
  #
  #     # TODO: unified ssh-config secret
  #     home.file.".ssh/config".text = ''
  #       Include ${config.sops.secrets."ssh-config".path}
  #     '';
  #   };
  # };
}