{ config, lib, pkgs, ... }:

{
  imports =
    [
      ./hardware-configuration.nix
      ./static.nix
    ];

  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  boot.tmp.cleanOnBoot = true;

  networking.nftables.enable = true;

  security.sudo.wheelNeedsPassword = false;

  users.users.netali = {
    isNormalUser = true;
    extraGroups = [ "wheel" ];
    openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPqnMKa8BZmbRM2Oc4E8N9h9N26ABPLgPTketLNSK7l7 me@netali.de" ];
  };

  time.timeZone = "Europe/Berlin";

  i18n.defaultLocale = "en_US.UTF-8";
  console = {
    font = "Lat2-Terminus16";
    keyMap = "de-latin1";
  };

  services.qemuGuest.enable = true;

  system.stateVersion = "$STATE_VERSION";

  networking.hostName = "$TARGET_HOSTNAME";

  services.openssh.enable = true;
  services.openssh.settings.PasswordAuthentication = false;
  services.openssh.ports = [ 1022 ];

  networking.useDHCP = false;
  networking.dhcpcd.enable = false;

  networking.nameservers = [ "2a00:fe0:0:2::300" "2a00:fe0:0:3::300" ];

  nix = {
    settings = {
      trusted-users = [ "@wheel" ];
      auto-optimise-store = true;
      experimental-features = [ "nix-command" "flakes" ];
    };
    gc = {
      automatic = true;
      dates = "weekly";
      options = "--delete-older-than 14d";
    };
    extraOptions = ''
      min-free = 104857600
      max-free = 1073741824
    ''; # more readable: min-free = 100*1024*1024; max-free = 1024*1024*1024;
  };

  systemd.network = {
    enable = true;
    networks = {
      "40-$INTERFACE" = {
        name = "$INTERFACE";
        networkConfig = {
          IPv6AcceptRA = false;
        };
        address = [
          "$PREFIX$LAST_IP_BLOCK/64"
        ];
        gateway = [
          "$GATEWAY"
        ];
      };
    };
  };
}