{ config, lib, pkgs, ... }:

{
  imports =
    [
      ./hardware-configuration.nix
    ];

  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  boot.tmp.useTmpfs = true;

  networking.nftables.enable = true;

  security.sudo.wheelNeedsPassword = false;

  users.users.netali = {
    isNormalUser = true;
    extraGroups = [ "wheel" ];
    openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOV4f3/OcNQIHqomvH0nGLDmXDlrO/u7JKE9Fgq2Vuqs me@netali.de" ];
  };

  time.timeZone = "Europe/Berlin";

  i18n.defaultLocale = "en_US.UTF-8";
  console = {
    font = "Lat2-Terminus16";
    keyMap = "de-latin1";
  };

  services.qemuGuest.enable = true;

  system.stateVersion = "24.11";

  networking.hostName = "$TARGET_HOSTNAME";

  services.openssh.enable = true;
  services.openssh.settings.PasswordAuthentication = false;
  services.openssh.ports = [ 1022 ];

  networking.useDHCP = false;
  networking.dhcpcd.enable = false;

  networking.nameservers = [ "2606:4700:4700::1111" "2606:4700:4700::1001" ];

  nix = {
    settings = {
      trusted-users = [ "@wheel" ];
      auto-optimise-store = true;
      experimental-features = [ "nix-command" "flakes" ];
    };
    gc = {
      automatic = true;
      dates = "weekly";
      options = "--delete-older-than 14d";
    };
    extraOptions = ''
      min-free = 104857600
      max-free = 1073741824
    ''; # more readable: min-free = 100*1024*1024; max-free = 1024*1024*1024;
  };

  systemd.network = {
    enable = true;
    networks = {
      "40-ens18" = {
        name = "ens18";
        networkConfig = {
          IPv6AcceptRA = false;
        };
        address = [
          "2001:67c:a6c:a::$LAST_IP_BLOCK/64"
        ];
        gateway = [
          "2001:67c:a6c:a::1"
        ];
      };
    };
  };
}