{
  pkgs,
  config,
  lib,
  inputs,
  self,
  ...
}: {
  imports = [
    inputs.home-manager.nixosModules.home-manager
    inputs.nixos-facter-modules.nixosModules.facter
    inputs.disko.nixosModules.disko
    ./lanzaboote.nix
    ./tidal.nix
    ./sops.nix
    ./stylix.nix
    ./wireguard.nix
    ./gnome.nix
    ./compliance.nix
    ./cinnamon.nix
    ./ssh.nix
  ];

  options.pim.inWheel = lib.mkOption {
    type = lib.types.bool;
    default = true;
  };

  config = {
    time.timeZone = "Europe/Amsterdam";
    i18n.defaultLocale = "en_US.UTF-8";
    programs.ssh.startAgent = true;
    systemd.services.NetworkManager-wait-online.enable = lib.mkForce false;
    hardware.pulseaudio.enable = false;

    services = {
      xserver.enable = true;

      tailscale = {
        useRoutingFeatures = "client";
        extraSetFlags = ["--accept-routes"];
      };

      printing = {
        enable = true;
        drivers = [pkgs.hplip pkgs.gutenprint];
      };

      pipewire = {
        enable = true;
        alsa.enable = true;
        alsa.support32Bit = true;
        pulse.enable = true;
        jack.enable = true;
      };
    };

    users.users.pim = {
      isNormalUser = true;
      extraGroups =
        ["docker" "input" "wireshark" "dialout"]
        ++ lib.optional config.pim.inWheel "wheel";
    };

    environment = {
      systemPackages = with pkgs; [
        age
        btop
        btrfs-progs
        curl
        dig
        exfat
        f3
        fastfetch
        file
        git
        jq
        ripgrep
        sbctl
        tree
        vim
        wget
        yq
        ncdu
        lshw
      ];
    };

    system = {
      stateVersion = "23.05";

      activationScripts.diff = ''
        if [[ -e  /run/current-system ]]; then
          ${pkgs.nix}/bin/nix store diff-closures /run/current-system "$systemConfig"
        fi
      '';
    };

    security = {
      rtkit.enable = true;

      sudo.extraConfig = ''
        Defaults        timestamp_timeout=30
      '';
    };

    nix = {
      package = pkgs.nixFlakes;
      settings.trusted-users = ["root" "pim"];

      extraOptions = ''
        experimental-features = nix-command flakes
      '';

      gc = {
        automatic = true;
        persistent = true;
        dates = "weekly";
        options = "--delete-older-than 7d";
      };
    };

    networking = {
      useDHCP = lib.mkDefault true;
      networkmanager.unmanaged = lib.mkIf config.services.tailscale.enable ["tailscale0"];
      wireless.extraConfig = ''
        p2p_disabled=1
      '';
    };

    nixpkgs = {
      hostPlatform = lib.mkDefault "x86_64-linux";

      config = {
        allowUnfreePredicate = pkg:
          builtins.elem (lib.getName pkg) [
            "libfprint-2-tod1-goodix"
            "steam"
            "steam-original"
            "steam-run"
          ];
      };

      overlays = [
        inputs.nur.overlay
        (final: _prev: {
          unstable = import inputs.nixpkgs-unstable {
            inherit (pkgs) system;
            config.allowUnfree = true;
          };
        })
      ];
    };

    boot.kernel.sysctl = {
      "net.core.default_qdisc" = "fq";
      "net.ipv4.tcp_congestion_control" = "bbr";
    };

    home-manager = {
      useGlobalPkgs = true;
      useUserPackages = true;
      extraSpecialArgs = {inherit self inputs;};

      users.pim.imports = ["${self}/home-manager"];
    };
  };
}