{ pkgs, lib, ... }:
let
  readlink = "${pkgs.coreutils}/bin/readlink";
  notify-send = "${pkgs.libnotify}/bin/notify-send";
in {
  systemd = {
    services = {
      systemd-lock-handler = { enable = true; };
      NetworkManager-wait-online.enable = lib.mkForce false;
      systemd-networkd-wait-online.enable = lib.mkForce false;
      clean-keychain = {
        description = "Clean up .keychain on boot";
        wantedBy = [ "multi-user.target" ];
        serviceConfig = {
          Type = "oneshot";
          ExecStart = "${pkgs.coreutils-full}/bin/rm -rf /home/don/.keychain";
        };
      };
    };
    user = {
      services = {
        swaylock = {
          description = "Screen locker for Wayland";
          documentation = [ "man:swaylock(1)" ];
          onSuccess = [ "unlock.target" ];
          partOf = [ "lock.target" ];
          before = [ "lock.target" ];
          wantedBy = [ "lock.target" ];
          serviceConfig = {
            Type = "forking";
            Environment =
              "PATH=/run/current-system/sw/bin:/etc/profiles/per-user/don/bin:/home/don/bin";
            ExecStart = "/home/don/bin/lock.sh -m";
            Restart = "on-failure";
            RestartSec = 0;
          };
        };
        detect-reboot-for-upgrade = {
          script = ''
              set -eu -o pipefail
              booted="$(${readlink} /run/booted-system/{initrd,kernel,kernel-modules})"
              built="$(${readlink} /nix/var/nix/profiles/system/{initrd,kernel,kernel-modules})"
              if [[ "''${booted}" != "''${built}" ]];
            then
              echo "Looks like we need a reboot!"
              ${notify-send} --urgency=low --icon=system-reboot "Reboot is needed for a NixOS upgrade."
              fi
          '';
          serviceConfig = { Type = "oneshot"; };
        };
        check-nic = {
          description = "Adjust tailscale MTU based on location";
          unitConfig = { Type = "simple"; };
          serviceConfig = {
            Type = "oneshot";
            Environment =
              "PATH=/run/current-system/sw/bin:/etc/profiles/per-user/don/bin:/home/don/bin";
            ExecStart = "/home/don/bin/check-nic";
          };
        };
      };
      timers = {
        check-nic = {
          wantedBy = [ "timers.target" ];
          partOf = [ "check-nic.service" ];
          timerConfig = {
            OnCalendar = "1m";
            Unit = "check-nic.service";
          };
        };
        detect-reboot-for-upgrade = {
          wantedBy = [ "timers.target" ];
          partOf = [ "detect-reboot-for-upgrade.service" ];
          timerConfig = {
            OnCalendar = "hourly";
            Unit = "detect-reboot-for-upgrade.service";
          };
        };
      };
    };
  };
}