{
  inputs,
  outputs,
  lib,
  config,
  pkgs,
  ...
}: let
  my-python-packages = python-packages:
    with python-packages; [
      # pipx
      distutils
      docx2txt
      numpy
      pip
      python-dateutil
      requests
      setuptools
    ];
  python-with-my-packages = pkgs.python313.withPackages my-python-packages;
in {
  nix = {
    settings = {
      # experimental-features = ["nix-command" "flakes"];
      warn-dirty = false;
      auto-optimise-store = true;
      trusted-users = ["root" "don"];
    };
    gc = {
      automatic = true;
      dates = "daily";
      options = "--delete-older-than 7d";
    };
  };
  imports = [
    inputs.catppuccin.nixosModules.catppuccin
    # ../comon/tailscale.nix
    ../../home
    ../../home/gui
    ../../home/gui/gnome-calenar.nix
    ../../home/work
    ../vars.nix
    ../wm
    ../wm/greetd
    ../workstation/games
    ../workstation/kvm.nix
    ../themes.nix
    ./detect-reboot-needed.nix
    ./kmscon.nix
    ./ollama.nix
    ./systemd.nix
    ../systemd-primary.nix
    ./auto-cpufreq.nix
    ./tlp.nix
    ../common/upgrade-diff.nix
    ./wine.nix
  ];

  sops = {
    age.keyFile = "/home/don/.config/sops/age/keys.txt";

    defaultSopsFile = ../../secrets.yaml;
    # defaultSymlinkPath = "/run/user/1000/secrets";
    # defaultSecretsMountPoint = "/run/user/1000/secrets.d";

    secrets = {
      "users/root_password" = {
        owner = "root";
        mode = "0400";
      };
      "users/root_sshauth" = {
        owner = "root";
        mode = "0400";
        path = "/etc/ssh/authorized_keys.d/root";
      };
      "users/don_password" = {
        owner = "don";
        mode = "0400";
      };
      "users/don_sshauth" = {
        owner = "don";
        mode = "0400";
        path = "/etc/ssh/authorized_keys.d/don";
      };
      "users/vicky_password" = {
        owner = "don";
        mode = "0400";
      };
      "users/vicky_sshauth" = {
        owner = "don";
        mode = "0400";
        path = "/etc/ssh/authorized_keys.d/vicky";
      };
      "smtp/smtp_password" = {
        owner = "root";
        mode = "0444";
      };
      "tailscale/ts_api" = {
        owner = "root";
        mode = "0400";
      };
    };
  };

  networking = {
    networkmanager.enable = true;
    enableIPv6 = true;
    networkmanager = {wifi = {powersave = true;};};
    useDHCP = false;
    firewall = {
      enable = true;
      trustedInterfaces = ["tailscale0"]; # always allow traffic from your Tailscale network
      checkReversePath = "loose";
      allowedUDPPorts = [config.services.tailscale.port];
      allowedTCPPortRanges = [
        {
          from = 1714;
          to = 1764;
        }
      ];
      allowedUDPPortRanges = [
        {
          from = 1714;
          to = 1764;
        }
      ];
      allowedTCPPorts = [22];
    };
  };

  # Set your time zone.
  time = {
    timeZone = "America/Chicago";
    hardwareClockInLocalTime = false;
  };

  # Select internationalisation properties.
  i18n = {
    defaultLocale = "en_US.UTF-8";
    inputMethod = {
      enable = true;
      type = "fcitx5";
      fcitx5.addons = with pkgs; [fcitx5-mozc fcitx5-gtk];
    };
  };

  # Bootloader.
  boot = {
    binfmt.emulatedSystems = ["aarch64-linux"];
    # kernelPackages = pkgs.linuxPackages_latest;
    kernelPackages = pkgs.linuxPackages_zen;
    kernelParams = ["consoleblank=60" "mem_sleep_default=deep"];
    # extraModulePackages = [config.boot.kernelPackages.ddcci-driver];
    # kernelModules = ["i2c-dev" "ddcci_backlight"];
    loader =
      if (pkgs.hostPlatform != lib.mkDefault "aarch64-linux")
      then {
        systemd-boot = {enable = true;};
        efi = {
          canTouchEfiVariables = true;
          efiSysMountPoint = "/boot";
        };
      }
      else {
        grub.enable = false;
        generic-extlinux-compatible.enable = true;
      };
    plymouth = {enable = true;};
    kernel = {sysctl = {"vm.swappiness" = 10;};};
  };

  security = {
    polkit = {enable = true;};
    sudo.enable = false;
    doas = {
      enable = true;
      extraRules = [
        {
          users = ["don"];
          keepEnv = true;
          noPass = true;
        }
      ];
    };
  };

  powerManagement.powertop.enable = true;

  services = {
    power-profiles-daemon.enable = false;
    avahi = {
      enable = true;
      nssmdns4 = true;
      publish = {
        enable = true;
        addresses = true;
        userServices = true;
      };
    };
    bpftune = {enable = true;};
    flatpak = {enable = true;};
    fstrim = {enable = true;};
    fwupd = {enable = true;};
    locate = {
      enable = true;
      package = pkgs.mlocate;
    };
    logind = {
      lidSwitchDocked = "ignore";
      lidSwitchExternalPower = "ignore";
      settings = {
        Login = {
          HandleLidSwitchDocked = "ignore";
          lidSwitchExternalPower = "ignore";
        };
      };
    };
    nscd = {enableNsncd = true;};
    openssh = {
      enable = true;
      settings = {
        PasswordAuthentication = false;
        KbdInteractiveAuthentication = false;
      };
    };
    pcscd = {enable = true;};
    pipewire = {
      enable = true;
      alsa = {
        enable = true;
        support32Bit = true;
      };
      pulse = {enable = true;};
    };
    printing = {
      enable = true;
      drivers = [pkgs.hplipWithPlugin];
    };
    pulseaudio = {enable = false;};
    tailscale = {enable = true;};
    udev = {
      extraRules = ''
        ACTION=="add|change", KERNEL=="sd[a-z]*[0-9]*|mmcblk[0-9]*p[0-9]*|nvme[0-9]*n[0-9]*p[0-9]*", ENV{ID_FS_TYPE}=="ext4", ATTR{../queue/scheduler}="none" '';
    };
    udisks2 = {enable = true;};
  };

  hardware = {
    bluetooth = {enable = true;};
    sane = {
      enable = true;
      extraBackends = [pkgs.sane-airscan];
      disabledDefaultBackends = ["escl" "v4l"];
    };
  };
  security.rtkit.enable = true;

  xdg.portal = {
    enable = true;
    wlr.enable = true;
    extraPortals = [
      pkgs.xdg-desktop-portal-gtk
      pkgs.xdg-desktop-portal-wlr
      pkgs.kdePackages.xdg-desktop-portal-kde
    ];
  };

  users = {
    users = {
      root = {
        initialPassword = "changeme";
        openssh.authorizedKeys.keys = [config.sops.secrets."users/root_sshauth".path];
      };
      don = {
        isNormalUser = true;
        initialPassword = "changeme";
        description = "Don Harper";
        extraGroups = ["networkmanager" "wheel" "scanner" "lp" "video" "mlocate" "disk"];
        openssh.authorizedKeys.keys = [config.sops.secrets."users/don_sshauth".path];
      };
    };
  };

  # Allow unfree packages
  nixpkgs = {
    config = {
      allowUnfree = true;
      allowUnfreePredicate = true;
      permittedInsecurePackages = ["libsoup-2.74.3" "qtwebengine-5.15.19"];
      allowInsecurePredicate = pkg:
        builtins.elem (lib.getName pkg) ["broadcom-sta"];
    };
  };

  fonts.packages = with pkgs; [
    anonymousPro
    font-awesome
    jetbrains-mono
    nerd-fonts.symbols-only
    nerd-fonts.roboto-mono
    nerd-fonts.monaspace
    nerd-fonts.ubuntu
    nerd-fonts.fira-code
    source-code-pro
    noto-fonts
    powerline-fonts
    source-code-pro
    victor-mono
  ];

  environment.systemPackages = with pkgs; [
    python-with-my-packages
    acpi
    age
    aspell
    aspellDicts.en
    base16-schemes
    bash-completion
    brightnessctl
    btop
    caligula
    colmena
    delta
    espeak-classic
    fwup
    fwupd
    fwupd-efi
    gcc
    git-crypt
    gitFull
    has
    headsetcontrol
    home-manager
    hunspell
    hunspellDicts.en_US
    id3v2
    imagemagick
    isync
    just
    libsForQt5.qtkeychain
    lsb-release
    lsof
    nix-bash-completions
    nixd
    nixfmt-classic
    isync
    pkg-config
    playerctl
    poppler-utils
    pulseaudio
    ruby
    sshfs
    sops
    termsonic
    # toot
    udiskie
    wireplumber
    xdg-utils
    xfce.thunar
    xsane
    zathura
  ];

  programs = {
    dconf = {enable = true;};
    light = {enable = true;};
    mtr = {enable = true;};
    kdeconnect = {enable = true;};
    gnupg = {
      agent = {
        enable = true;
        pinentryPackage = pkgs.pinentry-curses;
        enableSSHSupport = true;
      };
    };
  };

  nixpkgs.overlays = [
    (final: prev: {
      qutebrowser = prev.qutebrowser.override {enableWideVine = true;};
    })
    (final: super: {
      khal = super.khal.overridePythonAttrs (_: {doCheck = false;});
    })
  ];

  nix.nixPath = ["nixpkgs=${inputs.nixpkgs}"];

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It's perfectly fine and recommended to leavecatenate(variables, "bootdev", bootdev)
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "23.11"; # Did you read the comment?
  programs.msmtp = {
    enable = true;
    accounts = {
      default = {
        auth = true;
        tls = true;
        port = 587;
        from = "don@donharper.org";
        host = "smtp.smtp2go.com";
        user = "donharper.org";
        passwordeval = "cat ${config.sops.secrets."smtp/smtp_password".path}";
      };
    };
  };
  xdg.mime.enable = true;
  xdg.mime.defaultApplications = {
    "text/html" = "org.qutebrowser.qutebrowser.desktop";
    "x-scheme-handler/http" = "org.qutebrowser.qutebrowser.desktop";
    "x-scheme-handler/https" = "org.qutebrowser.qutebrowser.desktop";
    "x-scheme-handler/about" = "org.qutebrowser.qutebrowser.desktop";
    "x-scheme-handler/unknown" = "org.qutebrowser.qutebrowser.desktop";
  };
  environment.sessionVariables.DEFAULT_BROWSER = "${pkgs.qutebrowser}/bin/qutebrowser";
}