{
  config,
  lib,
  pkgs,
  inputs,
  ...
}: {
  nix.settings.experimental-features = ["nix-command" "flakes"];
  nix.settings.auto-optimise-store = true;

  nix.gc.automatic = true;
  nix.gc.dates = "weekly";
  nix.gc.options = "--delete-older-than 14d";
  nix.optimise.automatic = true;

  nixpkgs.config.allowUnfree = true;
  nixpkgs.overlays = [
    (final: prev: {
      unstable = import inputs.nixpkgs-unstable {
        system = prev.stdenv.hostPlatform.system;
        config.allowUnfree = true;
      };
    })
  ];

  boot = {
    loader.systemd-boot.enable = true;
    loader.systemd-boot.configurationLimit = 10;
    loader.efi.canTouchEfiVariables = true;
    loader.timeout = 2;
    kernelPackages = pkgs.linuxPackages_latest;
  };

  time.timeZone = "Asia/Jakarta";
  i18n.defaultLocale = "en_GB.UTF-8";

  services = {
    fwupd.enable = true;
    xserver.xkb.layout = "us";
    locate.enable = true;
    printing.enable = true;
    openssh.enable = false;

    pipewire.enable = true;
    pipewire.alsa.enable = true;
    pipewire.alsa.support32Bit = true;
    pipewire.pulse.enable = true;
  };

  security.rtkit.enable = true;

  security.sudo.enable = false;

  security.doas.enable = true;
  security.doas.extraRules = [
    {
      groups = ["wheel"];
      keepEnv = true;
      persist = true;
    }
  ];

  environment.systemPackages = with pkgs; [
    nh
    alejandra
    git
    unstable.python315
    # system utils
    file
    firmware-updater
    mtr
    gnupg
    ddate
    testdisk
    tree
    wget
    btop
    plocate
    traceroute
    rlwrap
    entr
    unzip
    ffmpeg
    imagemagick
    gnome-disk-utility
    # extra (oxidised) utils
    fd
    bat
    xh
    tlrc
    dysk
    dust
    hyperfine
    ripgrep
    fzf
    eza
  ];

  programs = {
    fish.enable = true;

    atuin.enable = true;
    atuin.settings.sync_address = "https://api.atuin.sh";
    atuin.settings.enter_accept = true;

    git.enable = true;
    git.config = {
      init.defaultBranch = "main";
      advice.defaultBranchName = false;
      gpg.format = "ssh";
      commit.gpgSign = true;
      url."https://github.com/".insteadOf = ["github:"];
    };

    # one-off options that would live in the Home Manager section if the
    # relevant modules existed there
    obs-studio.enableVirtualCamera = true;

    # NOTE: services.openssh.enable = false above only disables the SSH *server*
    # This still starts the ssh-agent user service (SSH_AUTH_SOCK=%t/ssh-agent)
    ssh.startAgent = true;

    nix-ld.enable = true;
    nix-ld.libraries = with pkgs; [
      fuse
      e2fsprogs
      stdenv.cc.cc
      zlib
      alsa-lib
      expat
    ];
  };

  fonts.packages = with pkgs; [
    # GUI fonts
    inter
    corefonts
    roboto
    cantarell-fonts
    # fonts for i18n
    noto-fonts
    noto-fonts-cjk-sans
    noto-fonts-cjk-serif
    noto-fonts-color-emoji
    noto-fonts-monochrome-emoji
    unifont
    unifont_upper
    unifont-csur
    # terminal fonts
    nerd-fonts.iosevka
  ];

  fonts.fontconfig.antialias = true;
  fonts.fontconfig.subpixel.rgba = "rgb";
  fonts.fontconfig.hinting.enable = true;
  fonts.fontconfig.defaultFonts = {
    serif = ["Noto Serif"];
    sansSerif = ["Inter"];
    monospace = ["Iosevka Nerd Font"];
    emoji = ["Noto Color Emoji"];
  };
}