{
  config,
  lib,
  pkgs,
  nixos-apple-silicon,
  ...
}:

{
  imports = [
    nixos-apple-silicon.nixosModules.apple-silicon-support
  ];

  # boot settings
  boot = {
    loader.systemd-boot.enable = true;
    loader.efi.canTouchEfiVariables = false;

    plymouth.enable = true;

    initrd.systemd.enable = true;

    # expand display to notch region
    kernelParams = [
      "apple_dcp.show_notch=1"
    ];

    # check nixos-apple-silicon documentation on this,
    # if keyboard weirdness ever comes up.
    # extraModprobeConfig = ''
    #   options hid_apple iso_layout=0
    # '';

    # show a nix logo on asahi m1n1 boot!
    m1n1CustomLogo = ../../assets/nix-256x256.png;
  };

  # swap
  zramSwap = {
    enable = true;
    algorithm = "zstd";
    swapDevices = 1;
    memoryPercent = 50;
  };

  # hardware
  hardware = {
    enableAllFirmware = true;
    enableRedistributableFirmware = true;

    graphics = {
      enable = true;
      enable32Bit = lib.mkForce false;
    };
    bluetooth.enable = true;

    # asahi-specific settings!
    asahi = {
      enable = true;

      # proprietary apple firmware extracted during installation.
      # it can also be found in /boot/asahi, but needs to be
      # included here for flake purity.
      peripheralFirmwareDirectory = ../../assets/m1-firmware;

      # mesa
      useExperimentalGPUDriver = true;
      experimentalGPUInstallMode = "replace"; # probably no longer used.
      # sound
      setupAsahiSound = true;
      # kernel
      withRust = true;
    };
  };

  # internet/wifi
  networking = {
    networkmanager = {
      enable = true;
      wifi.backend = "iwd";
    };
    wireless.iwd = {
      enable = true;
      settings.General.EnableNetworkConfiguration = true;
    };
  };

  # sound
  security.rtkit.enable = true;
  services.pipewire = {
    enable = true;
    alsa = {
      enable = true;
      support32Bit = true;
    };
    pulse.enable = true;
    jack.enable = true;
  };

  fileSystems =
    let
      options = [
        "users" # any user can mount and unmount dao, implies 'noexec', 'nodev', 'nosuid'
        "exec" # override 'users' 'noexec' default, executable files are nice!
        "nofail" # it's okay if dao can't be found
        "noatime" # do not update access timestamps (files+folders)

        # btrfs options
        "compress=zstd" # compress data with zstd, level 3
      ];
    in
    {
      # disk with all my personal projects & life in general
      "/mnt/Dao" = {
        device = "/dev/disk/by-label/Dao";
        fsType = "btrfs";

        inherit options;
      };

      # disk with consultancy work-related things
      "/mnt/Lao" = {
        device = "/dev/disk/by-label/Lao";
        fsType = "btrfs";

        inherit options;
      };
    };

  services.btrfs.autoScrub.enable = true;
}