{
  me,
  util,
  config,
  lib,
  pkgs,
  ...
}:

{
  imports = [
    ./foundation

    ./nix.nix
    ./user.nix
    ./locale.nix
    ./tailscale.nix
    ./nix-ld.nix
    ./vim.nix
  ];

  # fish enables this by default,
  # it makes every nixos rebuild very slow.
  documentation.man.generateCaches = false;

  users.motd = ''

    /^  /^
    \ ' ' 7   < Hi, I'm ${util.titleCase me.name}
    /    \

  '';

  networking = {
    hostName = me.name;
    useDHCP = false;
    dhcpcd.enable = false;
    nameservers = [
      "1.1.1.1"
      "1.0.0.1"
    ];

    nftables = {
      enable = true;
      flushRuleset = false;
    };

    firewall = {
      enable = true;
      allowedTCPPorts = [
        80
        443
      ];
    };
  };

  systemd.network = {
    enable = true;
    wait-online.anyInterface = true;
  };

  boot = {
    kernelPackages = pkgs.linuxPackages_latest;

    kernel.sysctl = {
      # turn all of the ip forwarding on
      "net.ipv4.ip_forward" = lib.mkDefault 1;
      "net.ipv6.conf.all.forwarding" = lib.mkDefault 1;
      "net.ipv6.conf.default.forwarding" = lib.mkDefault 1;
    };

    # mitigations
    blacklistedKernelModules = [
      # copy fail (cve-2026-31431)
      "algif_aead"

      # dirty frag (cve-2026-43284)
      "esp4" # ipv4 ipsec esp variant
      "esp6" # ipv6 ipsec esp variant
      "rxrpc" # rxrpc variant
      # note: these mitigations kill ipsec, though we never use it.
    ];
  };

  services.envfs.enable = true;

  virtualisation = {
    oci-containers.backend = "docker";
    # we need these settings to allow our networks to be ipv6-enabled and
    # to make docker support nftables directly without any compat layers.
    # we also ignore the default bridge, because it's setup
    # is a lot more complicated...
    docker = {
      enable = true;
      autoPrune.enable = true;

      # required to support nftables natively.
      # see: https://docs.docker.com/engine/network/firewall-nftables
      package = pkgs.docker_29;
      extraPackages = [ pkgs.nftables ];

      daemon.settings = {
        "metrics-addr" = "${me.tailscale.ip}:9323";

        # ipv6 support
        "ipv6" = true;
        "ip6tables" = true;

        # nftables options
        "experimental" = true;
        "ip-forward" = true;
        "firewall-backend" = "nftables";
      };
    };
  };
  systemd.services.docker.path = [ pkgs.nftables ]; # add nft tool into docker

  services = {
    openssh = {
      enable = true;
      openFirewall = false;
      listenAddresses = [
        {
          addr = me.tailscale.ip;
          port = 22;
        }
      ];
      settings = {
        PasswordAuthentication = false;
        KbdInteractiveAuthentication = false;
        PermitRootLogin = "no";
      };
    };
    # sometimes needed for gnupg
    pcscd.enable = true;
  };

  foundation.tailnetServices = [
    "docker"
    "sshd"
  ];

  programs = {
    fish.enable = true;
    git.enable = true;
    tmux.enable = true;

    gnupg.agent = {
      enable = true;
      enableSSHSupport = true;
      pinentryPackage = pkgs.pinentry-curses;
    };
  };

  environment.systemPackages = (
    with pkgs;
    [
      file
      unzip
      jq
      dig
      htop
      glances
      wget
      gnupg
      pinentry-curses
      age
      agenix
      inetutils
      pciutils
      lshw
      inxi
      iw
      dmidecode
      tcpdump
      nftables
      wireguard-tools
      ffmpeg_7-headless

      ripgrep
      gnumake
      gdb
      gcc
      clang
      dtc
      go
      gopls
      delve
      go-task
      meson
      cmake
      nil
      direnv
      nixfmt-rfc-style
      dive
      compose2nix
      nix-prefetch-docker

      borgbackup
    ]
  );
}