{
  povSelf,
  pkgs,
  lib,
  config,
  hostConfig,
  ...
}:
let
  inherit (lib) types;
  cfg = lib.getAttrFromPath povSelf config;

in
{

  options = {
    enable = {
      type = types.bool;
      default = false;
    };
  };

  config = lib.mkIf cfg.enable {
    environment.defaultPackages = lib.mkForce [ ];

    programs.command-not-found.enable = false;

    # make things more declerative
    services.userborn.enable = lib.mkDefault true;
    users.mutableUsers = lib.mkForce false;

    networking = {
      hostId = builtins.substring 0 8 (builtins.hashString "sha256" hostConfig.hostName);
      hostName = hostConfig.hostName;
      domain = lib.mkDefault hostConfig.domain;

      useNetworkd = lib.mkDefault true;
      useDHCP = lib.mkDefault false;

      nftables.enable = lib.mkDefault true;
      firewall.enable = lib.mkDefault true;
    };

    hardware.enableRedistributableFirmware = true;

    modules = {
      boot.enable = lib.mkDefault true;
      boot.type = lib.mkDefault "uefi";

      locale.enable = lib.mkDefault true;
      unfree.enable = lib.mkDefault true;
      nix.enable = lib.mkDefault true;
      homeManager.enable = lib.mkDefault true;
      sops.enable = lib.mkDefault true;

      security = {
        enable = lib.mkDefault true;
        kernel = lib.mkDefault true;
        networking = lib.mkDefault true;
      };

      services = {
        earlyoom = {
          avoid = [ "init" ];
          prefer = [ "nix" ];
        };
      };

      programs = {
        shellUtilities.enable = lib.mkDefault true;
        systemUtilities.enable = lib.mkDefault true;
        networkUtilities.enable = lib.mkDefault true;

        fish.enable = lib.mkDefault true;
        git.enable = lib.mkDefault true;
      };
    };

    services = {
      fstrim.enable = lib.mkDefault true;
    };

    security.sudo.extraConfig = "Defaults lecture=\"never\""; # "We trust you have received the usual lecture from the local System Administrator."

    # thanks piegames (https://git.darmstadt.ccc.de/piegames/home-config/-/blob/master/modules/generic.nix#L84)
    system.activationScripts = {
      diff = {
        supportsDryActivation = true;
        text = ''
          ${pkgs.nvd}/bin/nvd --color=always --nix-bin-dir=${pkgs.nix}/bin diff "$(readlink /run/current-system)" "$systemConfig"
          # Ignore "failures" because these tools have weird exit codes
          ${pkgs.colordiff}/bin/colordiff --nobanner --fakeexitcode --color=always -ur -I '\/nix\/store' \
            -- "$(readlink /run/current-system)/activate" "$systemConfig/activate" | ${pkgs.gnugrep}/bin/grep -v "^Binary files" || true
          ${pkgs.colordiff}/bin/colordiff --nobanner --fakeexitcode --color=always -ur -I '\/nix\/store' \
            -x "os-release" -x "issue" \
            -- "$(readlink /run/current-system)/etc" "$systemConfig/etc" | ${pkgs.gnugrep}/bin/grep -v "^Binary files" || true
          ${pkgs.colordiff}/bin/colordiff --nobanner --fakeexitcode --color=always -ur -I '\/nix\/store' \
            -x "environment.d" \
            -x "hwdb.d" \
            -- "$(readlink /run/current-system)/systemd" "$systemConfig/systemd" | ${pkgs.gnugrep}/bin/grep -v "^Binary files" || true
        '';
      };
    };
  };

}