{

  system = "x86_64-linux";
  nixpkgsStable = true;

  domain = "infra.zaphyra.eu";

  sshPubKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGzfyv5VewO+fMknvDOm1AneXeIynPYC3DsvY5XRpvsa";

  hardware = {
    cpuVendor = "intel";
    allowHibernation = true;
  };

  networking = {
    hasDN42 = true;
    dn42Address = "fd6b:6174:6a61::10";
  };

  configuration =
    {
      config,
      pkgs,
      lib,
      ...
    }:
    {

      specialisation.gnome.configuration = {
        modules.presets.graphical.type = lib.mkForce "gnomeMinimal";
      };

      boot.initrd.systemd.emergencyAccess = true;
      # boot.kernel.sysctl."power.pm_async" = false;

      sops.secrets."environments/networkManagerProfiles/cccdaWifi" = { };

      modules = {
        boot.secureboot = false;
        filesystem = {
          impermanence.system.enable = true;
          impermanence.home.enable = true;
          rootDisk = {
            enable = true;
            encrypt = true;
            type = "btrfs";
            path = "/dev/disk/by-id/nvme-WD_BLACK_SN770M_2TB_25242V800503";
            reservedSpace = "3G";
            parts = {
              nix = true;
            };
            swap = {
              enable = true;
              size = "33G";
            };
          };
        };

        hardware = {
          video.intel.enable = true;
          cpu.updateMicrocode = true;
          fprint.enable = true;
          fprint.disableOnLidClose = true;

          quirks.thinkpad.enable = true;
        };

        presets = {
          base.enable = true;
          zaphyra = {
            enable = true;
            networkManagerProfiles = {
              dn42.enable = true;
            };
          };

          graphical.enable = true;
          graphical.type = "niri";

          networkManagerProfiles = {
            voidPhoneWifi.enable = true;
            voidHomeWifi.enable = true;
            zaphyraPhoneWifi.enable = true;
            zaphyraHomeWifi.enable = true;
            grogHomeWifi.enable = true;
            cccdaWifi = {
              enable = true;
              username = "zaphyra";
              envFile = config.sops.secrets."environments/networkManagerProfiles/cccdaWifi".path;
            };
          };
        };

        services = {
          earlyoom.enable = true;
          systemd-oomd.enable = true;
          greetd.autoLogin = {
            enable = true;
            user = "zaphyra";
          };
        };

        programs = {
          AusweisApp.enable = true;
          yubikey.enable = true;
        };

        users.zaphyra.enable = true;
      };

      networking = {
        useNetworkd = false;
        hosts."127.0.0.1" = [ config.networking.fqdn ];
      };

      hardware.bluetooth.settings = {
        General.Experimental = true;
      };

      services = {
        #userborn.enable = false;
        resolved.enable = true;
        printing.enable = true;
        avahi = {
          enable = true;
          nssmdns4 = true;
          publish.enable = true;
          publish.userServices = true;
        };
        gnome.at-spi2-core.enable = false;
        pipewire.raopOpenFirewall = true;
      };

      system.stateVersion = "25.05";
      home-manager.users.zaphyra.home.stateVersion = "25.05";
    };

}