{

  system = "x86_64-linux";
  nixpkgsStable = true;

  domain = "home.infra.zaphyra.eu";

  sshPubKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA2bluHGMcdKEremjLq3aUEeJlWHlGSjL8nuAhkeEl1f";

  hardware = {
    cpuVendor = "intel";
    allowHibernation = false;
  };

  networking = {
    ip4IsPrivate = true;
    ip4Address = "10.0.0.1";
    ip4PrefixLength = 8;

    ip6IsPrivate = false;
    ip6Address = "2a03:4000:4d:5e:acab::1";
    ip6PrefixLength = 112;
  };

  configuration =
    {
      inputs,
      hostConfig,
      config,
      lib,
      pkgs,
      ...
    }:
    {

      boot = {
        kernelModules = [ "wireguard" ];

        # seems to make realtek ethernet faster?
        kernelParams = [ "pcie_aspm=off" ];

        initrd.systemd.emergencyAccess = true;
      };

      sops.secrets = {
        "resticEnv/novus" = {
          sopsFile = inputs.self.sopsSecrets.common;
        };
      };

      modules = {
        security.kernel = false;
        filesystem = {
          impermanence.system.enable = true;
          impermanence.home.enable = true;
          rootDisk = {
            enable = true;
            encrypt = true;
            type = "zfs";
            path = "/dev/disk/by-id/nvme-INTEL_SSDPEKNW010T8_PHNH9210020X1P0B";
            reservedSpace = "3G";
            parts = {
              nix = true;
            };
            swap = {
              enable = true;
              size = "8G";
            };
          };
        };

        presets = {
          base.enable = true;
          zaphyra = {
            enable = true;
            router.enable = true;
            smarthome.enable = true;
            syncthing.enable = false;
          };
        };

        websites = {
          "fedi.home.ctu.cx".enable = true;
        };

        users.zaphyra.enable = true;
      };

      system.stateVersion = "25.05";
      home-manager.users.zaphyra.home.stateVersion = "25.05";
    };

}