{
  config,
  username,
  hostname,
  pkgs,
  lib,
  nix-index-database,
  inputs,
  specialArgs,
  ...
}: let
  ddnsPkg = import ./invoke-ddns {inherit pkgs;};

  startSeq = builtins.fromJSON ''"\u001b[7m"''; # Start inverted color
  endSeq = builtins.fromJSON ''"\u001b[27m"''; # End inverted color
  motd = "${startSeq} Welcome to the Peterson Mainframe! Look, touch, but DO NOT LICK. ${endSeq}";

  nixPkgs = specialArgs.nixPkgs;
  ourRustVersion = pkgs.rust-bin.selectLatestNightlyWith (toolchain: toolchain.complete);

  ourRustPlatform = nixPkgs.makeRustPlatform {
    rustc = ourRustVersion;
    cargo = ourRustVersion;
  };

  pullomaticPkg = import ./pullomatic {
    inherit lib pkgs;
    rustPlatform = ourRustPlatform;
    specialArgs = {};
  };

  pullomatic = "${pullomaticPkg}/bin/pullomatic";

  start-arion-run = pkgs.writeShellScriptBin "start-arion-run" ''
    set -e
    export PATH="${pkgs.nixVersions.stable}/bin:$PATH"
    export NIX_PATH="nixpkgs=${pkgs.path}:nixos-config=/etc/nixos/configuration.nix:/nix/var/nix/profiles/per-user/root/channels"
    cd /root/petersweb-infra/nixos/arion
    ${pkgs.arion}/bin/arion down 2>> /var/log/start-arion-run.log >> /var/log/start-arion-run.log
    ${pkgs.arion}/bin/arion up -d 2>> /var/log/start-arion-run.log >> /var/log/start-arion-run.log
  '';
in {
  imports = [
    (import ./cloned_repos {inherit pkgs pullomatic lib;})
    (import ./firewall.nix {inherit pkgs;})
    (import ./nginx.nix {inherit pkgs lib config;})
    (import ./system/users.nix {inherit pkgs config lib nix-index-database;})
  ];

  time.timeZone = "America/Anchorage";

  age.secrets = {
    nearlyfreespeech = {
      file = ./secrets/nearlyfreespeech.age;
      owner = "root";
    };

    webdav = {
      file = ./secrets/webdav.age;
      owner = "root";
    };

    anthropic-api-key = {
      file = ./secrets/anthropic-api-key.age;
      owner = "root";
    };
  };

  environment.systemPackages = [
    ddnsPkg
    pullomaticPkg
    pkgs.vim
    pkgs.php
    pkgs.rustc
    pkgs.cargo
    pkgs.util-linux
    pkgs.iotop
    pkgs.rust-bin.stable.latest.default
    pkgs.wget

    pkgs.unstable.claude-code

    # For docker-compose like setups
    pkgs.arion
    start-arion-run
  ];

  swapDevices = [
    {
      device = "/swapfile";
      size = 1 * 1024; # 1GB
    }
  ];

  systemd.services.forgejo-arion = {
    description = "Forgejo via Arion";
    after = [ "network.target" "podman.service" ];
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      ExecStart = "${start-arion-run}/bin/start-arion-run";
    };
  };

  systemd.tmpfiles.rules = [
    "d /home/ironmagma/.config 0755 ${username} users"
    "d /root/.config 0755 ${username} users"
  ];

  networking.hostName = "${hostname}";

  # FIXME: change your shell here if you don't want zsh
  programs.zsh.enable = true;
  programs.zsh.shellInit = ''
    export ANTHROPIC_API_KEY=$(cat ${config.age.secrets.anthropic-api-key.path})
  '';
  environment.pathsToLink = ["/share/zsh"];
  environment.shells = [pkgs.zsh];

  environment.enableAllTerminfo = true;

  security.sudo.wheelNeedsPassword = false;

  users.motd = motd;

  system.stateVersion = "22.05";

  virtualisation.docker = {
    enable = true;
    enableOnBoot = true;
    autoPrune.enable = true;
  };

  # Arion works with Docker, but for NixOS-based containers, you need Podman
  # since NixOS 21.05.
  virtualisation.podman = {
    enable = true;
    defaultNetwork.settings.dns_enabled = true;
  };

  virtualisation.oci-containers = {
    backend = "docker";

    containers = {
      # Example:
      # "hello" = {
      #   autoStart = true;
      #   image = "nginxdemos/hello";
      #   #user = "root:jellyfin";
      #   volumes = [
      #   ];
      #   ports = ["8081:80"];
      # };

      "navidrome" = {
        autoStart = true;
        environment = {
          "TZ" = "America/Anchorage";
          "PUID" = "1000";
          "PGID" = "100";

          "ND_SCANSCHEDULE" = "1h";
          "ND_LOGLEVEL" = "info";
          "ND_SESSIONTIMEOUT" = "24h";
          "ND_BASEURL" = "";
        };
        ports = ["4533:4533"];
        volumes = [
          "/var/navidrome/data:/data"
          "/var/navidrome/music:/music:ro"
        ];
        image = "deluan/navidrome";
      };

      "nextcloud" = {
        autoStart = true;
        image = "quineglobal/ubuntu-with-ssh@sha256:64210887d48fae65bc4552503bf2d21a750ba0417ada530fd31254a8cc916746";
        # image = "nextcloud/28-apache@sha256:ed95d344718ec86df96886b4b3465a9ce553c08b44b47306d399f0f201b04cb3";
        volumes = [ ];
        environment = { };
        ports = ["8087:80"];
      };

      # "ubuntu" = {
      #   autoStart = true;
      #   image = "quineglobal/ubuntu-with-ssh@sha256:64210887d48fae65bc4552503bf2d21a750ba0417ada530fd31254a8cc916746";
      #   volumes = [ ];
      #   environment = {};
      #   ports = ["222:22"];
      # };

      "sync.io" = {
        autoStart = true;
        image = "quineglobal/sync.io@sha256:cbb180301fde42d8d22c26c952a4d4a487469d6491465302d8d79ebf194813b3";
        volumes = [
          "/var/syncio-cache:/sync.io-cache"
        ];
        environment = {};
        ports = ["9090:8080"];
        user = "0"; # run as root
      };
      
      "blog-quine" = {
        autoStart = true;
        image = "quineglobal/blog-quine@sha256:3c2901f772c322d81f843c04d6982b9f50ff0b46d3cc457d9f868a7ff5a15497";
        volumes = [];
        environment = {};
        ports = ["3010:8080"];
      };

      "riverside" = {
        autoStart = true;
        image = "forge.quinefoundation.com/ironmagma/riverside@sha256:ab62339730a4ea31a01b05e7fef6a5717d4217a79eb3480c2218eab9305181c3";
        volumes = [];
        environment = {};
        ports = ["3011:8080"];
      };

    };
  };

  nix = {
    settings = {
      trusted-users = [username];

      accept-flake-config = true;
      auto-optimise-store = true;
    };

    registry = {
      nixpkgs = {
        flake = inputs.nixpkgs;
      };
    };

    nixPath = [
      "nixpkgs=${inputs.nixpkgs.outPath}"
      "nixos-config=/etc/nixos/configuration.nix"
      "/nix/var/nix/profiles/per-user/root/channels"
    ];

    package = pkgs.nixVersions.stable;
    extraOptions = ''experimental-features = nix-command flakes'';

    gc = {
      automatic = true;
      options = "--delete-older-than 7d";
    };
  };

  # HTTPS

  security.acme = {
    acceptTerms = true;
    defaults.email = "peterson@sent.com";
    certs."philippeterson.com" = {
      dnsProvider = "nearlyfreespeech";
      environmentFile = config.age.secrets."nearlyfreespeech".path;
      webroot = null;
    };

    certs."webdav.philippeterson.com" = {
      dnsProvider = "nearlyfreespeech";
      environmentFile = config.age.secrets."nearlyfreespeech".path;
      webroot = null;
    };
  };
}