{
  pkgs,
  lib,
  config,
  flake,
  inputs,
  ...
}:
let
  inherit (builtins)
    fetchurl
    filter
    readFile
    ;

  inherit (lib)
    mkDefault
    mkForce
    mkOption
    types
    splitString
    ;

  gitKeys = fetchurl {
    url = "https://github.com/kbujari.keys";
    sha256 = "1ngnml1rg3g40n06cd155vr9ks5v5p12i8996xy021mkn9gx12b3";
  };
in
{
  imports = [
    ./disk.nix
    ./nginx.nix
    ./persist.nix
    ./gitserver
    # ./monitoring
  ];

  options.xnet = {
    pubKeys = mkOption {
      type = types.listOf types.str;
      default = readFile gitKeys |> splitString "\n" |> filter (s: s != "");
    };
  };

  config = {
    i18n.defaultLocale = mkDefault "en_US.UTF-8";
    time.timeZone = mkDefault "US/Pacific";

    nix = {
      nixPath = mkForce [ "nixpkgs=${inputs.nixpkgs}" ];
      settings = {
        auto-optimise-store = true;
        experimental-features = [
          "nix-command"
          "flakes"
          "pipe-operators"
        ];
        warn-dirty = false;

        # timeout fast from binary cache
        connect-timeout = 5;
      };
      gc = {
        automatic = true;
        options = mkDefault "--delete-older-than 30d";
      };
      registry = {
        nixpkgs.flake = inputs.nixpkgs;
        depot.flake = flake;
      };
    };

    documentation = {
      doc.enable = mkDefault false;
      info.enable = mkDefault false;
      man.enable = mkDefault false;
    };

    users.mutableUsers = false;
    users.users.root = {
      initialPassword = mkDefault "";
    };

    security.sudo = {
      execWheelOnly = true;
      extraConfig = "Defaults lecture = never";
    };

    nixpkgs.config.allowUnfree = true;

    services.gnome.gcr-ssh-agent.enable = false;
    programs.ssh = {
      startAgent = true;
      knownHosts = {
        "github.com".publicKey =
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
        "gitlab.com".publicKey =
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";
        "codeberg.org".publicKey =
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIVIC02vnjFyL+I4RHfvIGNtOgJMe769VTF1VR4EB3ZB";
        "git.sr.ht".publicKey =
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60";
        "pascal.ee.ryerson.ca".publicKey =
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFmWInQNT6EoU1NtUYzTs5jtpfbO/m6yvCckOiEGjvDc";
      };
      extraConfig = ''
        Host github
          HostName github.com
          User git
          PreferredAuthentications publickey

        Host codeberg
          HostName codeberg.org
          User git
          PreferredAuthentications publickey

        Host sourcehut
          HostName git.sr.ht
          User git
          PreferredAuthentications publickey

        Host ee
          HostName pascal.ee.ryerson.ca
          User kbujari
      '';
    };

    # Doesn't work since channels are disabled
    programs.command-not-found.enable = false;

    programs.git = {
      enable = true;
      config = {
        init.defaultBranch = "master";
        fetch.prune = true;
        core.excludesFile = pkgs.writeText "gitignore" ''
          # dev shell caching
          .direnv/
          .envrc
        '';
        push.default = "upstream";
        push.autoSetupRemote = true;
      };
    };
  };
}