{
  config,
  lib,
  pkgs,
  ...
}:
let
  hostSecrets = ../../secrets + "/${config.networking.hostName}.yaml";
in
{
  options.modules.host.enable = lib.mkEnableOption "physical host configuration";

  config = lib.mkIf config.modules.host.enable {
    nix.gc.automatic = true;
    nix.gc.dates = "Mon 03:15";
    nix.gc.options = "--delete-older-than 30d";

    nix.optimise.automatic = true;
    nix.optimise.dates = [ "Thu 03:45" ];

    boot.loader.systemd-boot.enable = true;
    boot.loader.systemd-boot.configurationLimit = 15;
    boot.loader.efi.canTouchEfiVariables = true;

    hardware.enableRedistributableFirmware = true;
    zramSwap.enable = true;

    modules.network.ssh.enable = true;
    modules.network.ssh.hostKeys.sopsFile = hostSecrets;
    modules.network.ssh.userKey.sopsFile = hostSecrets;

    services.xserver.xkb.layout = "us";
    console.useXkbConfig = true;

    sops.defaultSopsFile = ../../secrets/shared.yaml;
    sops.age.keyFile = "/var/lib/sops-nix/key.txt";
    sops.age.sshKeyPaths = [ ];
    sops.gnupg.sshKeyPaths = [ ];

    users.mutableUsers = false;
    sops.secrets."${config.user.name}-password".neededForUsers = true;
    users.users.${config.user.name}.hashedPasswordFile =
      config.sops.secrets."${config.user.name}-password".path;

    security.sudo.extraConfig = ''
      Defaults env_keep += "EDITOR VISUAL"
    '';

    home-manager = {
      useGlobalPkgs = true;
      useUserPackages = true;
      users.${config.user.name} = {
        home.username = config.user.name;
        home.homeDirectory = "/home/${config.user.name}";
        home.stateVersion = config.system.stateVersion;
        home.sessionVariables = lib.attrByPath [ config.networking.hostName ] { } config.registry.env;
        home.packages = with pkgs; [
          eza
          unzip
          wget
        ];
      };
    };

    registry.shell-shortcut.${config.networking.hostName} = {
      ls = {
        command = "eza -alg --color=always --group-directories-first --icons=always";
        abbreviation = false;
      };
      ll = {
        command = "eza -lg --color=always --group-directories-first --icons=always";
        abbreviation = false;
      };
      lt = {
        command = "eza -aT -I '.git' --color=always --group-directories-first --icons=always";
        abbreviation = false;
      };
      ".." = "cd ..";
      "..." = "cd ../..";
      "...." = "cd ../../..";

      cp = "cp -v";
      tarnow = "tar -acf ";
      untar = "tar -zxvf ";
      wget = "wget -c ";
      grep = "grep --color=auto";
      fgrep = "fgrep --color=auto";
      egrep = "egrep --color=auto";
      jctl = "journalctl -p 3 -xb";

      update = "sudo nixos-rebuild switch --flake .#${config.networking.hostName}";
      cleanup = "sudo nix-collect-garbage -d";
      sops-host = {
        command = "sudo --preserve-env=EDITOR,VISUAL env SOPS_AGE_KEY_FILE=/var/lib/sops-nix/key.txt nix shell nixpkgs#sops nixpkgs#neovim -c sops";
        abbreviation = false;
      };
    };

    modules.shell.fish.enable = lib.mkDefault true;
    modules.shell.fish.defaultShell = lib.mkDefault true;
    modules.shell.tmux.enable = lib.mkDefault true;
    modules.shell.nvim.enable = lib.mkDefault true;
    modules.shell.git.enable = lib.mkDefault true;
    modules.shell.yazi.enable = lib.mkDefault true;
  };
}