{
  inputs,
  pkgs,
  ...
}:
# neogaia — Dell XPS 13 9380 laptop.
# Disk layout is in ./disk.nix.
# `fileSystems` are derived from it, none declared here.
{
  imports = [
    inputs.nixos-hardware.nixosModules.dell-xps-13-9380
    ./hardware-configuration.nix
    ./disk.nix
  ];

  system.stateVersion = "26.05";

  # systemd-boot on the EFI system partition.
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  boot.kernelPackages = pkgs.linuxPackages_cachyos;

  # Redistributable firmware for the QCA6174 wifi (ath10k blobs).
  # Intel microcode updates follow from this, so none is declared here.
  hardware.enableRedistributableFirmware = true;

  # RAM-backed swap, no on-disk swap partition.
  zramSwap.enable = true;

  # So wifi can be joined from the console.
  networking.networkmanager.enable = true;

  registry.address.neogaia.self = "10.23.50.146";

  modules.network.vpn-client = {
    enable = true;
    sopsFile = ../../secrets/neogaia.yaml;
    address = "10.23.100.3/32";

    peer = {
      publicKey = "sGEkSD+gEdIMXi4PBN3AhwHGc4tWMtcjOIey3s7yb3I=";
      endpoint = "100.0.90.192:51820";
      allowedIPs = [ "10.23.0.0/16" ];
    };
  };

  registry.shell-shortcut.neogaia = {
    vpn-on = "sudo systemctl start wireguard-wg-home.target";
    vpn-off = ''sudo systemctl stop 'wireguard-wg-home*.service' wireguard-wg-home.target'';
  };

  # So setup can be driven over the network.
  # The matching host public keys sit beside this file in plaintext, since
  # publishing them is their purpose.
  modules.network.ssh.enable = true;
  modules.network.ssh.hostKeys.sopsFile = ../../secrets/neogaia.yaml;
  modules.network.ssh.userKey.sopsFile = ../../secrets/neogaia.yaml;

  modules.monorepo.enable = true;
  modules.shell.herdr.enable = true;
  modules.shell.gitea-axi.enable = true;
  modules.shell.pi.enable = true;

  modules.desktop.enable = true;
  modules.desktop.apps.firefox.uiScale = "1.25";
  modules.desktop.apps.obsidian.enable = true;
  modules.desktop.apps.steam.enable = true;

  time.timeZone = "America/New_York";
  i18n.defaultLocale = "en_GB.UTF-8";
}