{
  config,
  lib,
  ...
}:
let
  cfg = config.modules.host;
  user = config.user;
  passwordSecret = "${user.name}-password";
in
{
  options.modules.host.enable = lib.mkEnableOption "physical-host base configuration";

  config = lib.mkIf cfg.enable {
    nix.settings.extra-substituters = [ "https://nyx-cache.chaotic.cx/" ];
    nix.settings.extra-trusted-public-keys = [
      "nyx-cache.chaotic.cx:dJxTrgMC3V3cFfyIiBQDQorG6k1LsqurH/srpMSq7qk="
    ];

    nix.gc.automatic = true;
    nix.gc.dates = "Mon 03:15";
    nix.gc.options = "--delete-older-than 30d";

    nix.optimise.automatic = true;
    nix.optimise.dates = [ "Thu 03:45" ];

    boot.loader.systemd-boot.configurationLimit = 15;

    services.xserver.xkb.layout = "us";
    services.xserver.xkb.options = "caps:escape_shifted_capslock";
    console.useXkbConfig = true;

    sops.defaultSopsFile = ../secrets/shared.yaml;
    sops.age.keyFile = "/var/lib/sops-nix/key.txt";
    sops.age.sshKeyPaths = [ ];
    sops.gnupg.sshKeyPaths = [ ];

    users.mutableUsers = false;
    sops.secrets.${passwordSecret}.neededForUsers = true;
    users.users.${user.name}.hashedPasswordFile = config.sops.secrets.${passwordSecret}.path;
  };
}