{
  config,
  lib,
  pkgs,
  inputs,
  ...
}:
# Shared base config carried by every host.
let
  inherit (lib) mkOption types;
  user = config.user;

  # Args to instantiate an extra nixpkgs source on the base platform.
  pinArgs = prev: {
    inherit (prev.stdenv.hostPlatform) system;
    config.allowUnfree = true;
  };
in
{
  options.user = {
    name = mkOption {
      type = types.str;
      default = "alexion";
      description = ''
        The primary interactive user this host is built for. Drives both the
        system account and the home-manager user in lockstep.
      '';
    };
    description = mkOption {
      type = types.str;
      default = "Alexion";
      description = "Human-readable description (GECOS field) for the primary user.";
    };
  };

  config = {
    # Reach fresher packages with `unstable.<name>` or pin with `stable.<name>`.
    # chaotic's overlay is added by its own module, not here.
    nixpkgs.overlays = [
      (_final: prev: {
        unstable = import inputs.nixpkgs-unstable (pinArgs prev);
        stable = import inputs.nixpkgs-stable (pinArgs prev);
      })
    ];
    nixpkgs.config.allowUnfree = true;

    # Flakes, so `nixos-rebuild switch` works from the console.
    nix.settings.experimental-features = [
      "nix-command"
      "flakes"
    ];

    # chaotic's binary cache, so the CachyOS kernel is fetched rather than
    # compiled. The `extra-` prefix keeps cache.nixos.org alongside it.
    nix.settings.extra-substituters = [ "https://nyx-cache.chaotic.cx/" ];
    nix.settings.extra-trusted-public-keys = [
      "nyx-cache.chaotic.cx:dJxTrgMC3V3cFfyIiBQDQorG6k1LsqurH/srpMSq7qk="
    ];
    environment.systemPackages = [ pkgs.git ];

    # Primary user, in the wheel group. No password set here.
    users.users.${user.name} = {
      isNormalUser = true;
      description = user.description;
      extraGroups = [ "wheel" ];
    };

    # home-manager as a NixOS module: one `nixos-rebuild switch` builds the
    # system and user environment together, sharing the system's pkgs and
    # installing user packages into the system profile.
    home-manager = {
      useGlobalPkgs = true;
      useUserPackages = true;
      extraSpecialArgs = {
        inherit inputs;
        my = inputs.self.lib;
      };
      users.${user.name} = {
        home.username = user.name;
        home.homeDirectory = "/home/${user.name}";
        home.stateVersion = "26.05";
      };
    };
  };
}