{
  config,
  pkgs,
  ...
}:
{
  imports = [
    ../../features/bash.nix
    ../../features/vim.nix
    ../../features/docker.nix
    ../../features/libvirt.nix
    ../../features/avahi.nix
    ../../features/systemd-boot.nix
    ../../features/i18n.nix
    ../../features/sudo.nix
    ../../features/sops.nix
    ./nix-package-manager.nix
  ];

  services = {
    openssh.enable = true;
    resolved.enable = false;
  };

  networking = {
    useNetworkd = true;

    firewall = {
      trustedInterfaces = [ "br0" ];
      allowedTCPPorts = [ 22 ];
    };
  };

  systemd.network = {
    enable = true;

    netdevs = {
      "30-br0" = {
        netdevConfig = {
          Kind = "bridge";
          Name = "br0";
          MACAddress = "none";
        };
      };
    };

    networks = {
      "30-eno1" = {
        name = "eno1";
        bridge = [ "br0" ];
      };

      "30-br0" = {
        name = "br0";

        networkConfig = {
          DHCP = "ipv4";
          IPv6AcceptRA = true;
        };
      };
    };

    links = {
      "30-br0" = {
        matchConfig = {
          OriginalName = "br0";
        };

        linkConfig = {
          MACAddressPolicy = "none";
        };
      };
    };
  };

  users.users.frank = {
    isNormalUser = true;
    description = "Frank LoTurco";
    hashedPassword = config.sops.secrets.password_hash.path;

    extraGroups = [
      "wheel"
      "libvirtd"
    ];
  };

  environment = {
    systemPackages = with pkgs; [
      wget
      dnsmasq
      guestfs-tools
      unrar
      nil
      bash-language-server
      devenv
      weather
      borgbackup
      openjdk
      openjdk17
      openjdk25
      tmux
      ripgrep

      (python3.withPackages (
        python-pkgs: with python-pkgs; [
          requests
          pandas
        ]
      ))
    ];

    shellAliases = import ../../features/aliases.nix { inherit pkgs; };
    sessionVariables = import ../../features/xdg.nix { inherit pkgs; };
  };

  system.stateVersion = "26.05";
}