{
  config,
  lib,
  pkgs,
  ...
}:

{

  age.enable = true;
  age.identityPaths = [ "/var/lib/misc/key.age" ];
  age.secrets.easyroam.file = ./secrets/easyroam.age;
  services.easyroam = {
    enable = true;
    pkcsFile = config.age.secrets.easyroam.path;
    networkmanager.enable = true;
  };
  systemd.services.wpa_supplicant = {
    wants = [ "easyroam-cert-setup.service" ];
    after = [ "easyroam-cert-setup.service" ];
  };
  hardware.graphics.enable = true;
  services.xserver.videoDrivers = lib.mkIf (config.networking.hostName == "nerv") [ "nvidia" ];
  hardware.nvidia = lib.mkIf (config.networking.hostName == "nerv") {
    modesetting.enable = true;
    open = true;
    package = config.boot.kernelPackages.nvidiaPackages.new_feature;
  };
  environment.sessionVariables.NIXOS_OZONE_WL = "1";
  boot.loader.systemd-boot.enable = false;
  boot.loader.efi.canTouchEfiVariables = true;
  boot.loader.limine = {
    enable = true;
    extraEntries = lib.mkIf (config.networking.hostName == "nerv") ''
      /Windows 11
       protocol: efi
       path: uuid(6E25-7E8D):/EFI/Microsoft/Boot/bootmgfw.efi
    '';

  };
  boot.kernelPackages = pkgs.linuxPackages_latest;

  networking.networkmanager.enable = true;

  time.timeZone = "Europe/Berlin";
  i18n.defaultLocale = "en_US.UTF-8";
  i18n.extraLocaleSettings = {
    LC_ADDRESS = "de_DE.UTF-8";
    LC_IDENTIFICATION = "de_DE.UTF-8";
    LC_MEASUREMENT = "de_DE.UTF-8";
    LC_MONETARY = "de_DE.UTF-8";
    LC_NAME = "de_DE.UTF-8";
    LC_NUMERIC = "de_DE.UTF-8";
    LC_PAPER = "de_DE.UTF-8";
    LC_TELEPHONE = "de_DE.UTF-8";
    LC_TIME = "de_DE.UTF-8";
  };
  services.displayManager.gdm.enable = true;
  services.emacs.enable = false;
  services.xserver.xkb = {
    layout = "eu";
    variant = "";
  };
  services.printing.enable = true;
  services.pulseaudio.enable = false;
  security.rtkit.enable = true;
  services.upower.enable = true;

  # add niri
  security.polkit.enable = true; # polkit
  security.polkit.enablePkexecWrapper = true;
  services.gnome.gnome-keyring.enable = true;
  services.gvfs.enable = true;
  services.udisks2.enable = true;
  programs.niri.enable = true;
  services.pipewire = {
    enable = true;
    alsa.enable = true;
    alsa.support32Bit = true;
    pulse.enable = true;
  };
  programs.nixcord = {
    enable = true;
    user = "lucy";
    discord.enable = false;
    vesktop.enable = true;
    config.plugins = {
      messageLogger.enable = true;
      messageClickActions.enable = true;
    };
    config.enabledThemes = [ "tinted.css" ];
  };
  programs.mango.enable = true;
  users.users."lucy" = {
    isNormalUser = true;
    description = "lucy";
    extraGroups = [
      "networkmanager"
      "wheel"
    ];
    packages = with pkgs; [
      stow
      ufetch
      rbw
      clang
      clang-tools
      gnumake
      emacs
      tinty
      foot
      pinentry-gnome3
      git
      nixd
      nixfmt
      xournalpp
      btop
      chromium
      fuzzel
      quickshell
      kdePackages.qtdeclarative
      jq
      grim
      slurp
      wl-clipboard
      adw-gtk3
      papirus-icon-theme
      apple-cursor
      polkit_gnome
      xwayland-satellite
      nautilus
    ];
  };
  fonts.packages = with pkgs; [
    jetbrains-mono
    nerd-fonts.jetbrains-mono
    noto-fonts
    noto-fonts-cjk-sans
    noto-fonts-color-emoji
    inter
  ];
  programs.chromium.enable = true;
  programs.chromium.extensions = [
    "nngceckbapebfimnlniiiahkandclblb" # bitwarden
    "ddkjiahejlhfcafbddmgiahcphecmpfh" # ublock origin lite
  ];
  nixpkgs.config.allowUnfree = true;
  nix.settings.experimental-features = [
    "nix-command"
    "flakes"
  ];
  environment.etc = {
    "chromium" = {
      enable = true;
      mode = "symlink";
      source = "/home/lucy/.local/share/tinted-theming/tinty/tinted-chromium-build-file.json";
      target = "chromium/policies/managed/theme.json";
    };
  };
  system.stateVersion = "26.05"; # Did you read the comment?

}