{ lib, pkgs, unstable-pkgs, user-pkgs, ... }:
let
  vmBase = import ../../modules/vm-base.nix;
in
{
  microvm.host.enable = true;

  networking.useNetworkd = true;
  networking.useDHCP = false;
  networking.networkmanager.enable = lib.mkForce false;

  systemd.network = {
    enable = true;
    netdevs."10-br0" = {
      netdevConfig = {
        Kind = "bridge";
        Name = "br0";
      };
    };
    networks."10-lan" = {
      # en*: the physical NIC (verify on runestone via `ip link`).
      # vm-*: microvm tap interfaces, enslaved to the same bridge.
      matchConfig.Name = [ "en*" "vm-*" ];
      networkConfig.Bridge = "br0";
    };
    networks."20-br0" = {
      matchConfig.Name = "br0";
      address = [ "10.11.0.2/16" ];
      networkConfig.Gateway = "10.11.0.1";
      networkConfig.DNS = [ "10.11.0.1" ];
      networkConfig.IPv6AcceptRA = true;
      linkConfig.RequiredForOnline = "routable";
    };
  };

  systemd.tmpfiles.settings."05-vm-workspace" = {
    "/x/vm".d = { user = "charlotte"; group = "users"; mode = "0755"; };
    "/x/vm/lazuli".d = { user = "charlotte"; group = "users"; mode = "0755"; };
  };

  microvm.vms.lazuli = {
    pkgs = null;
    specialArgs = { inherit unstable-pkgs user-pkgs; };
    config = {
      microvm.mem = lib.mkForce 16384;

      imports = [
        ../common/base.nix
        ../common/dev.nix
        ../common/locale.nix
        ../lazuli/computer-use.nix
        ../../modules/dotfiles.nix
        (vmBase {
          hostName = "lazuli";
          ipAddress = "10.11.1.1";
          tapId = "vm-lazuli";
          mac = "02:00:00:00:00:01";
        })
      ];
    };
  };
}