{ pkgs, unstable-pkgs, ... }: {
  boot.tmp.cleanOnBoot = true;
  zramSwap.enable = true;

  networking.hostName = "topaz";
  time.timeZone = "UTC";
  networking.firewall.enable = false;

  services.openssh.enable = true;
  services.openssh.settings.PasswordAuthentication = false;

  security.sudo.wheelNeedsPassword = false;

  users.users.charlotte = {
    isNormalUser = true;
    description = "charlotte";
    extraGroups = ["wheel"];
    shell = pkgs.zsh;
  };

  programs.zsh.enable = true;
  programs.git.enable = true;
  programs.vim = {
    enable = true;
    defaultEditor = true;
    package = unstable-pkgs.vim;
  };

  environment.shells = [ pkgs.zsh ];
  environment.variables = {
    EDITOR = "vim";
    VISUAL = "vim";
    SYSTEMD_EDITOR = "vim";
  };

  nixpkgs.config.allowUnfree = true;
  programs.nix-ld.enable = true;

  environment.systemPackages =
    (with pkgs; [gcc binutils pkg-config glibc gnumake cmake]) ++
    (with pkgs; [wget htop tmux]) ++
    (with unstable-pkgs; [vim jujutsu deno sqlite-interactive]);
  services.tailscale.enable = true;

  security.acme = {
    acceptTerms = true;
    defaults.email = "half-kh-hacker@hackery.site";
    defaults.webroot = "/var/lib/acme/acme-challenge/";
  };
  users.groups.certs = {
    members = [ "nginx" "prosody" ];
  };

  nix.settings.trusted-public-keys = [ "runestone:zZhLpoLn/vHqjINbOuxqYwEQl21ry/nqTXIE1QAd7KQ=" ];
  nix.settings.require-sigs = false;
}