{ config, pkgs, pkgs-unstable, ... }:
{
  imports = [
    ./hardware-configuration.nix
  ];

  nixpkgs.config.allowBroken = true;
  nix.settings.download-buffer-size = 524288000;
  nixpkgs.config.permittedInsecurePackages = [ "electron-33.4.11" "mono-5.20.1.34" ];

  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  boot.supportedFilesystems = [ "ntfs" ];

  services.snap.enable = false;

  networking.hostName = "limgrave";
  networking.networkmanager.enable = true;
  services.mullvad-vpn.enable = true;


  environment.sessionVariables.MOZ_ENABLE_WAYLAND = 0;

  time.timeZone = "Europe/Madrid";
  i18n.defaultLocale = "en_US.UTF-8";
  i18n.extraLocaleSettings = {
    LC_ADDRESS = "es_ES.UTF-8";
    LC_IDENTIFICATION = "es_ES.UTF-8";
    LC_MEASUREMENT = "es_ES.UTF-8";
    LC_MONETARY = "es_ES.UTF-8";
    LC_NAME = "es_ES.UTF-8";
    LC_NUMERIC = "es_ES.UTF-8";
    LC_PAPER = "es_ES.UTF-8";
    LC_TELEPHONE = "es_ES.UTF-8";
    LC_TIME = "es_ES.UTF-8";
  };

  networking.firewall = rec {
    allowedTCPPortRanges = [ { from = 1714; to = 1764; } ];
    allowedUDPPortRanges = allowedTCPPortRanges;
  };


  services.xserver = {
    enable = true;
    displayManager.gdm.enable = true;
    desktopManager.gnome.enable = true;
    windowManager.openbox.enable = true;

    xkb = {
      layout = "us";
      variant = "";
    };
  };

  services.printing.enable = true;
  hardware.pulseaudio.enable = false;
  security.rtkit.enable = true;
  hardware.graphics.enable = true;
  services.pipewire = {
    enable = true;
    alsa.enable = true;
    alsa.support32Bit = true;
    pulse.enable = true;
  };

  users.users.catalin = {
    isNormalUser = true;
    description = "catalin";
    shell = pkgs.fish;
    useDefaultShell = true;
    extraGroups = [ "networkmanager" "wheel" "docker" "nas" ];
    packages = with pkgs; [ flatpak ];
  };
  users.groups.nas.gid = 568;

  programs.firefox.enable = true;
  # Enable smart card service and eID tooling (AutoFirma stack)
  services.pcscd.enable = true;
  programs.autofirma = {
    enable = true;
    firefoxIntegration.enable = true;
  };

  nixpkgs.config.allowUnfree = true;
  services.flatpak.enable = true;
  programs.nix-ld.enable = true;

  # Merge base packages with host-specific packages
  environment.systemPackages = import ./packages.nix pkgs;

  programs = {
    fish.enable = true;
    steam = {
      enable = true;
      package = pkgs.steam.override {
        extraLibraries = p: with p; [ (lib.getLib networkmanager) ];
      };
    };
  };

  xdg.portal.enable = true;
  xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
  xdg.portal.config.common.default = "gtk";

  programs.mtr.enable = true;
  programs.dconf.enable = true;
  programs.gnupg.agent = {
    enable = true;
    enableSSHSupport = true;
  };

  systemd.services.flatpak-repo = {
    wantedBy = [ "multi-user.target" ];
    path = [ pkgs.flatpak ];
    script = ''
      flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
    '';
  };

  nix.settings.experimental-features = [ "nix-command" "flakes" ];
  nix.gc = {
    automatic = true;
    dates = "weekly";
    options = "--delete-older-than 1w";
  };

  fonts.packages = with pkgs; [
    atkinson-hyperlegible
  ];

  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  services.openssh.enable = true;
  services.tailscale.enable = true;
  virtualisation.docker.enable = true;
  networking.nameservers = [ "192.168.1.7" "1.1.1.1" ];

  nix.extraOptions = ''
    trusted-users = root catalin
  '';

  system.autoUpgrade.enable = true;
  system.stateVersion = "24.11";
}