{ pkgs, ... }:
{
  imports = [
    ./hardware-configuration.nix

    ../../modules/boot
    ../../modules/backups
    ../../modules/desktop
    ../../modules/develop
    ../../modules/networking
    ../../modules/networking/tailscale.nix
    ../../modules/virtualisation
  ];

  networking.hostName = "p14s";

  # swap & hibernate
  boot.initrd.luks.devices."luks-21284f67-5a63-41be-9354-07a0240cac50".crypttabExtraOpts = [
    "fido2-device=auto"
  ];
  boot.initrd.luks.devices."luks-d51bdb99-5966-40d3-a920-83ea78a73699" = {
    device = "/dev/disk/by-uuid/d51bdb99-5966-40d3-a920-83ea78a73699";
    crypttabExtraOpts = [ "tpm2-device=auto" ];
  };
  boot.kernelParams = [ "resume=/dev/mapper/luks-d51bdb99-5966-40d3-a920-83ea78a73699" ];
  boot.resumeDevice = "/dev/mapper/luks-d51bdb99-5966-40d3-a920-83ea78a73699";

  boot.initrd.checkJournalingFS = false;

  hardware.graphics = {
    enable = true;
    enable32Bit = true;
    extraPackages = with pkgs; [
      mesa
      vulkan-loader
      vulkan-validation-layers
    ];
    extraPackages32 = with pkgs.pkgsi686Linux; [
      mesa
      vulkan-loader
    ];
  };

  networking.firewall.allowedTCPPorts = [
    22
    8080
  ];
  networking.firewall.allowedUDPPorts = [ 8080 ];
  networking.firewall.trustedInterfaces = [
    "virbr0"
    "docker0"
  ];

  system.stateVersion = "26.05"; # yes
}