{ inputs, lib, pkgs, ... }: {
  boot.loader = {
    systemd-boot.enable = true;
    efi.canTouchEfiVariables = true;
  };

  nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
    "osu-lazer-bin"
    "unrar"
    "steam"
    "steam-original"
    "corefonts"
    "vista-fonts"
    "steam-unwrapped"
  ];

  nixpkgs.config.permittedInsecurePackages = [
    "jitsi-meet-1.0.8043"
    "electron-28.3.3"
    "electron-27.3.11"
  ];

  documentation = {
    enable = true;
    doc.enable = true;
    info.enable = true;
    man.enable = true;
    dev.enable = true;
  };

  environment.systemPackages = with pkgs; [
    man-pages
    man-pages-posix
  ];

  nix = {
    settings = {
      # hardlink duplicate files in the nix store
      auto-optimise-store = true;
    };

    extraOptions = ''
      experimental-features = nix-command flakes

      # keep intermediary deps alive (no redownloading to rebuild after gc)
      keep-outputs = true
      keep-derivations = true

      builders-use-substitutes = true
    '';

    # flake registries are used by the new nix commands.
    # this binds the nixpkgs registry to the one in `flake.nix`.
    registry = {
      nixpkgs.flake = inputs.nixpkgs;
      stable.flake = inputs.stable;
    };

    # the nix path is used to discover channels for the old nix commands.
    # this binds the nix path to the channels following `flake.nix` declared below.
    nixPath = [
      "nixpkgs=/etc/nix/inputs/nixpkgs"
      "stable=/etc/nix/inputs/stable"
    ];

    distributedBuilds = true;
    buildMachines = [ {
      hostName = "192.168.2.1";
      system = "x86_64-linux";
      protocol = "ssh-ng";
      supportedFeatures = [ "big-parallel" "kvm" "nixos-test" "benchmark" ];
      speedFactor = 100;
      maxJobs = 16;
      sshUser = "nix-remote-build";
      sshKey = "/root/.ssh/id_build_server";
    } ];
  };

  # add entries for `nixPath` above.
  environment.etc = {
    "nix/inputs/nixpkgs".source = inputs.nixpkgs.outPath;
    "nix/inputs/stable".source = inputs.stable.outPath;
  };

  # allow processes to request scheduling priority
  security.rtkit.enable = true;

  services.pipewire = {
    enable = true;
    alsa.enable = true;
    alsa.support32Bit = true;
    pulse.enable = true;
    jack.enable = true;
  };
}