{
  config,
  home-manager,
  lib,
  pkgs,
  inputs,
  llama-cpp,
  ...
}:

{
  imports = [
    home-manager.nixosModules.default
  ];

  # boot options
  boot = {
    kernel.sysctl = {
      "net.ipv4.ip_forward" = true;
      "net.ipv6.conf.all.forwarding" = true;
    };

    kernelPackages = pkgs.linuxPackages_6_17;

    loader = {
      systemd-boot.enable = true;
      efi.canTouchEfiVariables = true;
    };

    supportedFilesystems = [ "zfs" ];

    zfs = {
      devNodes = "/dev/disk/by-partuuid";
      forceImportRoot = false;
    };
  };

  services = {
    # vpn
    # TODO replace with wireguard again
    tailscale = {
      enable = true;
      disableTaildrop = true;
      disableUpstreamLogging = true;
      extraUpFlags = [ "--login-server=https://controlplane.tailscale.com" ];
      openFirewall = true;
      useRoutingFeatures = "both";
    };

    # automatically scrub zfs pools (every week by default)
    zfs.autoScrub.enable = true;

    # graphical input
    libinput = {
      enable = true;

      mouse.accelProfile = "flat";

      touchpad = {
        accelProfile = "flat";
        tapping = true;
        tappingButtonMap = "lrm";
      };
    };

    # ssh
    openssh = {
      enable = true;

      settings = {
        KbdInteractiveAuthentication = false;
        PasswordAuthentication = true;
        PermitRootLogin = "no";
        X11Forwarding = true;
      };
    };

    # for yubikey
    pcscd.enable = true;

    # sound. for some reason, pipewire enabled itself when I tried
    # using pulseaudio and home-manager, so had to disable pulseaudio.
    pipewire = {
      enable = true;
      alsa.enable = true;
      audio.enable = true;
      pulse.enable = true;
      wireplumber = {
        enable = true;
        extraConfig = {
          "51-set-default-eq.conf" = {
            text = ''
              monitor.rules = [
                {
                  matches = [
                    {
                      # This rule matches the node with the name of your sink (node 35)
                      "node.name" = "effect_input.eq6"
                    }
                  ]
                  actions = {
                    update-props = {
                      # This sets a very high priority, making it the default.
                      # Standard hardware is usually around 1000.
                      "priority.session" = 2001
                    }
                  }
                }
              ]
            '';
          };
        };
      };
    };

    displayManager = {
      enable = true;
      ly.enable = true;
    };

    xserver = {
      enable = true;
      autorun = false;
      displayManager.setupCommands = ''
        xinput set-prop "Logitech USB Receiver Mouse" "libinput Accel Profile Enabled" 0 1 0
        xsetwacom set "Wacom One by Wacom S Pen stylus" MapToOutput 2304x1440+560+0

        #xrandr --output HDMI-1 --mode 1920x1080 --left-of DP-1

        xwallpaper --zoom ~/pics/wp/elite_milky_way_below2.png
      '';
      modules = [ pkgs.xf86_input_wacom ];
      wacom.enable = true;

      # config managed separately
      windowManager.stumpwm.enable = true;
    };
  };

  # extra systemd stuff
  systemd.services.sshd.after = [ "tailscaled-autoconnect.service" ];
}