{ user }:
{
  pkgs,
  inputs,
  lib,
  config,

  ...
}:
{
  imports = [
    inputs.sops-nix.nixosModules.sops
  ];

  nix.settings = {
    trusted-users = [ "@wheel" ];
    experimental-features = [
      "nix-command"
      "flakes"
    ];
    auto-optimise-store = true;
  };

  programs.nh = {
    enable = true;
    clean.enable = false;
    clean.extraArgs = "--keep-since 4d --keep 2";
    flake = "/home/${user}/.config/beeSystems";
  };

  boot.loader = {
    efi.canTouchEfiVariables = true;
    timeout = 50;
    grub = {
      enable = true;
      device = "nodev";
      efiSupport = true;
      useOSProber = true;
      splashImage = null;
      theme = null;
      configurationLimit = 4;
    };
  };

  services.kanata = {
    enable = true;
    keyboards.default = {
      extraDefCfg = "process-unmapped-keys yes";

      config = ''
        (defsrc
          esc   caps  rctrl f1
        )

        (defalias
          capesc (tap-hold-press 200 200 esc lctrl)

          game   (layer-switch gaming)
          base   (layer-switch base)
        )

        (deflayer base
          caps     @capesc  @game f1
        )

        (deflayer gaming
          caps     lctrl    @base esc
        )
      '';
    };
  };

  time.timeZone = "Asia/Kolkata";
  i18n.defaultLocale = "en_US.UTF-8";
  i18n.extraLocaleSettings = {
    LC_ADDRESS = "en_IN";
    LC_IDENTIFICATION = "en_IN";
    LC_MEASUREMENT = "en_IN";
    LC_MONETARY = "en_IN";
    LC_NAME = "en_IN";
    LC_NUMERIC = "en_IN";
    LC_PAPER = "en_IN";
    LC_TELEPHONE = "en_IN";
    LC_TIME = "en_IN";
  };

  services.displayManager.ly = {
    enable = true;
    x11Support = false;
    settings = {
      load = true;
      save = true;
    };
  };

  security.pam.services.ly.enableGnomeKeyring = true;
  security.pam.services.login.enableGnomeKeyring = true;

  nixpkgs = {
    config = {
      allowUnfree = true;
      # doInstallCheckByDefault = false;
    };
  };
  # nix.registry.${user}.flake = inputs.self;
  # nix.registry.nixpkgs.flake = inputs.nixpkgs;

  # TODO network provider fallback
  # networking.networkmanager.wifi.powersave = false;
  # networking.networkmanager = {
  # enable = true;
  # dns = "none";
  # dns = lib.mkForce "none";
  # insertNameservers = [
  #   "9.9.9.9" # Quad9
  #   "149.112.112.112" # Quad9 (Backup)
  #   "1.1.1.1" # Cloudflare
  #   "1.0.0.1" # Cloudflare (Backup)
  # ];
  # };

  networking.networkmanager = {
    enable = true;
    dns = "systemd-resolved";
  };

  services.resolved = {
    enable = true;
    settings.Resolve = {
      DNSOverTLS = "opportunistic";
      DNSSEC = "allow-downgrade";
      Domains = [ "~." ];
      DNS = [
        # Quad9 IPv4
        "9.9.9.9#dns.quad9.net"
        "149.112.112.112#dns.quad9.net"

        # Quad9 IPv6
        "2620:fe::fe#dns.quad9.net"
        "2620:fe::9#dns.quad9.net"

        # Cloudflare IPv4
        # "1.1.1.1#cloudflare-dns.com"
        # "1.0.0.1#cloudflare-dns.com"

        # Cloudflare IPv6
        # "2606:4700:4700::1111#cloudflare-dns.com"
        # "2606:4700:4700::1001#cloudflare-dns.com"
      ];
    };
  };

  hardware.bluetooth.enable = true;
  hardware.bluetooth.powerOnBoot = false;
  services.blueman.enable = false;

  hardware.enableRedistributableFirmware = true;

  services.libinput.enable = true;
  services.libinput.touchpad = {
    naturalScrolling = true;
    disableWhileTyping = true;
  };

  services.xserver.xkb = {
    layout = "us";
    variant = "";
  };

  services.pipewire = {
    enable = true;
    alsa.enable = true;
    alsa.support32Bit = true;
    pulse.enable = true;
    wireplumber.enable = true;
    jack.enable = false;
  };

  security.rtkit.enable = true;
  security.polkit.enable = true;

  fonts.fontDir.enable = true;
  fonts.packages = with pkgs; [
    nerd-fonts.iosevka
    # inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.iosevka-input
    # nerd-fonts.symbols-only
    noto-fonts
    noto-fonts-cjk-sans-static
  ];

  fonts.fontconfig.defaultFonts.monospace = [
    "Iosevka Nerd Font"
    "IosevkaInput"
    "Symbols Nerd Font"
  ];

  programs.nano.enable = false;
  programs.gnupg.agent = {
    enable = true;
    enableSSHSupport = true;
    pinentryPackage = lib.mkForce pkgs.pinentry-gnome3;
  };

  sops = {
    defaultSopsFile = ../secrets/secrets.yaml;
    defaultSopsFormat = "yaml";
    age.keyFile = "/home/${user}/.config/sops/age/keys.txt";
    secrets.gpg_private_key = {
      owner = user;
      mode = "0400";
    };
  };

  systemd.services.import-gpg-key = {
    description = "Import GPG key from sops secret";
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      User = user;
    };
    path = [
      pkgs.gnupg
      pkgs.gawk
    ];
    script = ''
      GPG_KEY="/run/secrets/gpg_private_key"
      if [ -f "$GPG_KEY" ]; then
        gpg --batch --import "$GPG_KEY" || true
        KEY_FP=$(gpg --batch --with-colons --list-secret-keys | awk -F: '/^fpr:/{print $10; exit}')
        if [ -n "$KEY_FP" ]; then
          echo "$KEY_FP:6:" | gpg --batch --import-ownertrust || true
        fi
      fi
    '';
  };

  services.upower.enable = true;
  services.earlyoom.enable = false;
  services.fwupd.enable = false;
  services.gnome.gnome-keyring.enable = true;
  services.power-profiles-daemon.enable = true;
  services.printing.enable = false;
  services.openssh.enable = false;
  services.dbus.enable = true;

  services.gvfs.enable = true;
  services.udisks2.enable = true;

  environment.systemPackages = with pkgs; [
    android-tools
    scrcpy
    playerctl
    pciutils
    sops
    fd
    ripgrep
    bat
  ];
}