{ pkgs, config, lib, ... }:
{
  imports = [
    ./containers.nix
    ./hardware.nix
  ];

  config =
    let
      gw = config.services.hyperhive.gateway;
      old = "forge.pr1ma.darkest.space";
      new = "forge.constellation.darkest.space";
    in
    {
      my = {
        # keep-sorted start
        intelGraphics.enable = true;
        muedeDesktopSettings.enable = true;
        podman.enable = true;
        secureBoot.enable = true;
        steam.enable = true;
        users.muede.enable = true;
        wineGaming.enable = true;
        # keep-sorted end
      };

      nix.settings.extra-platforms = [
        "aarch64-linux"
        "i686-linux"
      ];

      services.xserver.xkb = {
        # Configure keymap in X11
        layout = "de";
        variant = "";
      };

      # Configure console keymap
      console.keyMap = "de";

      users.users.muede.openssh.authorizedKeys.keys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY pixel-JuiceSSH"
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1CRn4yYTL4XUdCebE8Z4ZeuMujBjorTdWifg911EOv pc2 home roaming"
      ];

      # brightnessctl's udev rules grant the `video` group write access to backlight brightness (muede is in `video`)
      environment.systemPackages = [
        pkgs.android-tools
        pkgs.brightnessctl
      ];
      services.udev.packages = [ pkgs.brightnessctl ];

      networking.firewall.allowedTCPPorts = [
        8776
        1337
      ];

      services.servicepoint-tanks = {
        enable = false;
        urls = [
          "http://localhost:5666"
          "http://localhost:5667"
        ];
      };
      nixpkgs.config.permittedInsecurePackages = [
        "mbedtls-2.28.10"
      ];

      boot.binfmt.emulatedSystems = [ "aarch64-linux" ];

      my.constellation-swarm = {
        enable = true;
        hiveName = "pr1ma";
      };
      services.hyperhive.enableAllLocalDefaults = true;
      services.nginx.enable = true;

      # DNS: the hive's resolver must still answer for the old name, or
      # nothing ever reaches the redirect. The forge module drops it from
      # this list the moment you change `swarm.forge.domain`.
      services.hyperhive.gateway.localNames = [ old ];

      services.nginx.virtualHosts.${old} = (gw.lib.tlsFor old) // {
        listen = gw.lib.listen;
        locations."/".return = "301 https://${new}$request_uri";
      };
    };
}