{
  pkgs,
  lib,
  ...
}:
{
  imports = [
    ./constellation-swarm.nix
    ./containers.nix
    ./hardware.nix
  ];

  my = {
    # keep-sorted start
    intelGraphics.enable = true;
    muedeDesktopSettings.enable = true;
    podman.enable = true;
    secureBoot.enable = true;
    steam.enable = true;
    users.muede.enable = true;
    wineGaming.enable = true;
    # keep-sorted end
  };

  nix.settings.extra-platforms = [
    "aarch64-linux"
    "i686-linux"
  ];

  # Global default (nixosModules/distributed-builds.nix) is MemoryMax=90%,
  # which isn't tight enough on this machine's 31GiB to avoid OOM.
  systemd.services.nix-daemon.serviceConfig = {
    MemoryHigh = "60%";
    MemoryMax = lib.mkForce "80%";
  };

  services.xserver.xkb = {
    # Configure keymap in X11
    layout = "de";
    variant = "";
  };

  # Configure console keymap
  console.keyMap = "de";

  users.users.muede.openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY pixel-JuiceSSH"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1CRn4yYTL4XUdCebE8Z4ZeuMujBjorTdWifg911EOv pc2 home roaming"
  ];

  # brightnessctl's udev rules grant the `video` group write access to backlight brightness (muede is in `video`)
  environment.systemPackages = [
    pkgs.android-tools
    pkgs.brightnessctl
  ];
  services.udev.packages = [ pkgs.brightnessctl ];

  networking.firewall.allowedTCPPorts = [
    8776
    1337
  ];

  services.servicepoint-tanks = {
    enable = false;
    urls = [
      "http://localhost:5666"
      "http://localhost:5667"
    ];
  };
  nixpkgs.config.permittedInsecurePackages = [
    "mbedtls-2.28.10"
  ];

  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
}