{ config, lib, pkgs, ... }:
{
  programs.zsh.enable = true;
  programs.tmux.enable = true;

  nixpkgs.config.packageOverrides = pkgs: {
    libsignal-protocol-c = pkgs.callPackage ../pkgs/libsignal-c/default.nix { };
    keycloak = pkgs.callPackage ../pkgs/keycloak/default.nix { };
  };

  networking.networkmanager.unmanaged = [ "interface-name:wg*" ];

  # TODO: replace with programs.neovim.enable
  nixpkgs.overlays = [
    (final: prev: {
      neovim = prev.neovim.override {
        viAlias = true;
        vimAlias = true;
      };
    })
  ];
  environment.variables.EDITOR = "${pkgs.neovim}/bin/nvim";

  environment.systemPackages = with pkgs; [
    bat
    bwm_ng
    clang
    coreutils
    direnv
    dnsutils
    emacs
    exa
    fd
    fzf
    git
    gitFull
    gnupg
    haskellPackages.hledger
    hledger
    htop
    iotop
    ledger
    moreutils
    mosh
    most
    neovim
    nix-index
    p7zip
    pass
    ripgrep
    rustup
    silver-searcher
    sqlite
    stow
    unrar
    unzip
    whois
    zoxide
    (rWrapper.override {
      packages = with rPackages; [
        data_table
        ggplot2
        hms
        viridis
        lubridate
      ];
    })
  ];
  time.timeZone = "America/New_York";

  services = {
    postgresql = {
      dataDir = "/var/db/postgresql";
      package = pkgs.postgresql95;
    };
    openssh.passwordAuthentication = false;
    openssh.challengeResponseAuthentication = false;
  };

  nix = rec {
    useSandbox = lib.mkDefault true;
    maxJobs = lib.mkOverride 110 16;
    buildCores = lib.mkDefault 0;  # auto configure
    gc.automatic = lib.mkDefault true;
    trustedBinaryCaches = [
      "https://cache.nixos.org"
    ];
    binaryCaches = trustedBinaryCaches;
    daemonNiceLevel = 10;
    daemonIONiceLevel = 10;
    package = pkgs.nixFlakes;
    extraOptions = ''
      experimental-features = nix-command flakes
    '';
  };

  boot.cleanTmpDir = true;

  nixpkgs.config.allowUnfree = true;
}