{ self, config, lib, pkgs, ... }:
let inherit (lib) fileContents;
in
{
	imports = [ ../cachix ];

	nix.systemFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];

	environment = {
		systemPackages = with pkgs; [
			binutils
			coreutils
			direnv
			dnsutils
			dosfstools
			git
			bottom
			gptfdisk
			iputils
			jq
			manix
			tree
			delta
			moreutils
			nix-index
			cached-nix-shell
			nmap
			ripgrep
			skim
			tealdeer
			usbutils
			utillinux
			whois
			htop
			iftop
			wget
			curl
			exa
			bat
			fd
			ag
			tcpdump
			mtr
			file
			lsof
			atool
			inotify-tools
			strace
			zip
			unzip
			rsync
			tmux
			pwgen
			glow
			gitAndTools.gitFull
			pinentry_gnome
			pass
			less
			gdb
			xxd
			kitty
			taskwarrior
			gnupg
			syncthing
			dijo
			#kdeconnect
			#ssb-patchwork
			libreoffice
			fontconfig
			pandoc
		];

		shellInit = ''
			export STARSHIP_CONFIG=${
				pkgs.writeText "starship.toml"
				(fileContents ./starship.toml)
			}
		'';

		shellAliases =
			let ifSudo = lib.mkIf config.security.sudo.enable;
			in
			{
				# quick cd
				".." = "cd ..";
				"..." = "cd ../..";
				"...." = "cd ../../..";
				"....." = "cd ../../../..";

				# modern cli tools 
				ls = "exa";
				cat = "bat";
				unzip = "aunpack";
				copy = "xclip -selection clipboard";
				paste = "xclip -selection clipboard -o";

				# task warrior
				t = "task";

				# git
				g = "git";

				# grep
				grep = "rg";
				gi = "grep -i";

				# internet ip
				myip = "dig +short myip.opendns.com @208.67.222.222 2>&1";

				# nix
				n = "nix";
				np = "n profile";
				ni = "np install";
				nr = "np remove";
				ns = "n search --no-update-lock-file";
				nf = "n flake";
				nepl = "n repl '<nixpkgs>'";
				srch = "ns nixos";
				orch = "ns override";
				nrb = ifSudo "sudo nixos-rebuild switch --flake '/etc/nixos/#curve'";
				nedit = "cd /etc/nixos; vim";
				ncd = "cd  /etc/nixos";
				mn = ''
					manix "" | grep '^# ' | sed 's/^# \(.*\) (.*/\1/;s/ (.*//;s/^# //' | sk --preview="manix '{}'" | xargs manix
				'';

				# fix nixos-option
				nixos-option = "nixos-option -I nixpkgs=${self}/lib/compat";

				# sudo
				s = ifSudo "sudo -E ";
				pls = ifSudo "s";
				si = ifSudo "sudo -i";
				se = ifSudo "sudoedit";

				# top
				top = "btm";

				# systemd
				ctl = "systemctl";
				stl = ifSudo "s systemctl";
				utl = "systemctl --user";
				ut = "systemctl --user start";
				un = "systemctl --user stop";
				up = ifSudo "s systemctl start";
				dn = ifSudo "s systemctl stop";
				jtl = "journalctl";

			};
	};

	fonts = {
		fonts = with pkgs; [ powerline-fonts dejavu_fonts ];
		fontconfig.defaultFonts = {
			monospace = [ "DejaVu Sans Mono for Powerline" ];
			sansSerif = [ "DejaVu Sans" ];
		};
	};

	nix = {
		autoOptimiseStore = true;
		gc.automatic = true;
		optimise.automatic = true;
		useSandbox = true;
		allowedUsers = [ "@wheel" ];
		trustedUsers = [ "root" "@wheel" ];
		extraOptions = ''
			min-free = 536870912
			keep-outputs = true
			keep-derivations = true
			fallback = true
		'';
	};

	programs.bash = {
		promptInit = ''
			eval "$(${pkgs.starship}/bin/starship init bash)"
		'';
		interactiveShellInit = ''
			eval "$(${pkgs.direnv}/bin/direnv hook bash)"
		'';
		enableCompletion = true;
	};

	# For rage encryption, all hosts need a ssh key pair
	services.openssh = {
		enable = true;
		openFirewall = lib.mkDefault false;
	};

	programs.gnupg.agent.enable = true;
	#programs.gnupg.agent.pinentryFlavor = "curses";
	programs.gnupg.agent.pinentryFlavor = "gnome3";

	services.earlyoom.enable = true;
}