{
  config,
  pkgs,
  lib,
  inputs,
  ...
}: {
  imports = [
    inputs.disko.nixosModules.disko
    inputs.nixos-facter-modules.nixosModules.facter
    ./disks.nix

    ./iwlwifi.nix
    ./caddy.nix
  ];

  facter.reportPath = ./facter.json;

  virtualisation.oci-containers.backend = "docker"; # fix weird issue with minecraft server (only thing running in docker right now)

  # backup usb teather configuration
  systemd.network.networks."80-usb-teather" = {
    name = "enp0s20f0u2";
    networkConfig.DHCP = "yes";
  };

  systemd.services."disable-wifi-powersave" = {
    description = "Disable wifi powersaving using iw";
    after = ["network.target"];
    serviceConfig.ExecStart = "${pkgs.iw}/bin/iw dev wlp108s0 set power_save off";
    wantedBy = ["default.target"];
  };

  # VPN to server
  systemd.network = {
    netdevs."10-wg0" = {
      netdevConfig = {
        Kind = "wireguard";
        Name = "wg0";
      };
      wireguardConfig = {
        PrivateKeyFile = config.collinux.secrets."wireguard-pk".path;
        ListenPort = 51820;
      };
      wireguardPeers = [
        {
          PublicKey = "seOq75FUGb+KThvOXCEAGdabWbb+jTRUntITpuAPgWA=";
          AllowedIPs = "0.0.0.0/0";
          Endpoint = "20.251.8.247:51820";
          PersistentKeepalive = 25;
        }
      ];
    };
    networks."wg0" = {
      matchConfig.Name = "wg0";
      address = ["10.100.0.2/24"];
      DHCP = "no";
      networkConfig.IPv6AcceptRA = false;
    };
  };

  # deploy user
  users.groups."deploy" = {};
  users.users."deploy" = {
    isSystemUser = true;
    group = "deploy";

    openssh.authorizedKeys.keys = config.users.users."collin".openssh.authorizedKeys.keys;
  };
  security.sudo.extraRules = [
    {
      users = ["deploy"];
      commands = [
        {
          command = "/nix/store/*/bin/switch-to-configuration";
          options = ["NOPASSWD"];
        }
        {
          command = "/run/current-system/sw/bin/shutdown";
          options = ["NOPASSWD"];
        }
      ];
    }
  ];

  services.fail2ban.enable = true;

  # merge logs from subdomains
  services.caddy.virtualHosts."up.williamsfam.us.com".logFormat = lib.mkForce ''
    output file /var/log/caddy/access-williamsfam.us.com.log
  '';

  # i broke something and this fixes it
  environment.etc."systemd/resolved.conf.d/10-dns.conf".text = config.environment.etc."systemd/resolved.conf".text;
}