{
  lib,
  inputs,
  pkgs,
  ...
}: {
  imports = [
    ./disks.nix
    ./battery.nix

    inputs.nixos-facter-modules.nixosModules.facter
    inputs.lanzaboote.nixosModules.lanzaboote
  ];

  facter.reportPath = ./facter.json;
  services.dbus.implementation = "broker";

  environment.defaultPackages = lib.mkForce []; # im not a noob

  services.syncthing = {
    enable = true;
    user = "collin";
    dataDir = "/home/collin/.local/syncthing";
  };
  programs.kdeconnect.enable = true;

  security.soteria.enable = true;

  virtualisation.podman = {
    enable = true;
    dockerCompat = true;
  };
  users.users.collin = {
    extraGroups = ["podman"];
    subGidRanges = [
      {
        count = 65536;
        startGid = 100000;
      }
    ];
    subUidRanges = [
      {
        count = 65536;
        startUid = 100000;
      }
    ];
  };

  services.jupyter = {
    enable = true;
    ip = "127.0.0.1";
    port = 8888;

    user = "collin"; # to access my files

    package = pkgs.python313Packages.jupyter;
    command = "jupyter lab --ServerApp.token='' --ServerApp.password=''";
    password = "";

    notebookDir = "~/brain/notes/schoolyear2025/physics";

    kernels = {
      python3 = let
        python = pkgs.python313.withPackages (ps:
          with ps; [
            numpy
            pandas
            matplotlib
            sympy
            ipywidgets
            ipydatagrid
            ipykernel
          ]);
      in {
        language = "python";
        displayName = "Python (Physics)";
        argv = ["${python}/bin/python" "-m" "ipykernel_launcher" "-f" "{connection_file}"];
      };
    };
  };

  fileSystems."/home/collin/ganymede" = {
    device = "collin@ganymede:/media";
    fsType = "fuse.sshfs";
    options = [
      "identityfile=/home/collin/.ssh/id_ed25519"
      "idmap=user"
      "x-systemd.automount" #< mount the filesystem automatically on first access
      "allow_other" #< don't restrict access to only the user which `mount`s it (because that's probably systemd who mounts it, not you)
      "user" #< allow manual `mount`ing, as ordinary user.
    ];
  };
  boot.supportedFilesystems."fuse.sshfs" = true;

  services.autossh.sessions = [
    {
      name = "ganymede";
      user = "collin";
      monitoringPort = 20000;
      extraArguments = "-N -D 9090 collin@williamsfam.us.com";
    }
  ];
  programs.ssh.extraConfig = ''
    Host ganymede
      HostName williamsfam.us.com
      Port 22
  '';
  security.pki.certificates = [
    ''
      -----BEGIN CERTIFICATE-----
      MIIBozCCAUmgAwIBAgIQbfaguvgtbo/JBep9INWMFjAKBggqhkjOPQQDAjAwMS4w
      LAYDVQQDEyVDYWRkeSBMb2NhbCBBdXRob3JpdHkgLSAyMDI1IEVDQyBSb290MB4X
      DTI1MTIyMzIzMTExMFoXDTM1MTEwMTIzMTExMFowMDEuMCwGA1UEAxMlQ2FkZHkg
      TG9jYWwgQXV0aG9yaXR5IC0gMjAyNSBFQ0MgUm9vdDBZMBMGByqGSM49AgEGCCqG
      SM49AwEHA0IABNWAL+OmSvNI1twW7CjWtVTj9PH86ejV52Tl/VKtTqacbAgS+TdU
      aaekC0skEI1BNc76lsD84yRydvci1om1vv2jRTBDMA4GA1UdDwEB/wQEAwIBBjAS
      BgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBShYvNluMWdF4EwkTWJgcBe8Foe
      XzAKBggqhkjOPQQDAgNIADBFAiEAkoloryXWPdw50LtidCzi9lZDScU2Uofpp8ie
      uc1PJgQCIBy3BQIcEh9ChGJ1cIrop43zMA4C9O8HwytFX11YpZnF
      -----END CERTIFICATE-----
    ''
  ];

  programs.firefox.policies.ExtensionSettings = {
    "foxyproxy@eric.h.jung" = {
      installation_mode = "force_installed";
      install_url = "https://addons.mozilla.org/firefox/downloads/latest/foxyproxy-standard/latest.xpi";
    };
  };
}