{ config, pkgs, lib, inputs, ... }:
{
  imports = [
    #../nixos/profiles/debug.nix
    ../nixos/profiles/lang-fr.nix
    ../nixos/profiles/security.nix
    ../nixos/profiles/system.nix
    #../nixos/profiles/tor.nix
    aubergine/hardware.nix
    aubergine/networking.nix
  ];

  # Lower kernel's security for better performances
  boot.kernelParams = [ "mitigations=off" ];

  home-manager.users.julm = {
    imports = [ ../homes/julm.nix ];
  };
  systemd.services.home-manager-julm.postStart = ''
    ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/julm/home-manager
  '';
  users.users.julm = {
    isNormalUser = true;
    uid = 1000;
    # Put the hashedPassword in /nix/store, but it will also be in /etc/passwd
    # which is already world readable.
    # printf %s $(mkpasswd -m md5crypt)
    hashedPassword = lib.readFile aubergine/users/julm/login/hashedPassword.clear;
    extraGroups = [
      "adbusers"
      "dialout"
      "networkmanager"
      "tor"
      "wheel"
    ];
    # If created, zfs-mount.service would require:
    # zfs set overlay=yes ${hostName}/home
    createHome = true;
    openssh.authorizedKeys.keys = map lib.readFile [
      ../users/root/ssh/losurdo.pub
      ../users/julm/ssh/losurdo.pub
      ../users/julm/ssh/oignon.pub
      ../users/julm/ssh/redmi.pub
    ];
  };
  users.users.root = {
    hashedPassword = "!";
    openssh.authorizedKeys.keys =
      config.users.users.julm.openssh.authorizedKeys.keys;
  };

  #systemd.services.nix-daemon.serviceConfig.LoadCredentialEncrypted =
  #  "secret-key-files:" + aubergine/nix/secret-key-files;
  nix = {
    extraOptions = ''
      #secret-key-files = /run/credentials/nix-daemon.service/secret-key-files.pem
    '';
    settings = {
      trusted-users = [ config.users.users."julm".name ];
      substituters = [
        #"http://nix-localcache.losurdo.wg"
        #"ssh://nix-ssh@losurdo.wg?priority=30"
        #"ssh://nix-ssh@oignon.wg?priority=30"
      ];
      trusted-public-keys = map lib.readFile [
        ../users/root/nix/oignon.pub
      ];
    };
    nixPath = lib.mkForce [ "nixpkgs=${inputs.nixpkgs}" ];
  };
  #environment.etc."nixpkgs".source = pkgs.path;
  #environment.etc."nixpkgs-overlays".source = inputs.self + "/nixpkgs";

  nix.settings.allowed-users = [ config.users.users."nix-ssh".name ];
  nix.sshServe = {
    enable = true;
    keys = map lib.readFile [
      ../users/julm/ssh/losurdo.pub
      ../users/sevy/ssh/patate.pub
      ../users/julm/ssh/oignon.pub
    ];
  };

  environment.systemPackages = [
  ];

  boot.extraModulePackages = [
    #config.boot.kernelPackages.v4l2loopback
  ];

  # This value determines the NixOS release with which your system is to be
  # compatible, in order to avoid breaking some software such as database
  # servers. You should change this only after NixOS release notes say you should.
  system.stateVersion = "22.11"; # Did you read the comment?
}