{ config, pkgs, lib, inputs, ... }:
with lib;
{
  boot.cleanTmpDir = mkDefault true;
  boot.tmpOnTmpfs = mkDefault true;
  services.logrotate.enable = true;
  # NOTE: mostly useless on a server, and CPU intensive.
  documentation = {
    enable = mkDefault true;
    dev.enable = mkDefault false;
    doc.enable = mkDefault true;
    info.enable = mkDefault false;
    man.enable = mkDefault true;
    nixos.enable = mkDefault false;
  };
  environment.variables = {
    EDITOR = "vim";
    NIXPKGS_CONFIG = mkForce "";
    PAGER = "less -R";
    SYSTEMD_LESS = "FKMRX";
    # Setting TZ= avoids a lot of useless syscalls reading /etc/localtime
    # but requires to restart the session to change the time zone for all programs.
    TZ = config.time.timeZone;
  };
  home-manager.users.root = {
    imports = [
      ../../home-manager/options.nix
      ../../home-manager/profiles/essential.nix
    ];
  };
  systemd.services.home-manager-root.postStart = ''
    ${pkgs.nix}/bin/nix-env --delete-generations +1 --profile /nix/var/nix/profiles/per-user/root/home-manager
  '';
  nix = {
    settings.auto-optimise-store = mkDefault true;
    gc.automatic = mkDefault true;
    gc.dates = mkDefault "weekly";
    gc.options = mkDefault "--delete-older-than 7d";
    nixPath = mkForce [ ];
    registry.nixpkgs = mkDefault { flake = inputs.nixpkgs; };
    package = pkgs.nixFlakes;
    extraOptions = "experimental-features = nix-command flakes";
  };
  security.lockKernelModules = false;
  services.journald = {
    extraConfig = ''
      Compress=true
      MaxRetentionSec=1month
      Storage=persistent
      SystemMaxUse=100M
    '';
  };
  systemd.oomd = {
    enable = mkDefault true;
    enableRootSlice = mkDefault true;
    enableSystemSlice = mkDefault true;
    enableUserServices = mkDefault true;
  };
  systemd.services.openssh = {
    serviceConfig = {
      ManagedOOMPreference = "omit";
    };
  };
  /*
    system.nixos.versionSuffix = ".${
    substring 0 8 (inputs.self.lastModifiedDate or inputs.self.lastModified)}.${
    inputs.self.shortRev or "dirty"}";
    system.nixos.revision = mkIf (inputs.self ? rev) inputs.self.rev;
  */
  # Let 'nixos-version --json' know about the Git revision of this flake.
  system.configurationRevision = mkIf (inputs.self ? rev) inputs.self.rev;
  /*
    system.configurationRevision =
    if inputs.self ? rev
    then inputs.self.rev
    else throw "Refusing to build from a dirty Git tree!";
  */
  users.mutableUsers = false;
}