{
  config,
  pkgs,
  lib,
  hostInfo,
  customPkgs,
  flakeRev,
  ...
}:
let
  inherit (hostInfo) paths;
in
{
  imports = [ ./modules/autodeploy.nix ];

  services.server-autodeploy = {
    enable = true;
    giteaUrl = "https://git.floweytf.com/";
    giteaRepo = "server/server-config";
    tokenFile = "${hostInfo.paths.secrets}/gitea-autodeploy-token";
    allowedSigners = [
      "flowey@arch namespaces=\"git\" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPaGpTX3EzfezVc2nl3MgsKVamYYP2h2VJaRny8pZkvi"
    ];
    stateDir = hostInfo.paths.config;
    repoOwner = "server";
  };

  assertions =
    let
      isMounted =
        path:
        lib.any (
          # rootfs may be subject to erasure so it's not persistent
          fs: fs.mountPoint != "/" && (fs.mountPoint == path || lib.hasPrefix "${fs.mountPoint}/" path)
        ) (lib.attrValues config.fileSystems);

      isMountedEarly = path: (config.fileSystems.${path} or { neededForBoot = false; }).neededForBoot;

      mountAssertion = path: {
        assertion = isMounted path;
        message = "configuration.nix needs '${path}' to be a mounted path, but no fileSystems entry covers it.";
      };

      earlyMountAssertion = path: {
        assertion = isMountedEarly path;
        message = "configuration.nix needs '${path}' to be mounted early (neededForBoot = true), but its fileSystems entry doesn't set that.";
      };

      strictPaths = lib.optionals (!hostInfo.isVm) [
        "/nix"
        "/var/log"
      ];
    in
    map mountAssertion (
      [
        paths.server
        paths.secrets
      ]
      ++ strictPaths
    )
    ++ lib.optionals (!hostInfo.isVm) [ (earlyMountAssertion "/var/log") ];

  time.timeZone = "UTC";
  system.stateVersion = "26.05";
  system.nixos.label =
    let
      labelFile = ./.nixos-label;
    in
    if builtins.pathExists labelFile then
      lib.removeSuffix "\n" (builtins.readFile labelFile)
    else
      flakeRev;

  nix = {
    settings = {
      experimental-features = [
        "nix-command"
        "flakes"
      ];
    };
    nrBuildUsers = 80;
  };

  powerManagement.cpuFreqGovernor = "performance";

  boot.kernelParams = [ "transparent_hugepage=madvise" ];

  services = {
    fstrim = {
      enable = true;
      interval = "weekly";
    };

    openssh = {
      enable = true;
      ports = [ 5952 ];
      hostKeys =
        lib.map
          (type: {
            inherit type;
            path = "${paths.secrets}/ssh_host_${type}_key";
          })
          [
            "ed25519"
            "ecdsa"
            "rsa"
          ];
      settings.PasswordAuthentication = false;
    };
  };

  users.mutableUsers = false;
  users.users.server = {
    uid = 1000;
    isNormalUser = true;
    extraGroups = [
      "wheel"
      "systemd-journal"
    ];
    hashedPassword = "!";
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPaGpTX3EzfezVc2nl3MgsKVamYYP2h2VJaRny8pZkvi flowey@arch"
    ];
  };

  security.sudo.wheelNeedsPassword = false;

  security.polkit.extraConfig = ''
    polkit.addRule(function(action, subject) {
      if (action.id.startsWith("org.freedesktop.machine1.") &&
          subject.user === "server") {
        return polkit.Result.YES;
      }
    });
  '';

  systemd.tmpfiles.rules = [
    "L /home/server/config     - - - - /persist/@configuration"
    "L /home/server/containers - - - - /persist/@containers"
    "L /home/server/secrets    - - - - /persist/@secrets"
  ];

  environment.etc."machine-id".text = "${
    builtins.substring 0 32 (builtins.hashString "sha256" "machine-id-for-${hostInfo.hostname}")
  }\n";
  environment.systemPackages = [
    customPkgs.ct
    customPkgs.server-rebuild
    customPkgs.server-status
    customPkgs.server-kexec
    customPkgs.kitty-terminfo
    pkgs.git
    pkgs.wezterm.terminfo
  ];

  networking.firewall.allowedTCPPorts = [ 5952 ];

  system.activationScripts.server-keypair = ''
    if [[ ! -f "${paths.server}/keypair/id_ed25519" ]]; then
      mkdir -p "${paths.server}/keypair"
      ${lib.getExe' pkgs.openssh "ssh-keygen"} -t ed25519 -f "${paths.server}/keypair/id_ed25519" -N ""
    fi
  '';
}