{ config, modulesPath, pkgs, ... }:

let

  pubkeys = {
    labyrinth = {
      nix = "labyrinth-1:GCR2h5k9WFvome2mrFRBtiWw7sAn+pYZwXRwAj9W0b0=";
    };
  };

in

{
  imports = [
    (modulesPath + "/installer/sd-card/sd-image-aarch64.nix")

    ../../users/christian
  ];

  age.secrets = {
    wlan.file = ../../../secrets/wlan.age;
  };

  networking.wireless.enable = true;
  networking.wireless = {
    networks."@WLAN_SSID@" = {
      psk = "@WLAN_PSK@";
    };
    environmentFile = config.age.secrets.wlan.path;
  };

  services = {
    openssh.enable = true;
  };

  networking.hostName = "outpost";

  users.users = {
    christian = {
      isNormalUser = true;
      extraGroups = [ "wheel" ];
    };
  };

  environment.systemPackages = [ pkgs.raspberrypi-eeprom ];

  security = {
    sudo = {
      wheelNeedsPassword = false;
    };
  };

  nix.settings = {
    trusted-users = [ "@wheel" ]; 
    trusted-public-keys = [ pubkeys.labyrinth.nix ];
  };

  system.stateVersion = "23.11";
}