{ lib, pkgs, inputs, ... }:
let
  concordSession = pkgs.writeShellScriptBin "concord-session" ''
    set -eu

    runtime_dir="''${XDG_RUNTIME_DIR:-/tmp}"
    session_dir="$(mktemp -d "$runtime_dir/concord-session.XXXXXX")"

    cleanup() {
      rm -rf -- "$session_dir"
    }

    trap cleanup EXIT
    trap 'exit 129' HUP
    trap 'exit 130' INT
    trap 'exit 143' TERM

    config_home="$session_dir/config"
    state_home="$session_dir/state"
    mkdir -p "$config_home" "$state_home"

    cat > "$config_home/config.toml" <<'EOF'
[credentials]
store = "plain"
EOF

    XDG_CONFIG_HOME="$config_home" \
      XDG_STATE_HOME="$state_home" \
      "${inputs.concord.packages.${pkgs.system}.default}/bin/concord" "$@"
  '';
in
{
  imports = [
    ./hardware-configuration.nix
    "${inputs.self}/modules/mizukios/base"
    "${inputs.self}/modules/mizukios/features/system/boot.nix"
    "${inputs.self}/modules/mizukios/features/remote/ssh.nix"
    "${inputs.self}/modules/mizukios/features/management/podman.nix"

    ./services/quadlet/authentik.nix
    ./services/quadlet/conduit.nix
    ./services/quadlet/paste.nix
    ./services/quadlet/thetree.nix
    ./services/quadlet/today.nix
  ];

  # 1. 크론 설정
  services.cron = {
    enable = true;
    systemCronJobs = [
      "0 1 * * * imnyang printf '\\n%s : ' \"$(date)\" >> /home/imnyang/codelounge.log && /home/imnyang/codelounge.sh >> /home/imnyang/codelounge.log"
    ];
  };

  services.qemuGuest.enable = true;

  # 2. 사용자 SSH 키 등록
  users.users.imnyang.openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOHP3Z+AYrRh9f8TYyqChKfeyNm3lOe0F75AwRHTTaxD imnyang@kazusa"
  ];

  users.users.discord = {
    isNormalUser = true;
    description = "Ephemeral Concord session user";
    shell = pkgs.bashInteractive;
    password = "";
  };

  services.openssh.extraConfig = ''
    Match User discord
      AuthenticationMethods none
      PasswordAuthentication yes
      PermitEmptyPasswords yes
      ForceCommand ${concordSession}/bin/concord-session
      DisableForwarding yes
      PermitTTY yes
      PermitUserRC no
  '';

  environment.systemPackages = with pkgs; [
    eza
    neovim
    nil
    nixd
  ];

  programs.git.config = {
    safe.directory = "*";
  };

  nix.settings.require-sigs = false;

  networking.firewall.enable = false;

  # Keep short-lived service memory spikes from turning into a global OOM.
  # The host has 8 GiB RAM and currently had no swap configured.
  swapDevices = [
    {
      # nixpkgs currently requires a label definition for swap submodules,
      # but file-backed swap must still use its real path here.
      label = "hako-swap";
      device = lib.mkForce "/swapfile";
    }
  ];

  boot.kernel.sysctl."vm.swappiness" = 10;

  # /dev/sdd1 (ext4, UUID efdf753d-282c-4b78-9549-a124b353c6a5)
  fileSystems."/mnt/static" = {
    device = "/dev/disk/by-uuid/efdf753d-282c-4b78-9549-a124b353c6a5";
    fsType = "ext4";
  };

  systemd.tmpfiles.rules = [
    "L+ /var/static - - - - /mnt/static/static"
  ];

  networking.hostName = "hako";
  system.stateVersion = "26.05";
}