{ config, lib, pkgs, ... }:
{
  imports = [
    # Include the results of the hardware scan.
    ./hardware-configuration.nix
    # ./modules/kvm.nix
    ./../../sway
  ];

  age.identityPaths = [ "/root/.ssh/id_ed25519" ];

  services.zfs.trim.enable = true;
  boot.supportedFilesystems.zfs = true;
  
  # security.pam.yubico.control = "required";

  services.udev.extraRules = let 
    inherit (lib) getExe' getExe;
    inherit (pkgs) procps writeShellScriptBin;
    exitSway = writeShellScriptBin "kill-sway" ''
      for pid in $(${getExe' procps "pgrep"} sway -x)
      do
        uid=$(id -u $(${getExe' procps "ps"} -o user= -p $pid))
        export SWAYSOCK="/run/user/$uid/sway-ipc.$uid.$pid.sock"
        if [[ -e "$SWAYSOCK" ]] ; then
          echo "sock is $SWAYSOCK"
          ${getExe' config.programs.sway.package "swaymsg"} exit
        fi
      done
    '';
  in ''
      ACTION=="remove",\
       ENV{SUBSYSTEM}=="usb",\
       ENV{PRODUCT}=="1050/407/543",\
       RUN+="${lib.getExe exitSway}"
#  '';

       # RUN+="${lib.getExe' pkgs.systemd "loginctl"} lock-sessions"
  
#  networking.hostId = "2ea79333";
#  boot.kernelPackages = lib.mkForce config.boot.zfs.package.latestCompatibleLinuxPackages;

  grimmShared = {
    tooling = {
      pass = true;
    };
    gaming = true;
    printing = true;
    portals = true;
    sound = {
      enable = true;
      midi = true;
    };
    graphical = true;
    firefox = {
      enable = true;
      plugins = {
        "uBlock0@raymondhill.net" = "ublock-origin";
        "{1e6672b5-a286-4217-83ec-81cc872debcf}" = "youtube-control-fix";
        "gdpr@cavi.au.dk" = "consent-o-matic";
        "{41f9e51d-35e4-4b29-af66-422ff81c8b41}" = "disable-javascript";
        "{7a7a4a92-a2a0-41d1-9fd7-1e92480d612d}" = "styl-us";
        "wappalyzer@crunchlabz.com" = "wappalyzer";
        "{b9db16a4-6edc-47ec-a1f4-b86292ed211d}" = "video-downloadhelper";
        "{1526fba1-ac33-4dfc-99d8-163e6129f7b9}" = "reveye-ris";
        "shinigamieyes@shinigamieyes" = "shinigami-eyes";
      };
    };
    cloudSync = {
      enable = true;
      username = "Grimmauld";
      server = "cloud.grimmauld.de";
      passwordFile = config.age.secrets.nextcloud_pass.path;
    };

    spotify.enable = true;
  };

  age.secrets.nextcloud_pass = {
    file = ./../../secrets/nextcloud_pass.age;
    mode = "777";
  };

  networking.hostName = "grimm-nixos-ssd";

  system.stateVersion = "24.05";

  # nix.settings.extra-substituters = [ "https://nixcache.grimmauld.de" ];

  nix.settings.trusted-public-keys = [
    "nixcache.grimmauld.de:LFBlakr8RYIuVb9I1S0+L9JGyB2THcfbPa0W6srghqo="
  ];
}