{ flake, flakeInputs, pkgs, config, lib, ... }:
{
  imports = with flake.nixosModules.systemProfiles; [
    ./hw.nix ./fs.nix ./networking
    tmpfs-root default-locale openssh lanzaboote zswap initrd-all-crypto-modules
  ];

  config = {
    system.stateVersion = "26.05";

    boot = {
      initrd = {
        systemd = {
          emergencyAccess = config.users.users.root.hashedPassword;
          extraBin = {
            "vim" = lib.getExe pkgs.vim;
            "grep" = lib.getExe pkgs.gnugrep;
          };
        };

        kernelModules = [ "dm-integrity" ];
      };

      lanzaboote.configurationLimit = 15;
      loader = {
        efi.canTouchEfiVariables = true;
        timeout = null;
      };

      plymouth.enable = true;

      kernelPackages = pkgs.linuxPackages_7_2;
      consoleLogLevel = 3;
      kernelParams = [
        "quiet"
        "boot.shell_on_fail"
        "udev.log_priority=3"
        "rd.systemd.show_status=auto"
        "plymouth.use-simpledrm"
      ];

      tmp.useTmpfs = true;
    };

    services.timesyncd.enable = false;
    services.chrony = {
      enable = true;
      enableNTS = true;
      servers = [];
      extraConfig = ''
        pool time.cloudflare.com iburst nts
        pool nts.netnod.se prefer iburst nts
        server ptbtime1.ptb.de prefer iburst nts
        server ptbtime2.ptb.de prefer iburst nts
        server ptbtime3.ptb.de prefer iburst nts
        server ptbtime4.ptb.de prefer iburst nts
        pool ntppool1.time.nl prefer iburst nts
        pool ntppool2.time.nl prefer iburst nts

        authselectmode require
        minsources 3

        nocerttimecheck 1

        leapsectz right/UTC

        makestep 0.1 3

        cmdport 0
      '';
    };

    services.userborn.importLegacyState = false;

    services.kmscon = {
      enable = true;
      config.hwaccel = true;
    };

    environment.persistence."/persistent".timezone = true;
    time.timeZone = null;
    systemd.tmpfiles.settings = {
      "10-localtime"."/etc/localtime".L.argument = "/persistent/etc/localtime";
    };
  };
}