{
  modulesPath,
  lib,
  pkgs,
  pubkeys,
  ...
}:
{
  imports = [
    (modulesPath + "/profiles/qemu-guest.nix")
    ./disk-config.nix
    ../../modules
  ];

  age.secrets.navidrome.file = ../../secrets/navidrome.age;

  boot.loader.grub = {
    efiSupport = true;
    efiInstallAsRemovable = true;
  };

  modules = {
    container.kitchenowl = {
      enable = true;
      openFirewall = true;
    };

    server = {
      paperless = {
        enable = true;
        openPort = true;
        settings = {
          PAPERLESS_URL = "https://paperless.ccnlc.eu";
        };
      };

      navidrome = {
        enable = true;
        library = {
          path = "/mnt/music";
          type = "nfs";
          source = {
            ip = "192.168.178.21";
            path = "/mnt/Fort/data/music";
          };
        };
        settings = {
          Address = "0.0.0.0";
          Port = 4533;
        };
      };
    };
  };

  services = {
    openssh.enable = true;
    tailscale = {
      enable = true;
      extraUpFlags = [
        "--ssh"
        "--advertise-tags"
        "tag:server"
        "--login-server"
        "https://hs.ccnlc.eu"
      ];
      #useRoutingFeatures = "both";
    };
  };

  environment.systemPackages = map lib.lowPrio [
    pkgs.curl
  ];

  users.users.root.openssh.authorizedKeys.keys = [ pubkeys.ny ];

  system.stateVersion = "23.11";
}