{ lib, config, pkgs, ... }: {
  imports = [

    ../../system/server
    ./hardware-configuration.nix

    ./mail-fetcher.nix
    ./transmission.nix
    ./nextcloud.nix

    ./borg.nix
    ./finance.nix
    ./gogs.nix
    ./grafana.nix
    ./graylog.nix
    ./jenkins.nix
    ./kibana.nix
    ./mysql.nix
    ./packages.nix
    ./prometheus.nix
    ./syncthing.nix
    ./taskserver.nix
    ./tinc.nix
    ./weechat.nix

    #./property.nix # flask sucks, find something else

  ];

  sops.defaultSopsFile = ../../secrets/workhorse.yaml;

  nixpkgs.config.permittedInsecurePackages =
    [ "gogs-0.11.91" ];

  # todo: add this to each file instead summing that here
  #on-failure.plans = {
  #  gogs.name = "gogs";
  #  jenkins.name = "jenkins";
  #  graylog.name = "graylog";
  #  prometheus.name = "prometheus";
  #  taskserver.name = "taskserver";
  #  weechat.name = "weechat";
  #  transmission.name = "transmission";
  #  mail-fetcher.name = "fetchmail";
  #};

  networking.hostName = "workhorse";

  # font
  # ----
  programs.custom.urxvt.fontSize = 17;
  programs.custom.xterm.fontSize = 17;
  system.custom.fonts.dpi = 140;

  # enable initrd ssh
  configuration.init-ssh = {
    enable = "enabled";
    kernelModules = [ "r8169" ];
    hostKey = "/etc/ssh/ssh_host_ed25519_key";
  };

  # nix-shell -p speedtest_cli --run speedtest
  configuration.fireqos = {
    enable = true;
    interface = "enp2s0f1";
    input = 45000;
    output = 8000;
    balance = false;
  };

  virtualisation = { docker.enable = false; };

  services.printing.enable = false;
  services.smartd.enable = true;

}