{ pkgs, lib, config, ... }: {
  imports = [

    <system/server>
    ./hardware-configuration.nix

    ./tinc.nix
    ./syncthing.nix
    #./packages.nix
    #./home-assistant.nix
    #./wifi-access-point.nix
    ./kodi.nix
    #./mpd.nix

  ];

  networking.hostName = "porani";

  backup.services.restic = {
    "on-porani.insecure".enable = false;
    "on-workhorse.private".enable = false;
    "on-workout.private".enable = false;
  };

  # not needed because not encrypted
  # enable initrd ssh
  #configuration.init-ssh = {
  #  enable = "enabled";
  #  kernelModules = [ "e1000e" ];
  #  hostECDSAKey = <secrets/init-ssh/host_ecdsa_key>;
  #};

  # programs
  programs.custom.vim.enable = true;
  environment.systemPackages = [ pkgs.mosh ];

  # wifi setup
  system.custom.wifi = {
    enable = true;
    configurationFile = <secrets/wpa_supplicant>;
    interfaces = [ "wlp3s0" ];
  };
  # nix-shell -p speedtest_cli --run speedtest
  configuration.fireqos = {
    enable = true;
    interface = "wlp3s0";
    input = 2500;
    output = 1200;
    balance = false;
  };

  # nix-shell -p speedtest_cli --run speedtest
  #configuration.fireqos = {
  #  enable = true;
  #  interface = "eth0";
  #  input = 2500;
  #  output = 1200;
  #  balance = false;
  #};

  # new Zealand overwrites
  # services.netdata.enable = lib.mkForce false ;
  services.SystemdJournal2Gelf.enable = lib.mkForce false;

}