{ config, lib, pkgs, ... }:

{
  system.stateVersion = "25.05";

  nix.settings = {
    experimental-features = [ "nix-command" "flakes" ];
    trusted-users = [ "@wheel" "deploy" ];
  };

  # deploy-rs SSHes in as `deploy` and uses sudo to activate.
  users.users.deploy = {
    isNormalUser = true;
    extraGroups = [ "wheel" ];
    openssh.authorizedKeys.keys = [
      # TODO: paste the Gitea runner's deploy ed25519 pubkey here
    ];
  };
  security.sudo.wheelNeedsPassword = false;

  services.openssh = {
    enable = true;
    settings.PasswordAuthentication = false;
  };

  networking.firewall.enable = true;

  time.timeZone = "UTC";

  environment.systemPackages = with pkgs; [ vim curl jq ];
}