{ pkgs, ... }:

# Shared base for all hosts: user, SSH hardening, nix settings, packages.
{
  # ---- User ----
  users.users.darman = {
    isNormalUser = true;
    description = "darman";
    extraGroups = [ "wheel" "networkmanager" ];
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZpkPVhzi1zG5JI9hWyUgdyvNIQbp4ts4jw3idpMhhN erik@laptop"
    ];
  };
  security.sudo.wheelNeedsPassword = false;

  # ---- SSH (key-only) ----
  services.openssh = {
    enable = true;
    settings = {
      PasswordAuthentication = false;
      PermitRootLogin = "no";
    };
  };

  # ---- Nix ----
  nix.settings = {
    experimental-features = [ "nix-command" "flakes" ];
    # trust wheel so `nixos-rebuild --target-host darman@…` can push closures.
    trusted-users = [ "root" "@wheel" ];
  };
  nix.gc = {
    automatic = true;
    dates = "weekly";
    options = "--delete-older-than 30d";
  };

  environment.systemPackages = with pkgs; [ vim git htop tmux curl ];

  # ---- Locale / firewall base ----
  time.timeZone = "Europe/Berlin";
  i18n.defaultLocale = "en_US.UTF-8";

  # Firewall on, ssh always allowed. Service modules add their own ports
  # (samba via openFirewall, caddy 80/443, tailscale trusts tailscale0).
  networking.firewall.enable = true;
  networking.firewall.allowedTCPPorts = [ 22 ];
}