{pkgs, ...}: let
  updateScript = pkgs.writeShellScriptBin "rebuild" ''
    #!/bin/sh
    nixos-rebuild switch --flake /etc/nixos#distrust --impure
  '';
in {
  environment.systemPackages = with pkgs; [vim btop git alejandra statix deadnix] ++ [updateScript];

  nix.settings.experimental-features = ["nix-command" "flakes"];

  boot.tmp.cleanOnBoot = true;
  zramSwap.enable = true;
  networking.hostName = "distrust";

  services = {
    openssh = {
      enable = true;
      settings.PermitRootLogin = "yes";
      ports = [292];
    };
    fail2ban.enable = true;
    endlessh = {
      enable = true;
      port = 22;
      openFirewall = true;
    };
  };

  users.users.root.openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxah5pnxmk=P7HtwRsryDoAHZsDs5RcGP9IPCNg1KFe cardno;16-179-196"];
  system.stateVersion = "25.05";
}