{ config, lib, pkgs, ... }:

{
  documentation = {
    doc.enable = false;
    info.enable = false;
    man.enable = true;
    nixos.enable = lib.mkDefault false;
  };

  nix.gc = {
    automatic = true;
    options = "--delete-older-than 14d";
  };

  nix.settings = {
    auto-optimise-store = true;
    experimental-features =
      [ "nix-command" "flakes" "auto-allocate-uids" "cgroups" ];
    trusted-users = [ "root" "@wheel" ];
    # show more log lines for failed derivations
    log-lines = 32;
    # basically pwn-as-a-service
    accept-flake-config = false;
    flake-registry = config.nix.registry.nixpkgs.flake;
  };

  # Let <nixpkgs> be the used system packages, such that `nix-shell` can pick them up
  environment.etc.nixpkgs.source = lib.cleanSource pkgs.path;
  nix.nixPath = [ "nixpkgs=/etc/nixpkgs" ];

  nix.registry = {
    nixpkgs.to = {
      type = "path";
      path = lib.cleanSource pkgs.path;
    };
  };

  nixpkgs.config = {
    allowUnfree = false; # fsck NO
    allowBroken = false; # no?
    allowAliases = false; # slow and broken
  };
}