radicle-infra/os/mixin/common.nix

{
  pkgs,
  config,
  lib,
  ...
}: {
  time.timeZone = "UTC";
  i18n.defaultLocale = "en_US.UTF-8";

  networking = {
    useNetworkd = true;
  };

  systemd.network = {
    enable = true;
    config.networkConfig = {
      IPv4Forwarding = true;
      IPv6Forwarding = true;
    };

    networks."10-hetzner" = {
      linkConfig.RequiredForOnline = "routable";
      matchConfig.Name = "enp1s0";
      networkConfig.DHCP = "ipv4";
      routes = [
        {Gateway = "fe80::1";}
      ];
    };
  };

  security = {
    acme = {
      defaults = {
        email = "team@${config.networking.domain}";
        extraLegoRenewFlags = ["--ari-disable"]; # Until all certificates were renewed by "team@radicle.dev".
      };
      acceptTerms = true;
    };
    sudo.wheelNeedsPassword = false;
  };

  nixpkgs.hostPlatform = "x86_64-linux";

  environment.systemPackages = with pkgs; [
    config.boot.kernelPackages.perf
    coreutils-full
    curl
    dmidecode
    exfat
    gitMinimal
    libvirt
    lshw
    lsof
    nfs-utils
    utillinux
    which
  ];

  services = {
    accounts-daemon.enable = true;
    resolved.enable = true;
    nginx.enable = true;
  };
}