{
  artautil,
  config,
  lib,
  ...
}: {
  sops.defaultSopsFile = ../../../secrets/${config.networking.hostName}/secrets.yaml;

  boot.isContainer = true;

  # Install new init script
  system.activationScripts.installInitScript = lib.mkForce ''
    mkdir -p /sbin
    ln -fs $systemConfig/init /sbin/init
  '';

  time.timeZone = "Europe/Helsinki";

  networking.defaultGateway = {
    address = "10.1.2.1";
    interface = "eth0";
  };
  networking.nameservers = ["10.1.2.3"];
  networking.interfaces."eth0".ipv4.addresses = [
    {
      address = artautil.getIPv4 "lxc" config.networking.hostName;
      prefixLength = 24;
    }
  ];

  nix.settings.trusted-users = ["root"];

  users.users.root = {
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGAlif3ABIk0YSx++A+sEeRYPNMMZWLcDuoTKhmcCL6K jonni@liljamo.com"
    ];
  };

  services.openssh = {
    enable = true;
    settings = {
      PasswordAuthentication = lib.mkForce false;
      KbdInteractiveAuthentication = lib.mkForce false;
      PermitRootLogin = lib.mkForce "prohibit-password";
    };
  };

  systemd.suppressedSystemUnits = [
    "console-getty.service"
    "getty@.service"
    "systemd-udev-trigger.service"
    "systemd-udevd.service"
    "sys-fs-fuse-connections.mount"
    "sys-kernel-debug.mount"
    "dev-mqueue.mount"
  ];
  services = {
    journald.extraConfig = "SystemMaxUse=4G";
    cron.systemCronJobs = [
      "0 22 * * * root journalctl --vacuum-time=7d"
    ];
  };
}