{
  config,
  inputs,
  lib,
  pkgs,
  ...
}: {
  imports = [
    ./hardware-configuration.nix

    inputs.nixos-hardware.nixosModules.lenovo-thinkpad-e495
  ];

  boot.initrd.postDeviceCommands = lib.mkAfter ''
    zfs rollback -r zpool/root@blank
  '';

  sops.defaultSopsFile = ../../../secrets/arwen/secrets.yaml;
  sops.gnupg.sshKeyPaths = ["/persist/etc/ssh/ssh_host_rsa_key"];
  sops.age.sshKeyPaths = ["/persist/etc/ssh/ssh_host_ed25519_key"];
  sops.secrets.rootPwd.neededForUsers = true;
  users.users.root.hashedPasswordFile = config.sops.secrets.rootPwd.path;

  networking.hostId = "d2a2e2cb";
  networking.networkmanager.enable = true;

  time.timeZone = "Europe/Helsinki";

  services.xserver.xkb.layout = "us";

  roles.audio.enable = true;
  roles.bluetooth = {
    enable = true;
    enableHDAudio = true;
  };

  services.libinput.enable = true;

  environment.systemPackages = with pkgs; [
    inputs.nvim-flake.packages.x86_64-linux.nvim
    git
    vim
    wget
  ];

  environment.persistence."/persist" = {
    hideMounts = true;
    directories = [
      "/etc/nixos"
      "/etc/ssh"
      "/var/lib/tailscale"
    ];
  };

  services.pcscd.enable = true;
  programs.gnupg.agent.enable = true;

  services.openssh.enable = true;

  system.stateVersion = "24.05";
}