{ config, pkgs, ... }:
{
  # [HARDWARE]
  imports =
    [ # Include the results of the hardware scan.
      ./hardware-configuration.nix
    ];
  hardware.opengl = {
    enable = true;
    driSupport = true;
    driSupport32Bit = true;
    extraPackages = with pkgs; [
      intel-ocl
      intel-compute-runtime
      intel-media-driver
      vaapiIntel
      vaapiVdpau
      libvdpau-va-gl
    ];
  };
  hardware.bluetooth.enable = true;
  services.blueman.enable = true;
  services.logind = {
    lidSwitch = "hibernate";
    lidSwitchDocked = "ignore";
    lidSwitchExternalPower = "hibernate";
  };
  services.udev.extraRules = ''
    KERNEL=="0000:00:14.0", SUBSYSTEM=="pci", ATTR{power/wakeup}="disabled"
  '';
  services.tlp = {
    enable = true;
    settings = {
      TLP_DEFAULT_MODE = "BAT";
      DISK_IDLE_SECS_ON_AC = 0;
      DISK_IDLE_SECS_ON_BAT = 5;
      MAX_LOST_WORK_SECS_ON_AC = 15;
      MAX_LOST_WORK_SECS_ON_BAT = 120;
      CPU_SCALING_GOVERNOR_ON_AC = "performance";
      CPU_SCALING_GOVERNOR_ON_BAT = "powersave";
      CPU_SCALING_MIN_FREQ_ON_AC = 400000;
      CPU_SCALING_MAX_FREQ_ON_AC = 4700000;
      CPU_SCALING_MIN_FREQ_ON_BAT = 400000;
      CPU_SCALING_MAX_FREQ_ON_BAT = 2700000;
      CPU_ENERGY_PERF_POLICY_ON_AC = "balance_performance";
      CPU_ENERGY_PERF_POLICY_ON_BAT = "power";
      CPU_MIN_PERF_ON_AC = 0;
      CPU_MAX_PERF_ON_AC = 100;
      CPU_MIN_PERF_ON_BAT = 0;
      CPU_MAX_PERF_ON_BAT = 30;
      CPU_BOOST_ON_AC = 1;
      CPU_BOOST_ON_BAT = 0;
      SCHED_POWERSAVE_ON_AC = 0;
      SCHED_POWERSAVE_ON_BAT = 1;
      NMI_WATCHDOG = 0;
      DISK_DEVICES = "nvme0n1";
    };
  };

  # [BOOT / DISK ENCRYPTION]
  boot.loader.efi.canTouchEfiVariables = true;
  boot.loader.grub = {
    enable = true;
    device = "nodev";
    efiSupport = true;
    enableCryptodisk = true;
    theme = ../shared/sayonara;
  };

  boot.loader.efi.efiSysMountPoint = "/boot/efi";
  boot.initrd = {
    availableKernelModules = [ "aesni_intel" "cryptd" ];
    secrets = { "/boot/key" = "/boot/key"; };
    luks.mitigateDMAAttacks = true;
    luks.devices = {
      root = {
        device = "/dev/disk/by-uuid/91114176-b6cc-4454-89df-e2bf5c1fac0a";
        keyFile = "/boot/key";
        preLVM = true;
      };
    };
  };
  boot.kernelParams = [ "i915.enable_dpcd_backlight=1" ];

  # [NETWORKING]
  networking.hostName = "lambda";
  networking.networkmanager = {
    enable = true;
    wifi.powersave = true;
    wifi.scanRandMacAddress = true;
    wifi.macAddress = "random";
  };

  # [DESKTOP / XORG / WAYLAND]
  services.xserver = {
    windowManager.berry.enable = true;
    displayManager.startx.enable = true;
    dpi = 144;
  };

  system.stateVersion = "23.11";
}