{
  config,
  pkgs,
  meta,
  credentials,
  ...
}:
{

  nix.settings.experimental-features = [
    "nix-command"
    "flakes"
  ];

  nixpkgs.config.allowUnfree = true;

  # Allow login and remote control of VM
  users.users.admin = {
    isNormalUser = true;
    hashedPassword = "$y$j9T$WI7E.NXw4qar1DXodrVWG/$gUErw1R6W8k1UFm49C5.vEc9MT5RcKW0BKitURNqbl/";
    extraGroups = [ "wheel" ];

    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAcofS7u0BYzRBn0i4RuXPHWpnvk3nEbGo9B9ghsR4oL roydumblauskas@gmail.com"
    ];
  };

  # Don't allow password login
  services.openssh = {
    enable = true;

    settings = {
      PasswordAuthentication = false;
      KbdInteractiveAuthentication = false;
    };
  };

  # Networking
  networking = {
    hostName = "nixos-vm-test-00";
    hostId = "9C7030FE";
    defaultGateway = "192.168.8.1";
    nameservers = [
      "1.1.1.1"
      "1.0.0.1"
    ];
    nftables.enable = true;

    firewall = {
      enable = true;
      allowedTCPPorts = [
        22
        80 # gitea routing not enabled, open firewall here
        443 # gitea routing not enabled, open firewall here
        30222 # gitea routing not enabled, open firewall here
        6443 # k3s
      ];
    };

    interfaces.eth0.ipv4.addresses = [
      {
        address = "192.168.8.180";
        prefixLength = 24;
      }
    ];
  };

  # Packages
  environment.systemPackages = with pkgs; [
    curl
    kitty
    kubectl
    nginx
    tmux
    vim
    wget
  ];

  # ================================ #
  #            K3S SERVICE           #
  # ================================ #

  services.k3s = {
    enable = true;
    disable = [ "traefik" ];
    role = "server";

    # only enable the service on k3s when roughly finalized
    # Until then use a vm, as k3s is persisted
    extraFlags = [
      "--data-dir=/var/lib/rancher/k3s"
      "--cluster-cidr=10.42.0.0/20"
    ];
  };

  # ================================ #
  #           GITEA SERVICE          #
  # ================================ #

  services.hl-gitea = {
    enable = true;
    credentialsFile = credentials.gitea-env;
    database-hostname = "${config.ipAddrs.${meta.hostname}}:5432"; # whatever port I host psql on below

    default-nginx = {
      enable = false;
    };
  };

  # ================================ #
  #           PSQL SERVICE           #
  # ================================ #

  # Postgresql/postgrest for row storage (not on k3s)
  services.postgresql-db = {
    enable = true;
    dataDir = "/var/lib/postgresql";
    port = 5432;
    credentialsFile = credentials.psql-env;
    databases = [
      "gitea"
    ];
    ipMasks = [
      "10.42.0.0/20" # k3s pod mask
    ];
  };

  # To stop the complaining
  system.stateVersion = "26.05";

}