{ tree, config, pkgs, lib, ... }: {
  imports = with tree; [
    users.root
    users.chaos
    profiles.sshd
    profiles.kernels.latest

    presets.nixos.desktop
    presets.nixos.laptop
    presets.nixos.encrypted-usb

    ./secrets.nix
    ./profiles/wireguard.nix
    ./profiles/harry-vpn.nix
  ];

  home-manager.users.root = {
    imports = with tree; [ home.base ];
    home.stateVersion = "22.05";
  };
  home-manager.users.chaos = {
    imports = with tree; [
      home.base
      home.dev.all
      home.home-folders
      home.backup-apps

      home.programming.editors.vscode
      home.programming.languages.rust
      home.programming.languages.nix
    ];
    home.stateVersion = "22.05";
  };

  networking.firewall.enable = true;
  networking.firewall.allowPing = true;

  networking.enableIPv6 = true;

  nix.buildMachines = [{
    hostName = "buildbox.servers.genderfucked.monster";
    system = "x86_64-linux";
    # if the builder supports building for multiple architectures, 
    # replace the previous line by, e.g.,
    # systems = ["x86_64-linux" "aarch64-linux"];
    sshUser = "root";
    sshKey = "/usb/ssh-keys/chaos.priv";
    publicHostKey = "c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSUpXZGI5SVl3dFBSRm9rK2JTWUpmSnlRTlJSSithVEtIT3VOTkNLY2FMUHggcm9vdEBuaXhvcwo=";
    maxJobs = 16;
    speedFactor = 4;
    supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
    mandatoryFeatures = [ ];
  }];
  nix.distributedBuilds = true;
  nix.extraOptions = "builders-use-substitutes = true";

  networking.hostName = "tablet";
  time.timeZone = "Europe/London";

  system.stateVersion = "22.05";
}