{tree, ...}: {
  imports = with tree;
    [
      presets.nixos.serverBase
      presets.nixos.serverHetzner
      presets.nixos.serverEncryptedDrive

      profiles.nginx
      profiles.firewallAllow.httpCommon
      profiles.chaosInternalWireGuard

      ./secrets.nix
      ./hardware.nix
    ]
    ++ (with hosts.vault.profiles; [
      vault
      vaultUI
      restic
      internalCA
    ]);

  networking.hostName = "vault";

  home-manager.users.root.home.stateVersion = "23.05";
  system.stateVersion = "23.05";
}