{ config, pkgs, ... }:

{
  # Boot configuration
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  # Timezone
  time.timeZone = "Europe/Berlin";
  i18n.defaultLocale = "en_US.UTF-8";

  # Security & sudo
  security.sudo.enable = true;
  security.sudo.wheelNeedsPassword = false;

  # SSH configuration
  services.openssh = {
    enable = true;
    settings = {
      PermitRootLogin = "no";
      PasswordAuthentication = false;
    };
  };

  # User configuration
  users.users.danlin = {
    isNormalUser = true;
    extraGroups = [ "wheel" ];
    initialPassword = "changeme";
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAzAW0DTpdQJaQOWDC3YJCmPc/veBQ0R3e1q9nOlWgxC danlin@MacBook-Pro-von-Daniel.fritz.box"
    ];
  };

  # Base system packages
  environment.systemPackages = with pkgs; [
    neovim
    rclone
    htop
    curl
    wget
    apacheHttpd  # Provides htpasswd for registry password management
  ];

  # QEMU guest agent (for VM integration when running as guest)
  services.qemuGuest.enable = true;

  # Automatic updates (security)
  system.autoUpgrade = {
    enable = false;  # Manual control via flake
    allowReboot = false;
  };
}