{ pkgs, lib, config, ... }:
with lib;
with lib.metacfg;
{
  imports = [ ./hardware-configuration.nix ];

  boot.kernel.sysctl."net.ipv4.conf.all.route_localnet" = 1;
  networking.firewall.extraCommands = ''
    iptables -t nat -A OUTPUT -o lo -p tcp --dport 8081 -j DNAT --to-destination 192.168.122.1:8081
    iptables -t nat -A POSTROUTING -j MASQUERADE
  '';

  metacfg = {
    base.enable = true;
    nix-ld.enable = true;
    nix.enable = true;
    user.extraGroups = [ "docker" "sgx" ];
  };

  virtualisation.docker.enable = true;

  system.autoUpgrade = {
    enable = true;
    operation = "switch";
    allowReboot = true;
  };

  security.tpm2.enable = false;
  security.tpm2.abrmd.enable = false;

  networking.wireless.enable = false; # Enables wireless support via wpa_supplicant.

  services.aesmd.enable = true;

  powerManagement.cpuFreqGovernor = "ondemand";

  system.stateVersion = "23.11";
}