{
  config,
  lib,
  inputs,
  modulesPath,
  stable_pkgs,
  unstable_pkgs,
  ...
}: {
  imports = [
    # Include the results of the hardware scan.
    (modulesPath + "/installer/scan/not-detected.nix")
    #./hardware-configuration.nix
    ./disko.nix
    ../../nixos
    ../../../users/blake
    ../../../modules/system
    ../../../modules/fileshares/holocron_new
    ../../../modules/homelab
    #../../../modules/gameservers/srcds
    ../../../modules/gameservers/minecraft_recpro
    ../../../modules/gameservers/minecraft_modded
  ];

  home-manager.users.blake.imports = [
    ../../../users/blake/hosts/lumiose.nix
  ];

  system = {
    ssh.enable = true;
    sops.enable = true;
    podman.enable = true;
    yubikey.enable = true;
    graphics = {
      enable = true;
      vendor = "amd";
    };
    keepalive = {
      enable = true;
      url = "https://up.blakedheld.xyz/api/push/7DAcvsedwB?status=up&msg=fuckingvibing&ping=";
    };
  };

  homelab = {
    enable = true;
    base_domain = "lumiose.blakedheld.xyz";
    host_ip = "10.10.0.11";
    gitea.enable = true;
    glance.enable = true;
    immich = {
      enable = true;
      data_dir = "/holocron/srv/immich";
      backup = false;
    };
    vaultwarden.enable = true;
    #searx.enable = true;
    # home assistant
    home.enable = true;
    # network
    tailscale.enable = true;
    caddy.enable = true;
    dnsmasq.enable = true;
    # mediastack
    mediastack.enable = true;
    qbittorrent.vpn_inf = "enp34s0.69";
    # system
    backups.enable = true;
    motd.enable = true;
    postfix.enable = false;
    uptime-kuma.enable = true;
    #    # ai
    #    ollama.enable = false;
    #    open-webui.enable = false;
    wyoming.enable = true;
  };

  holocron = {
    #    copyparty.enable = false;
    syncthing.enable = true;
    ensure_perms.enable = false;
    zfs.enable = true;
    smb.enable = true;
    nfs.enable = true;
  };

  gameservers = {
    minecraft_recpro.enable = true;
    minecraft_modded.enable = true;
  };

  # boot (systemd is going on me)
  boot.loader.systemd-boot.enable = true; # systemd your pretty cool ya know
  boot.loader.efi.canTouchEfiVariables = true;
  boot.initrd.systemd.enable = true; # better logging

  # setup hostname and networking stack
  services.resolved = {
    enable = true;
    settings = {
      Resolve = {
        FallbackDNS = ["1.1.1.1" "9.9.9.9"];
        DNSOverTLS = "opportunistic";
      };
    };
  };
  networking = {
    hostName = "lumiose"; # hostname
    hostId = "007f0200";
    networkmanager = {
      enable = true; # the goat
      dns = "systemd-resolved"; # the backup dancer!
      ensureProfiles.profiles = {
        vpn = {
          #ethernet.mac-address = "7a:e4:07:8d:22:76";
          connection.type = "vlan";
          connection.id = "vpn";
          connection.interface-name = "enp34s0.69"; # or just "vpn-vlan"
          vlan.interface-name = "enp34s0.69"; # or just "vpn-vlan"
          vlan.parent = "enp34s0";
          vlan.id = 69;
          #ipv4.dns = "9.9.9.9";
        };
      };
    };
  };

  hardware.bluetooth.enable = true;

  # Open ports in the firewall.
  networking.firewall.allowedTCPPorts = [
    80 # set - http
    111 # set - portmapper for nfs
    139 # set - smb
    443 # set - https
    137
    138
    139
    445 # set - cifs
    1198
    1883 # set - mqtt
    2049 # set - nfs
    2222 # srv - syncthing
    5201 # iperf3
  ];

  networking.firewall.allowedUDPPorts = [51820];
  # Or disable the firewall altogether.
  networking.firewall.enable = true;

  # hardware stuff
  boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod"];
  boot.initrd.kernelModules = [];
  boot.kernelModules = ["kvm-amd"];
  boot.extraModulePackages = [];
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;

  system.stateVersion = "25.05"; # stays here :   )
}