{
  lib,
  pkgs,
  inputs,
  ...
}:
{
  imports = [
    ../../common/encrypted-btrfs-layout.nix
    ../../common/global
    ../../common/base-node.nix
    ./hardware.nix
  ];

  diskLayout = {
    mainDiskDevice = "/dev/disk/by-id/ata-FORESEE_512GB_SSD_MP15B03900928";
    #keyDiskDevice = "/dev/disk/by-id/usb-Intenso_Micro_Line_22080777660586-0:0";
    keyDiskDevice = "/dev/sdb";
  };

  networking.hostName = "chilly";
  services.tailscaleAutoconnect.authkey = "tskey-auth-kRXS9oPyPm11CNTRL-BE6YnbP9J6ZZuV9dHkX17ZMnm1JGdu93";
  services.consul.interface.advertise = lib.mkForce "br0";

  virtualisation.libvirtd = {
    enable = true;
    allowedBridges = [ "br0" ];
  };

  environment.systemPackages = with pkgs; [
    unstable.qemu
    usbutils
    virt-manager
    (pkgs.writeShellScriptBin "qemu-system-x86_64-uefi" ''
      qemu-system-x86_64 \
        -bios ${pkgs.OVMF.fd}/FV/OVMF.fd \
        "$@"
    '')
  ];

  users.users.ppetru.extraGroups = [ "libvirtd" ];

  networking = {
    # TODO: try using DHCP for br0. will probably need a hardcoded MAC
    defaultGateway = "192.168.1.1";
    nameservers = [ "192.168.1.1" ];
    bridges.br0.interfaces = [ "enp1s0" ];
    interfaces.br0 = {
      useDHCP = false;
      ipv4.addresses = [
        {
          "address" = "192.168.1.5";
          "prefixLength" = 24;
        }
      ];
    };
  };
}