{
  nix.settings = {
    trusted-users = [
      "root"
      "@wheel"
    ];

    # Binary cache configuration
    # c3 runs ncps (Nix Cache Proxy Server) that caches cache.nixos.org
    # Falls back to cache.nixos.org if c3 is unreachable
    substituters = [
      "http://c3.mule-stork.ts.net:8501"  # Local ncps cache proxy on c3
      "https://cache.nixos.org"
    ];
    trusted-public-keys = [
      "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
      "c3:sI3l1RN80xdehzXLA8u2P6352B0SyRPs2XiYy/YWYro="
    ];

    # Performance tuning
    max-jobs = "auto";           # Use all cores for parallel builds
    cores = 0;                   # Each build can use all cores
    max-substitution-jobs = 16;  # Faster fetching from caches
    http-connections = 25;       # More parallel downloads
    download-attempts = 3;       # Retry failed downloads
  };

  nix.gc = {
    automatic = true;
    dates = "weekly";
    options = "--delete-older-than 30d";
  };

  # TODO: this should be a secret, maybe
  nix.extraOptions = ''
    access-tokens = github.com=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
  '';
}