{
  inputs,
  outputs,
  lib,
  config,
  pkgs,
  nix-rice,
  nix-std,
  ...
}: {
  # these settings propagate to home-manager's nixpkgs
  nixpkgs = {
    overlays = [
      inputs.nur.overlay
      outputs.overlays.additions
      inputs.nix-rice.overlays.default
      outputs.overlays.rice
      inputs.helix.overlays.default
      inputs.nixd.overlays.default
      inputs.nh.overlays.default
    ];
    config = {
      allowUnfree = true;
      allowUnfreePredicate = _: true;
    };
  };

  nix = {
    # add flake inputs to our registry to allow global use
    registry = lib.mapAttrs (_: value: {flake = value;}) inputs;
    settings = {
      # trusted-users = ["bolt" "plank"];
      experimental-features = "nix-command flakes";
      substitute = true;
    };
    extraOptions = ''
      keep-outputs = true
      keep-derivations = true
    '';
    optimise.automatic = true;
    # package = pkgs.lix;
  };

  imports = [
    ./modules/network.nix
    ./modules/term.nix
    ./modules/cosmic.nix
    ./modules/systemdboot.nix
    ./modules/sound.nix
    ./modules/sydney.nix
    ./modules/docs.nix
    ./modules/nix-meta.nix
  ];

  hardware.enableRedistributableFirmware = true;
  hardware.enableAllFirmware = true;

  boot.tmp.useTmpfs = true;

  services.libinput.enable = true;

  # busted as hell
  # services.usbmuxd.enable = true; # for iphone

  hardware.graphics.enable = true;
  hardware.graphics.enable32Bit = true;

  services.udisks2.enable = true;

  services.flatpak.enable = true;

  security.polkit.enable = true;

  xdg.autostart.enable = true;
  xdg.portal.enable = true;

  # services.tailscale.enable = true;

  environment.systemPackages = with pkgs; [
    curl
    eza
    git

    # broken \/
    # libimobiledevice
    # ifuse
  ];

  services.atuin.enable = true;

  programs.nh = {
    enable = true;
    clean.enable = true;
    clean.extraArgs = "--keep-since 3d --keep 3";
  };

  programs.nix-index-database.comma.enable = true;
  programs.nix-index.enableZshIntegration = false;
  programs.nix-index.enableBashIntegration = false;

  # gnome/freedesktop compat stuff
  programs.dconf.enable = true;
  services.gvfs.enable = true;

  # give cpuset to user
  systemd.services."user@".serviceConfig.Delegate = "memory pids cpu cpuset";

  systemd.user.extraConfig = "LogLevel=debug";
}