};
          system.stateVersion = "26.05";
        };
      }
    ];
  };
  flake.nixosConfigurations.plum = inputs.os.lib.nixosSystem {
    specialArgs = { inherit inputs; };
    system = "x86_64-linux";
    modules = with inputs.self.modules.nixos; [
      acme
      boot-server
      disable-nano
      lib
      disks-server
      disks-zram-swap
      dynamic-binaries
      forgejo
      forgejo-action-runner
      goatcounter
      hjem
      keys
      locale
      linux-kernel
      netrc
      network
      nginx
      nix-cache
      nix-settings
      prometheus-node-exporter
      openssh
      packages
      rebuild
      rust
      secret-manager
      sudo-server
      system-types
      tailscale
      unfree
      uptime-kuma
      users
      virtualisation
      website-personal
      yubikey
      {
        config = {
          operatingSystem = "linux";
          systemType = "server";
          network = {
            hostName = "plum";
            domain = "plumj.am";
            tcpPorts = [
              22
              80
              443
            ];

          forgejo-action-runner = {
            labels = [
              "self-hosted:host"
              "plum:host"
              "docpad-infra:host"
            ];
          };

          unfree.allowedNames = [
            "nvidia-x11"
            "nvidia-settings"
            "steam"
            "steam-unwrapped"
          ];
          age.rekey.hostPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBH1S3dhOYCCltqrseHc3YZFHc9XU90PsvDo7frzUGrr root@plum";
          age.secrets = {
            id.rekeyFile = ../secrets/plum-id.age;
            password.rekeyFile = ../secrets/plum-password.age;
            forgejoRunnerToken.rekeyFile = ../secrets/plum-forgejo-runner-token.age;
            forgejoAdminPassword.rekeyFile = ../secrets/plum-forgejo-password.age;
            nixServeKey.rekeyFile = ../secrets/plum-cache-key.age;
            acmeEnvironment.rekeyFile = ../secrets/acme-environment.age;
            context7Key = {
              rekeyFile = ../secrets/context7-key.age;
              owner = "jam";
              mode = "400";
            };
            zaiKey = {
              rekeyFile = ../secrets/z-ai-key.age;
              owner = "jam";
              mode = "400";
            };
          };