{ pkgs, ... }:

{
  # European timezone
  time.timeZone = "Europe/Amsterdam";
  i18n.defaultLocale = "en_US.UTF-8";

  # SSH: key-only, no passwords, no root login
  services.openssh = {
    enable = true;
    settings = {
      PasswordAuthentication = false;
      PermitRootLogin = "no";
      KbdInteractiveAuthentication = false;
    };
  };

  # Firewall: only allow SSH, HTTP, HTTPS, and DNS (for AdGuard)
  networking.firewall = {
    enable = true;
    allowedTCPPorts = [ 22 80 443 53 ];
    allowedUDPPorts = [ 53 ];
  };

  # Nix settings: flakes, auto-gc, auto-optimise
  nix = {
    settings = {
      experimental-features = [ "nix-command" "flakes" ];
      auto-optimise-store = true;
      trusted-users = [ "root" "admin" ];
    };
    gc = {
      automatic = true;
      dates = "weekly";
      options = "--delete-older-than 14d";
    };
  };

  # Base system packages
  environment.systemPackages = with pkgs; [
    git
    htop
    curl
    vim
    age
    ssh-to-age
    sops
  ];

  # Automatic security updates for the OS
  system.autoUpgrade = {
    enable = false; # set to true once you are comfortable with unattended reboots
    flake = "github:YOUR_USERNAME/nix#eurovm"; # update to your actual flake URL
    flags = [ "--update-input" "nixpkgs" ];
  };
}