{
  self,
  config,
  pkgs,
  lib,
  modulesPath,
  ...
}: {
  imports = [
    ../../../mixin/cache.nix
    ../../../mixin/common.nix
    ../../../mixin/disk-config.nix
    ../../../mixin/kmscon.nix
    ../../../mixin/motd.nix
    ../../../mixin/nix.nix
    ../../../mixin/sops.nix
    ../../../mixin/users.nix

    ./ssh.nix
    ./radicle.nix
    ./tor.nix

    (modulesPath + "/installer/scan/not-detected.nix")
    (modulesPath + "/profiles/qemu-guest.nix")
  ];

  systemd.network.networks."10-hetzner".address = [
    # IPv6 address is statically configured, see Hetzner dashboard.
    "2a01:4ff:f0:abd3::1/128"
  ];

  boot.loader.grub = {
    efiSupport = true;
    efiInstallAsRemovable = true;
  };

  networking = {
    domain = "radicle.network";
    hostName = "rosa";
    useDHCP = false;

    firewall = {
      allowedTCPPorts = [
        22 # ssh
        80 # http
        443 # https
        8776 # radicle-node
      ];

      allowedUDPPorts = [
        443 # http3
      ];
    };
  };

  networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
}