{ config, lib, pkgs, modulesPath, inputs, ... }:
{
  imports = [
    ./hardware.nix
    ./secrets.nix

    ../../common/system.nix
    ../../common/users.nix
    ../../common/services.nix

    ../../host-secrets.nix
  ];

  boot = {
    loader = {
      systemd-boot.enable = true;
      efi = {
        canTouchEfiVariables = true;
        efiSysMountPoint = "/boot";
      };
    };
    initrd.systemd.enable = true;
  };

  system.stateVersion = "24.11";
  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";

  systemd.targets.multi-user.enable = true;
  
  networking = {
    hostName = "baal";
    hostId = "aaaaaaaa";
    networkmanager.enable = true;
  };

    services.fail2ban = {
    enable = true;
    # Ban IP after 5 failures
    maxretry = 5;
    ignoreIP = [
      "10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16" "100.64.0.0/10"
    ];
    bantime = "24h"; # Ban IPs for one day on the first ban
    bantime-increment = {
      enable = true; # Enable increment of bantime after each violation
      multipliers = "1 2 4 8 16 32 64";
      maxtime = "168h"; # Do not ban for more than 1 week
      overalljails = true; # Calculate the bantime based on all the violations
    };
  };

  virtualisation.docker = {
    enable = true;
    enableOnBoot = true;
  };

  documentation.enable = false;
}