{ user, home }:
{
  config,
  pkgs,
  inputs,
  ...
}:
let
  hmConfig = config.home-manager.users.${user};
in
{
  imports = [
    (import ./authelia { inherit user home; })
    (import ./gitea { inherit user home; })
    (import ./grafana { inherit user home; })
    (import ./littlelink { inherit user home; })
    (import ./lore { inherit user home; })
    (import ./media { inherit user home; })
    (import ./nextcloud { inherit user home; })
    (import ./ntfy { inherit user home; })
    (import ./outline { inherit user home; })
    (import ./prometheus { inherit user home; })
    (import ./shlink { inherit user home; })
    (import ./sish { inherit user home; })
    (import ./traefik { inherit user home; })
    (import ./vaultwarden { inherit user home; })
    (import ./whoami { inherit user home; })
  ];

  boot.kernel.sysctl = {
    "net.ipv4.ip_unprivileged_port_start" = 0;
    "vm.overcommit_memory" = 1;
  };

  home-manager.users.${user} = {
    virtualisation.quadlet.autoUpdate.enable = true;

    systemd.user.tmpfiles.rules = [
      "d /mnt/storage/private/storm/containers/storage/volumes 700 storm storm"
    ];

    sops = {
      secrets."registry/docker.io".sopsFile = "${inputs.secrets}/personal/secrets.yaml";

      templates.containers-auth = {
        content = builtins.readFile (
          (pkgs.formats.json { }).generate "auth.json" {
            auths = {
              "docker.io" = {
                auth = hmConfig.sops.placeholder."registry/docker.io";
              };
            };
          }
        );
        path = "${home}/.config/containers/auth.json";
      };
    };
  };
}