{
  user ? throw "user argument is required",
  home ? throw "home argument is required",
}:
{ config, pkgs, ... }:
let
  hmConfig = config.home-manager.users.${user};
in
{
  imports = [
    (import ./authelia { inherit user home; })
    (import ./grafana { inherit user home; })
    (import ./ntfy { inherit user home; })
    (import ./traefik { inherit user home; })
    (import ./whoami { inherit user home; })
  ];

  boot.kernel.sysctl = {
    "net.ipv4.ip_unprivileged_port_start" = 0;
    "vm.overcommit_memory" = 1;
  };

  home-manager.users.${user} = {
    virtualisation.quadlet = {
      autoUpdate.enable = true;
    };

    sops = {
      secrets."registry/docker.io".sopsFile = ../../../../../../../secrets/personal/secrets.yaml;

      templates."containers-auth.json" = {
        content = builtins.readFile (
          (pkgs.formats.json { }).generate "auth.json" {
            auths = {
              "docker.io" = {
                auth = hmConfig.sops.placeholder."registry/docker.io";
              };
            };
          }
        );
        path = "${home}/.config/containers/auth.json";
      };
    };
  };
}