{
  config,
  lib,
  pkgs,
  ...
}: let
  keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILm0O46zW/XfVOSwz0okRWYeOAg+wCVkCtCAoVTpZsOh"];

  nu_scripts = "${pkgs.nu_scripts}/share/nu_scripts";
  mkCompletions = completions:
    lib.concatStringsSep "\n" (
      builtins.map (
        el: "source ${nu_scripts}/custom-completions/${el.name or el}/${el.filename or el}-completions.nu"
      )
      completions
    );
in {
  i18n.defaultLocale = "en_US.UTF-8";

  users.mutableUsers = false;
  users.users.root.hashedPasswordFile = config.age.secrets."system/password-root".path;

  users.users.winston = {
    extraGroups = ["wheel"];
    hashedPasswordFile = config.age.secrets."system/password-winston".path;
    isNormalUser = true;
    openssh.authorizedKeys.keys = keys;
  };

  home-manager = {
    useGlobalPkgs = true;
    useUserPackages = true;
    users.winston = {
      home.stateVersion = "23.11";

      programs = {
        bash = {
          enable = true;
          initExtra =
            # bash
            ''
              if [[ $(${pkgs.procps}/bin/ps --no-header --pid=$PPID --format=comm) != "nu" && -z ''${BASH_EXECUTION_STRING} ]]; then
                exec ${lib.getExe pkgs.nushell}
              fi
            '';
        };
        direnv = {
          enable = true;
          nix-direnv.enable = true;
        };
        nushell = {
          enable = true;
          extraConfig =
            # nu
            ''
              let carapace_completer = {|spans: list<string>|
                ^${lib.getExe pkgs.carapace} $spans.0 nushell ...$spans
                | from json
                | if ($in | default [] | where value == $"($spans | last)ERR" | is-empty) { $in } else { null }
              }

              let nix_completer = {|spans: list<string>|
                let current_arg = $spans | length| $in - 1
                with-env { NIX_GET_COMPLETIONS: $current_arg } { $spans| skip 1| ^nix ...$in }
                | lines
                | skip 1
                | parse "{value}\t{description}"
              }

              let external_completer = {|spans|
                let expanded_alias = scope aliases
                | where name == $spans.0
                | get -i 0.expansion

                let spans = if $expanded_alias != null {
                  $spans
                  | skip 1
                  | prepend ($expanded_alias | split row ' ' | take 1)
                } else {
                  $spans
                }

                match $spans.0 {
                  nix => $nix_completer
                  _ => $carapace_completer
                } | do $in $spans
              }

              $env.config = {
                show_banner: false
                table: { mode: "psql" }
                completions: {
                  case_sensitive: false
                  external: {
                    enable: true
                    max_results: 100
                    completer: $external_completer
                  }
                }
              }

              source ${nu_scripts}/aliases/git/git-aliases.nu
              ${mkCompletions ["git" "man" "rg" "tar"]}
            '';
        };
        starship.enable = true;
      };
    };
  };
}