{
  config,
  pkgs,
  ...
}: let
  keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILm0O46zW/XfVOSwz0okRWYeOAg+wCVkCtCAoVTpZsOh"];
in {
  i18n.defaultLocale = "en_US.UTF-8";

  users.mutableUsers = false;
  users.users.root.hashedPasswordFile = config.age.secrets."system/password-root".path;

  users.users.winston = {
    extraGroups = ["wheel"];
    hashedPasswordFile = config.age.secrets."system/password-winston".path;
    isNormalUser = true;
    openssh.authorizedKeys.keys = keys;
  };

  home-manager = {
    useGlobalPkgs = true;
    useUserPackages = true;
    users.winston = {
      home.stateVersion = "23.11";

      programs = {
        bash = {
          enable = true;
          initExtra =
            # bash
            ''
              if [[ $(${pkgs.procps}/bin/ps --no-header --pid=$PPID --format=comm) != "fish" && -z ''${BASH_EXECUTION_STRING} ]]; then
                shopt -q login_shell && LOGIN_OPTION='--login' || LOGIN_OPTION=""
                exec ${pkgs.fish}/bin/fish $LOGIN_OPTION
              fi
            '';
        };
        direnv.enable = true;
        fish = {
          enable = true;
          interactiveShellInit = "set fish_greeting";
          plugins = [
            {
              name = "plugin-git";
              src = pkgs.fishPlugins.plugin-git.src;
            }
          ];
        };
        nix-index.enable = true;
        nix-index-database.comma.enable = true;
        starship.enable = true;
      };

      services.vscode-server.enable = true;
    };
  };
}