{ config, pkgs, ... }:

let
  npins = import ../../npins;
  nixGit = import (pkgs.fetchFromGitHub {
    owner = "NixOS";
    repo = "nix";
    rev = "7a8a28629c61c75af010ff0a5a88c16c4ce536c7";
    sha256 = "sha256-oqG9AFPXBneKVmiWa9b9ai0hGZqHVKVFaFLdBZitSUA=";
  });
in
{
  imports = [
    ../common
    <top/shared/basics-physical.nix>
    ./graphical.nix
    ./dev.nix
    ./create.nix
  ];

  environment.systemPackages = [
    pkgs.npins
    (pkgs.callPackage "${npins.agenix}/pkgs/agenix.nix" {})
  ];

  environment.sessionVariables = {
    # Tell .zshrc to source zshrc-workstation.sh.
    MYNIX_PROFILE = "workstation";
  };

  # Age defaults to this anyway when openssh is enabled.
  # We're setting this here for workstations where openssh is disabled.
  age.identityPaths = ["/etc/ssh/ssh_host_ed25519_key"];

  # Using nix from git for --raw support in nix-instantiate --eval.
  # FUTURE: remove once upgrading to NixOS 25.05
  nix.package = nixGit.packages.${builtins.currentSystem}.default;
}