{
  config,
  lib,
  pkgs,
  modulesPath,
  ...
}:
{
  imports = [
    ../profiles/all.nix
    (modulesPath + "/profiles/minimal.nix")
  ];

  system.stateVersion = "25.11";

  vmapps.enable = true;
  _module.args.inputs = import ../npins;

  # following microvm.nix:
  boot.loader.grub.enable = false;
  boot.initrd.systemd.enable = true;
  fileSystems."/" = lib.mkDefault {
    device = "rootfs"; # how does this work? does this assign a label to the tmpfs?
    fsType = "tmpfs";
    options = [ "size=20%,mode=0755" ];
    neededForBoot = true;
  };
  boot.initrd.systemd.settings.Manager.DefaultTimeoutStartSec = 30;
  systemd.settings.Manager.DefaultTimeoutStopSec= 10;
  networking.useNetworkd = true;
  networking.nftables.enable = true;

  uvms.cloud-hypervisor.enable = true;

  users.mutableUsers = false;
  users.users.root.password = "hacktheplanet!";
  services.getty.autologinUser = "root";

  systemd.services."suid-sgid-wrappers".serviceConfig = {
    StandardOutput = "journal+console";
    StandardError = "journal+console";
  };

  # TODO: cmdline, kernel, initrd, fileSystems
}