{
  config,
  pkgs,
  lib,
  ...
}: {
  # helps calibre detect kindle
  services.gvfs.enable = true;

  # iOS
  services.usbmuxd.enable = true;
  environment.systemPackages = [pkgs.libimobiledevice];

  users.users.root.openssh.authorizedKeys.keys = let
    ids = import ../../../identities.nix;
  in
    builtins.concatMap builtins.attrValues (builtins.attrValues ids);

  networking = {
    networkmanager.enable = lib.mkForce false;

    firewall.allowedTCPPorts = [8080];

    wireless = {
      enable = true;
      userControlled.enable = true;
      secretsFile = config.age.secrets.wpa_password.path;
      networks = let
        ordered = nss:
          lib.pipe nss [
            lib.lists.reverseList
            (lib.lists.imap0 (i: lib.mapAttrs (_: n: n // {priority = i;})))
            lib.mergeAttrsList
          ];
      in
        ordered [
          # first in list is tried first
          {
            "HiddenParadize@Earth2077".pskRaw = "ext:HOME";
            "Pei’s Wifi".pskRaw = "ext:PEI";
            "estrich".pskRaw = "ext:ESTRICH";
            "girlypop-net".pskRaw = "ext:MEOW";
          }
          {
            "_SNCF_WIFI_INOUI" = {};
            "_WIFI_LYRIA" = {};
            "EurostarTrainsWiFi" = {};
            "SBB-FREE" = {};
          }
          {
            gast-ost.pskRaw = "ext:GAST_OST";
            eduroam = {
              authProtocols = ["WPA-EAP"];
              auth = ''
                pairwise=CCMP
                group=CCMP TKIP
                eap=PEAP
                ca_cert="${./certs/universite_de_rennes.pem}"
                identity="ychiang@etudiant.univ-rennes.fr"
                altsubject_match="DNS:radius.univ-rennes1.fr;DNS:radius1.univ-rennes1.fr;DNS:radius2.univ-rennes1.fr;DNS:vmradius-psf1.univ-rennes1.fr;DNS:vmradius-psf2.univ-rennes1.fr"
                phase2="auth=MSCHAPV2"
                password=ext:EDUROAM
                anonymous_identity="anonymous@univ-rennes.fr"
              '';
            };
          }
          {"iPhone de Léana 江".pskRaw = "ext:PHONE";}
        ];
    };
  };

  hardware.bluetooth.enable = true;
}