{
  pkgs,
  lib,
  config,
  ...
}:

with lib;
let
  cfg = config.modules.profiles.server;
in
{
  options.modules.profiles.server = {
    enable = mkEnableOption "Base server profile";
  };

  config = mkIf cfg.enable {
    # Enabled modules
    modules = {
      profiles.base.enable = true;
      disko.enable = true;
      impermanence = {
        enable = true;
        resetScript = ''
          # Revert to the blank state for the root directory
          zfs rollback -r tank/root@blank
        '';
      };
      domain = {
        enable = mkDefault true;
        join = {
          userFile = config.sops.secrets."vm-join/user".path;
          passwordFile = config.sops.secrets."vm-join/password".path;
          domainOUFile = config.sops.secrets."vm-join/ou".path;
        };
      };
      ssh.enable = true;
    };

    # Initialize domain join secrets
    sops.secrets."vm-join/user" = { };
    sops.secrets."vm-join/password" = { };
    sops.secrets."vm-join/ou" = { };

    # Local user
    sops.secrets."passwords/local-hashed".neededForUsers = true;
    users.mutableUsers = false;
    users.users.local = {
      isNormalUser = true;
      group = "local";
      hashedPasswordFile = config.sops.secrets."passwords/local-hashed".path;
      extraGroups = [ "wheel" ];
      openssh.authorizedKeys.keys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKxoQSxfYqf9ITN8Fhckk8WbY4dwtBAXOhC9jxihJvq Admin"
      ];
    };
    users.groups.local = { };
    home-manager.users.local =
      { ... }:
      {
        home.stateVersion = "24.11";
        modules.profiles.base.enable = true;
      };

    # System packages
    environment.systemPackages = with pkgs; [
      # TODO: Make module for utilities/scripts
      (writeShellScriptBin "system-update" "nixos-rebuild switch --flake git+https://git.bulthuis.dev/Jan/nixos-config")
    ];

    # Machine platform
    nixpkgs.hostPlatform = mkDefault "x86_64-linux";

    # Set hostid (required for ZFS)
    networking.hostId = "deadbeef";

    # Hardware configuration
    hardware.enableRedistributableFirmware = true;
  };
}