{
  inputs,
  pkgs,
  lib,
  config,
  ...
}:
let
  configurationLimit = config.mod.gc.configurationLimit;
in
{
  imports = [ inputs.nix-gc-env.nixosModules.default ];

  options = {
    mod.gc = {
      configurationLimit = lib.mkOption {
        type = lib.types.int;
        default = 10;
        description = "number of configuration generations to keep";
      };
    };
  };

  config = {
    nix.gc = {
      automatic = true;
      dates = "weekly";

      # `delete_generations` added by nix-gc-env
      delete_generations = "+${builtins.toString configurationLimit}";
    };

    boot = {
      kernelPackages = pkgs.linuxPackages_latest;

      tmp.cleanOnBoot = true;

      kernel = {
        sysctl = {
          "fs.inotify.max_user_instances" = 1024; # default: 128
        };
      };

      loader = {
        systemd-boot = {
          enable = true;
          inherit configurationLimit;
        };

        efi.canTouchEfiVariables = true;
      };

      initrd.secrets = {
        "/crypto_keyfile.bin" = null;
      };
    };
  };
}