{
  config,
  lib,
  pkgs,
  nixpkgs-as-input,
  templates,
  ...
}: let
  nixpkgs = nixpkgs-as-input;
in {
  nix = {
    package = pkgs.nixStable;

    registry = {
      nixpkgs.flake = nixpkgs;
      n.flake = nixpkgs;
      t.flake = templates;
    };

    gc = {
      automatic = true;
      dates = "weekly";
      options = "--delete-older-than 7d";
    };
    settings = {
      auto-optimise-store = true;
      experimental-features = [
        "nix-command"
        "flakes"
        #"ca-derivations"
      ];

      #substituters = ["https://cache.ngi0.nixos.org/"];
      #trusted-public-keys = ["cache.ngi0.nixos.org-1:KqH5CBLNSyX184S9BKZJo1LxrxJ9ltnY2uAs5c/f1MA="];
      fallback = true; # TODO what does this do?

      keep-failed = true; # keep failed tmp build dirs
      pure-eval = true; # restrict file system and network access to hash
    };
  };
}