{ config, pkgs, lib, ... }:
{
  config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
    # Create symlink from home to storage
    systemd.tmpfiles.rules = [
      "L+ /home/fred/storage - - - - /mnt/storage"
    ];

    # Basic system packages
    environment.systemPackages = with pkgs; [
      mergerfs
      wget
      util-linux
      javaPackages.compiler.temurin-bin.jre-25
      unzip
      screen
      yt-dlp
      ghostty.terminfo
      usbutils
      lm_sensors
      (pkgs.writeShellScriptBin "transcode-hevc" ''
        export PATH="${pkgs.jellyfin-ffmpeg}/bin:${pkgs.coreutils}/bin:${pkgs.findutils}/bin:${pkgs.gnugrep}/bin:${pkgs.gawk}/bin:${pkgs.bc}/bin:${pkgs.curl}/bin:$PATH"
        exec ${pkgs.bash}/bin/bash ${../scripts/transcode-hevc.sh} "$@"
      '')
      (pkgs.writeShellScriptBin "record-update" ''
        export PATH="${pkgs.nvd}/bin:${pkgs.coreutils}/bin:${pkgs.gnugrep}/bin:${pkgs.gnused}/bin:$PATH"
        exec ${pkgs.bash}/bin/bash ${../scripts/record-update.sh} "$@"
      '')
      # Stats stream for the quickshell server monitor on the desktops:
      # `ssh mediaserver qs-stats` = top's 2s batch stream, interleaved with
      # one @STAT line per tick (hottest coretemp across both sockets, WAN
      # byte rates from eno1). Everything rides one SSH connection.
      (pkgs.writeShellScriptBin "qs-stats" ''
        C=${pkgs.coreutils}/bin
        export LC_ALL=C
        ${pkgs.procps}/bin/top -b -d 2 -w 512 &
        trap 'kill $! 2>/dev/null' EXIT
        prev_rx=""
        while :; do
          t=0
          for h in /sys/class/hwmon/*; do
            if [ "$($C/cat "$h/name" 2>/dev/null)" = coretemp ]; then
              for f in "$h"/temp*_input; do
                v=$($C/cat "$f" 2>/dev/null || echo 0)
                [ "$v" -gt "$t" ] && t=$v
              done
            fi
          done
          read -r rx tx < <(${pkgs.gawk}/bin/awk '$1 == "eno1:" {print $2, $10}' /proc/net/dev)
          if [ -n "$prev_rx" ]; then
            echo "@STAT temp=$((t / 1000)) rxbps=$(( (rx - prev_rx) / 2 )) txbps=$(( (tx - prev_tx) / 2 ))"
          fi
          prev_rx=$rx
          prev_tx=$tx
          $C/sleep 2
        done
      '')
    ];

    # Basic networking
    networking.useDHCP = lib.mkForce false;

    # Allow fred to act as a remote Nix builder (trusted users can import
    # unsigned store paths sent by the build client).
    nix.settings.trusted-users = [ "root" "fred" ];

    # Automatic daily system updates
    system.autoUpgrade = {
      enable = true;
      flake = "git+https://forg.gregersen.it/rope/nixos";
      dates = "05:15";
      allowReboot = true;
    };

    # WAN exposure is controlled by nftables in services/router.nix +
    # ports.toml (networking.firewall is disabled on this host).
    services.openssh = {
      enable = true;
      settings = {
        PermitRootLogin = "no";
        PasswordAuthentication = false;
      };
    };
  };
}