{
  config,
  lib,
  pkgs,
  ...
}:

let
  inherit (lib)
    mkDefault
    optional
    versionOlder
    versions
    ;
in
{
  nix.package = mkDefault pkgs.nix;

  # for `nix run synix#foo`, `nix build synix#bar`, etc
  nix.registry = {
    synix = {
      from = {
        id = "synix";
        type = "indirect";
      };
      to = {
        owner = "sid";
        repo = "synix";
        host = "git.sid.ovh";
        type = "gitea";
      };
    };
  };

  # fallback quickly if substituters are not available.
  nix.settings.connect-timeout = mkDefault 5;
  nix.settings.fallback = true;

  nix.settings.experimental-features = [
    "nix-command"
    "flakes"
  ]
  ++ optional (
    config.nix.package != null && versionOlder (versions.majorMinor config.nix.package.version) "2.22"
  ) "repl-flake";

  nix.settings.log-lines = mkDefault 25;

  # avoid disk full issues
  nix.settings.max-free = mkDefault (3000 * 1024 * 1024);
  nix.settings.min-free = mkDefault (512 * 1024 * 1024);

  # avoid copying unnecessary stuff over SSH
  nix.settings.builders-use-substitutes = true;

  # workaround for https://github.com/NixOS/nix/issues/9574
  nix.settings.nix-path = config.nix.nixPath;

  nix.settings.download-buffer-size = 524288000; # 500 MiB

  # add all wheel users to the trusted-users group
  nix.settings.trusted-users = [
    "@wheel"
  ];

  # binary caches
  nix.settings.substituters = [
    "https://cache.nixos.org"
    "https://nix-community.cachix.org"
    "https://cache.garnix.io"
    "https://numtide.cachix.org"
  ];
  nix.settings.trusted-public-keys = [
    "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
    "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
    "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
    "numtide.cachix.org-1:2ps1kLBUWjxIneOy1Ik6cQjb41X0iXVXeHigGmycPPE="
  ];

  nix.gc = {
    automatic = true;
    dates = "weekly";
    options = "--delete-older-than 30d";
  };
}