{ ... }:

{
  # Determinate already manages the Nix daemon, so nix-darwin shouldn't.
  nix.enable = false;
  programs.zsh.enable = true; 

  # SSH server (macOS 14.4+ gates `systemsetup -setremotelogin` behind Full Disk Access; nix-darwin loads ssh.plist via launchd directly instead).
  services.openssh.enable = true;

  nixpkgs.config.allowUnfree = true;
  nixpkgs.hostPlatform = "aarch64-darwin"; # use x86_64-darwin for Intel CPU

  system.primaryUser = "laptran";
  users.users.laptran = {
    home = "/Users/laptran";
  };

  system.stateVersion = 6;
  system.defaults = {
    NSGlobalDomain = {
      AppleInterfaceStyle = "Dark";
      KeyRepeat = 2;          # fast key repeat
      InitialKeyRepeat = 15;  # short delay before repeat
      _HIHideMenuBar = true;  # auto-hide the menu bar
      AppleShowAllExtensions = true;
    };
    dock.autohide = true;
    finder.FXPreferredViewStyle = "Nlsv";  # list view by default
    finder.CreateDesktop = false;          # clean desktop
    trackpad.Clicking = true;              # tap to click
  };

  nix-homebrew = {
    enable = true;
    user = "laptran";
    autoMigrate = true; # adopt existing homebrew if already installed
  };

  homebrew = {
    enable = true;
    onActivation.cleanup = "zap";  # remove anything not listed here
    onActivation.autoUpdate = true;
    onActivation.upgrade = true;   # upgrade outdated formulae/casks on rebuild
    onActivation.extraFlags = [ "--force" ];
    brews = [
      "ffmpeg"
      "gh"
      "herdr"
      "node"      # required: opencode2 is an npm global, not a Homebrew formula
      "pi-coding-agent"
      "tea"       # Gitea CLI - PRs for firstmate crewmates on unraid.local:3003
      "tmux"
      "treehouse"
    ];
    casks = [
      "docker-desktop"
      "grok-build"
      "puremac"
      "utm"
      "wezterm"
    ];
  };
}