{
  pkgs,
  config,
  # these come in via home-manager.extraSpecialArgs and are specific to each node
  nodeFlake,
  packages',
  repoFlake,
  # repoFlakeInputs',
  ...
}: let
  pkgsMaster = nodeFlake.inputs.nixpkgs-master.legacyPackages.${pkgs.system};
  pkgsUnstableSmall = nodeFlake.inputs.nixpkgs-unstable-small.legacyPackages.${pkgs.system};
  pkgs2211 = nodeFlake.inputs.nixpkgs-2211.legacyPackages.${pkgs.system};
  # pkgs2211 = repoFlakeInputs'.nixpkgs-2211.legacyPackages;
in {
  imports = [
    ../profiles/common.nix
    ../profiles/dotfiles.nix
    # FIXME: fix homeshick when no WAN connection is available
    # ../programs/homeshick.nix

    # ../profiles/gnome-desktop.nix
    ../profiles/sway-desktop.nix
    # ../profiles/experimental-desktop.nix

    ../programs/redshift.nix
    ../programs/gpg-agent.nix

    # ../programs/espanso.nix

    ../programs/firefox.nix
    ../programs/chromium.nix

    ../programs/libreoffice.nix
    ../programs/neovim.nix
    ../programs/pass.nix
    ../programs/vscode

    # TODO: bump these to 23.05 and make it work
    (args: import ../programs/radicale.nix (args // {pkgs = pkgs2211;}))
    # (args: import ../programs/espanso.nix (args // {pkgs = pkgs2211;}))
  ];

  home.sessionVariables.HM_CONFIG = "graphical-fullblown";
  home.sessionVariables.GOPATH = "$HOME/src/go";
  home.sessionVariables.PATH = pkgs.lib.concatStringsSep ":" ["$HOME/.local/bin" "$PATH"];

  nixpkgs.config.permittedInsecurePackages = [
  ];

  home.packages =
    []
    ++ (with pkgs; [
      # Authentication
      cacert
      fprintd
      openssl
      mkpasswd

      # Nix package related tools
      patchelf
      nix-index
      nix-prefetch-scripts
      # nix-prefetch-github

      # Version Control Systems
      gitFull
      pijul
      # gitless
      gitRepo
      git-lfs

      # Process/System Administration
      htop
      # gnome.gnome-tweaks
      xorg.xhost
      dmidecode
      evtest

      # Archive Managers
      sshfs-fuse
      p7zip
      zip
      unzip
      gzip
      lzop

      # Password Management
      gnupg
      # yubikey-manager
      yubikey-manager-qt
      yubikey-personalization
      yubikey-personalization-gui

      # gnome.gnome-keyring
      gcr
      gnome.seahorse

      # Language Support
      hunspellDicts.en-us
      hunspellDicts.de-de

      # Messaging/Communication
      # pidgin
      hexchat
      schildichat-desktop
      aspellDicts.en
      aspellDicts.de
      # skypeforlinux
      # pkgsUnstable.jitsi-meet-electron
      thunderbird
      evolution # gnome4.glib_networking

      # FIXME: depends on insecure openssl 1.1.1t
      # kotatogram-desktop
      tdesktop
      (let
        version = "6.20.0-beta.1";
      in
        pkgsUnstableSmall.signal-desktop-beta.overrideAttrs (old: {
          inherit version;
          src = builtins.fetchurl {
            url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop-beta/signal-desktop-beta_${version}_amd64.deb";
            sha256 = "0xkagnldagfxnpv4c23yd9w0kz1y719m1sj9vqn8mnr1zfn7j62a";
          };
          preFixup =
            old.preFixup
            + ''
              gappsWrapperArgs+=(
                --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto}}"
                --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform}}"
              )
            '';
        }))

      # --add-flags "--enable-features=UseOzonePlatform"
      # --add-flags "--ozone-platform=wayland"
      (pkgsUnstableSmall.session-desktop.overrideAttrs (old: {
        nativeBuildInputs =
          old.nativeBuildInputs
          ++ [
            pkgs.wrapGAppsHook
          ];

        preFixup =
          (old.preFixup or "")
          + ''
            gappsWrapperArgs+=(
              --add-flags "--enable-features=UseOzonePlatform"
              --add-flags "--ozone-platform=wayland"
              # --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto}}"
              # --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=WaylandWindowDecorations}}"
              # --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform}}"
            )
          '';
      }))

      #(pkgsUnstableSmall.session-desktop.overrideAttrs(old: {
      #    nativeBuildInputs = old.nativeBuildInputs ++ [
      #      pkgs.wrapGAppsHook
      #    ];
      #
      #    preFixup = (old.preFixup or "") + ''
      #      gappsWrapperArgs+=(
      #        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland}}"
      #        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform}}"
      #      )
      #    '';
      #  }))

      thunderbird
      # gnome.cheese
      discord

      # Virtualization
      # virtmanager

      # Remote Control Tools
      remmina
      freerdp
      teamviewer
      rustdesk

      # Audio/Video Players
      ffmpeg
      vlc
      audacity
      spotify
      yt-dlp
      (writeShellScriptBin "youtube-dl-audio" "${yt-dlp}/bin/yt-dlp --extract-audio --audio-format best --audio-quality 9 \${@:?}")
      libwebcam

      # Network Tools
      openvpn
      tcpdump
      iftop
      iperf
      bind
      socat
      # 2019-03-05: broken on 19.03 linssid
      iptraf-ng
      ipmitool

      iptables
      nftables
      wireshark
      wireguard-tools

      # Code Editors
      xclip
      xsel

      # Image/Graphic/Design Tools
      gnome.eog
      gimp
      imagemagick
      exiv2
      graphviz
      inkscape
      qrencode
      zbar
      feh

      # TODO: remove or move these: Modelling Tools
      # plantuml
      # umlet
      # staruml
      # eclipses.eclipse-modeling
      # dia
      # astah-community

      # Misc Development Tools
      qrcode
      jq
      cdrtools

      # Document Processing and Management
      gnome.nautilus
      xfce.thunar
      pcmanfm
      # mendeley
      evince
      ((pkgsMaster.logseq.overrideAttrs (finalAttrs: previousAttrs: {
          version = "nightly";
          src = repoFlake.inputs.logseqNightly;
        }))
        .override (_: {
          electron = pkgs.electron_24;
        }))

      # File Synchronzation
      maestral
      maestral-gui
      rsync

      # Filesystem Tools
      ntfs3g
      ddrescue
      ncdu
      unetbootin
      hdparm
      testdisk
      # binwalk
      gptfdisk
      gparted
      smartmontools

      ## Android
      androidenv.androidPkgs_9_0.platform-tools

      ## Python
      packages'.myPython

      # Misc Desktop Tools
      ltunify
      # dex
      xorg.xbacklight
      coreutils
      lsof
      xdotool
      xdg_utils
      xdg-user-dirs
      dconf
      picocom
      glib.dev # contains gdbus tool
      alacritty
      wally-cli
      man-pages

      # Screen recording
      # gtk-recordmydesktop # can't select the window
      # qt-recordmydesktop
      # vokoscreen
      # shutter
      # kazam # doesn't start
      # xvidcap # doesn't keep the recording rectangle
      # obs-studio
      # shotcut
      # openshot-qt
      # introduces python: screenkey

      pkgsUnstableSmall.ledger-live-desktop
    ]);

  systemd.user.startServices = true;
  services.syncthing.enable = true;

  services.udiskie = {
    enable = true;
    automount = true;
    notify = true;
  };

  # FIXME: doesn't work as the service can't seem to control its started PID
  services.dropbox = {
    enable = false;
    path = "${config.home.homeDirectory}/Dropbox-Hm";
  };

  # TODO: uncomment this when it's in stable home-manger
  # programs.joshuto = {
  #   enable = true;
  # };

  # systemd.user.services.maestral = {
  #   Unit.Description = "Maestral daemon";
  #   Install.WantedBy = ["default.target"];
  #   Service = {
  #     ExecStart = "${pkgs.maestral}/bin/maestral start -f";
  #     ExecStop = "${pkgs.maestral}/bin/maestral stop";
  #     Restart = "on-failure";
  #     Nice = 10;
  #   };
  # };
}