{
  pkgs,
  lib,
  config,
  # these come in via home-manager.extraSpecialArgs and are specific to each node
  nodeFlake,
  repoFlake,
  packages',
  ...
}: let
  # pkgsMaster = nodeFlake.inputs.nixpkgs-master.legacyPackages.${pkgs.system};
  pkgsUnstable = import nodeFlake.inputs.nixpkgs-unstable {inherit (pkgs) system config;};
in {
  imports = [
    ../profiles/common.nix
    # ../profiles/dotfiles.nix
    # FIXME: fix homeshick when no WAN connection is available
    # ../programs/homeshick.nix

    # ../profiles/gnome-desktop.nix
    # ../profiles/experimental-desktop.nix

    ../programs/redshift.nix

    ../programs/gpg-agent.nix
    ../programs/pass.nix

    ../programs/espanso.nix

    ../programs/firefox.nix
    ../programs/chromium.nix

    ../programs/libreoffice.nix
    ../programs/neovim.nix
    ../programs/vscode
  ];

  home.sessionVariables.HM_CONFIG = "graphical-fullblown";
  home.sessionVariables.GOPATH = "$HOME/src/go";
  home.sessionVariables.PATH = pkgs.lib.concatStringsSep ":" ["$HOME/.local/bin" "$PATH"];

  nixpkgs.config.allowInsecurePredicate = pkg:
    builtins.elem (lib.getName pkg) [
      "electron-28.3.3"
      "electron-27.3.11"
    ];

  nixpkgs.config.permittedInsecurePackages = [
    "electron-28.3.3"
    "electron-27.3.11"
  ];

  home.packages =
    []
    ++ (with pkgs; [
      # Authentication
      # cacert
      # fprintd
      # openssl
      # mkpasswd

      # Nix package related tools
      patchelf
      # nix-index
      nix-prefetch-scripts
      nix-tree

      # Version Control Systems
      gitFull
      # gitless
      gitRepo
      git-lfs

      # Process/System Administration
      htop
      # gnome.gnome-tweaks
      xorg.xhost
      dmidecode
      evtest

      # Archive Managers
      sshfs-fuse
      p7zip
      zip
      unzip
      gzip
      lzop

      # Password Management
      gnupg
      # yubikey-manager
      yubikey-manager-qt
      yubikey-personalization
      yubikey-personalization-gui

      # gnome.gnome-keyring
      gcr
      gnome.seahorse

      # Language Support
      hunspellDicts.en-us
      hunspellDicts.de-de

      # Messaging/Communication
      # pidgin
      # hexchat
      pkgsUnstable.element-desktop
      aspellDicts.en
      aspellDicts.de
      # skypeforlinux
      # pkgsUnstable.jitsi-meet-electron
      thunderbird-115
      # betterbird

      # FIXME: depends on insecure openssl 1.1.1t
      # kotatogram-desktop
      pkgsUnstable.tdesktop
      # TODO: remove or reuse this depending on whether waydroid signal works
      pkgsUnstable.signal-desktop

      # gnome.cheese

      # Virtualization
      virt-manager

      # Remote Control Tools
      remmina
      # freerdp

      # Audio/Video Players
      ffmpeg
      vlc
      # v4l-utils
      # audacity
      # spotify
      yt-dlp
      (writeShellScriptBin "youtube-dl-audio" "${yt-dlp}/bin/yt-dlp --extract-audio --audio-format best --audio-quality 9 \${@:?}")
      libwebcam

      # Network Tools
      tcpdump
      iftop
      iperf
      bind
      socat
      nethogs

      # Code Editing and Programming
      # TODO(remove or use): pkgsUnstable.lapce
      # TODO(remve or use): pkgsUnstable.helix

      # Image/Graphic/Design Tools
      gnome.eog
      # gimp
      # imagemagick
      # exiv2
      # graphviz
      # inkscape
      # qrencode

      # TODO: remove or move these: Modelling Tools
      # plantuml
      # umlet
      # staruml
      # eclipses.eclipse-modeling
      # dia
      # astah-community

      # Misc Development Tools
      # qrcode
      # jq
      # cdrtools

      # Document Processing and Management
      gnome.nautilus
      pcmanfm
      # mendeley
      evince
      xournalpp

      # File Synchronzation
      maestral
      rsync

      # Filesystem Tools
      # ntfs3g
      # ddrescue
      # ncdu
      # hdparm
      # binwalk
      # gptfdisk
      # gparted
      # smartmontools

      ## Python
      # packages'.myPython

      # Misc Desktop Tools
      # ltunify
      # dex
      coreutils
      lsof
      xdg_utils
      xdg-user-dirs
      dconf
      picocom
      glib.dev # contains gdbus tool
      alacritty
      # wally-cli
      man-pages

      # Screen recording
      # gtk-recordmydesktop # can't select the window
      # qt-recordmydesktop
      # vokoscreen
      # shutter
      # kazam # doesn't start
      # xvidcap # doesn't keep the recording rectangle
      # shotcut
      # openshot-qt
      # introduces python: screenkey

      # avidemux # broken
      # handbrake

      # snes9x
      # snes9x-gtk
      # this is a displaymanager!
      # libretro.snes9x2010
      # retroarchFull

      packages'.logseq
      # (pkgs.runCommand "logseq-wrapper"
      #   {
      #     nativeBuildInputs = [ pkgs.makeWrapper ];
      #   } ''
      #   makeWrapper ${pkgs.logseq}/bin/logseq $out/bin/logseq  \
      #         --set NIXOS_OZONE_WL ""
      # '')
    ])
    ++ (lib.lists.optionals (!pkgs.stdenv.targetPlatform.isAarch64) [
      ])
    ++ (lib.lists.optionals (!pkgs.stdenv.targetPlatform.isAarch64) [
      pkgsUnstable.ledger-live-desktop

      # unsupported on aarch64-linux
      pkgs.androidenv.androidPkgs_9_0.platform-tools
      pkgs.teamviewer
      pkgs.discord
      pkgsUnstable.session-desktop
      pkgsUnstable.rustdesk
    ]);

  systemd.user.startServices = true;

  services.syncthing.enable = true;

  services.udiskie = {
    enable = true;
    automount = false;
    notify = true;
  };

  # TODO: uncomment this when it's in stable home-manger
  # programs.joshuto = {
  #   enable = true;
  # };

  # systemd.user.services.maestral = {
  #   Unit.Description = "Maestral daemon";
  #   Install.WantedBy = ["default.target"];
  #   Service = {
  #     ExecStart = "${pkgs.maestral}/bin/maestral start -f";
  #     ExecStop = "${pkgs.maestral}/bin/maestral stop";
  #     Restart = "on-failure";
  #     Nice = 10;
  #   };
  # };
}