{ lib, pkgs, modulesPath, config, ... }:
let
  inherit (lib) mkDefault mkForce mkImageMediaOverride;

  installRoot = "/mnt";
in
{
  imports = [
    # Lots of kernel modules and firmware
    "${modulesPath}/profiles/all-hardware.nix"
    # Useful tools to have
    "${modulesPath}/profiles/base.nix"
  ];

  config = {
    my = {
      # Whatever installer mechanism is chosen will provied an appropriate `/`
      tmproot.enable = false;
      firewall.nat.enable = false;
      server.enable = true;
      deploy.enable = false;
      user.enable = false;
    };

    environment.sessionVariables = {
      INSTALL_ROOT = installRoot;
    };
    users.users.root.openssh.authorizedKeys.keyFiles = [ lib.my.authorizedKeys ];
    home-manager.users.root = {
      programs = {
        starship.settings = {
          hostname.ssh_only = false;
        };
      };

      home.shellAliases = {
        show-hw-config = "nixos-generate-config --show-hardware-config --root $INSTALL_ROOT";
      };
    };

    services = {
      openssh = {
        permitRootLogin = mkImageMediaOverride "prohibit-password";
      };
    };

    # Will be set dynamically
    networking.hostName = "";

    # This should be overridden by whatever boot mechanism is used
    fileSystems."/" = mkDefault {
      device = "none";
      fsType = "tmpfs";
    };

    systemd.tmpfiles.rules = [
      "d ${installRoot} 0755 root root"
    ];
    boot.postBootCommands =
      ''
        ${pkgs.nettools}/bin/hostname "installer-$(${pkgs.coreutils}/bin/head -c4 /dev/urandom | \
          ${pkgs.coreutils}/bin/od -A none -t x4 | \
          ${pkgs.gawk}/bin/awk '{ print $1 }')"
      '';

    environment.systemPackages = with pkgs; [
      # We disable networking.useDHCP, so bring these in for the user
      # dhcpcd probably has more features, but dhclient actually seems a bit more simple
      (pkgs.writeShellScriptBin "dhclient" ''exec ${pkgs.dhcp}/bin/dhclient -v "$@"'')
      dhcpcd
    ];

    # Much of this onwards is yoinked from modules/profiles/installation-device.nix
    # Good to have docs in the installer!
    # TODO: docs rebuilding every time?
    documentation.enable = mkForce false;
    documentation.nixos.enable = mkForce false;

    # Enable wpa_supplicant, but don't start it by default.
    networking.wireless.enable = mkDefault true;
    networking.wireless.userControlled.enable = true;
    systemd.services.wpa_supplicant.wantedBy = mkForce [];

    # Tell the Nix evaluator to garbage collect more aggressively.
    # This is desirable in memory-constrained environments that don't
    # (yet) have swap set up.
    environment.variables.GC_INITIAL_HEAP_SIZE = "1M";

    # Make the installer more likely to succeed in low memory
    # environments.  The kernel's overcommit heustistics bite us
    # fairly often, preventing processes such as nix-worker or
    # download-using-manifests.pl from forking even if there is
    # plenty of free memory.
    boot.kernel.sysctl."vm.overcommit_memory" = "1";
  };
}