{
  config,
  lib,
  namespace,
  ...
}:
let
  inherit (lib.${namespace}) nixSettings;
in
{
  nix = {
    settings = nixSettings.commonSettings // {
      # extra-sandbox-paths = [ config.programs.ccache.cacheDir ];
      substituters = [
        # NixOS-only: lantian attic cache (has some useful packages)
        "https://attic.xuyh0120.win/lantian"
      ]
      ++ nixSettings.commonSubstituters;
      trusted-public-keys = [
        "lantian:EeAUQ+W+6r7EtwnmYjeVwx5kOGEBpjlBfPlzGlTNvHc="
      ]
      ++ nixSettings.commonTrustedPublicKeys;
    };

    # Linux-specific: run the nix daemon at idle priority to avoid impacting
    # interactive work during builds.
    daemonCPUSchedPolicy = lib.mkDefault "idle";
    daemonIOSchedClass = lib.mkDefault "idle";
    daemonIOSchedPriority = lib.mkDefault 7;

    gc = nixSettings.commonGc;

    optimise.automatic = lib.mkDefault true;
  };

  # Give the nix-gc systemd unit the same idle-IO treatment as the daemon.
  systemd.services.nix-gc.serviceConfig = {
    CPUSchedulingPolicy = "batch";
    IOSchedulingClass = "idle";
    IOSchedulingPriority = 7;
  };

  nixpkgs = {
    config = {
      cudaSupport = lib.mkDefault config.${namespace}.hardware.nvidia.enable;
      rocmSupport = lib.mkDefault config.${namespace}.hardware.amd.enable;
      allowUnsupportedSystem = true;
    };
  };
}