{
  lib,
  ...
}:
{
  nix = {
    settings = {
      # extra-sandbox-paths = [ config.programs.ccache.cacheDir ];
      substituters = [
        "http://jallen-nas.local:9012/nas-cache"
        "https://nixos-apple-silicon.cachix.org"
        "https://nixos-raspberrypi.cachix.org"
        "https://nix-community.cachix.org"
        "https://cache.nixos.org/"
      ];
      trusted-public-keys = [
        "nas-cache:eK0eRVAt9QNwbkLIyOo9N5Z5+zi6ukI4mSlL196C7Yg="
        "nixos-apple-silicon.cachix.org-1:8psDu5SA5dAD7qA0zMy5UT292TxeEPzIz8VVEr2Js20="
        "nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI="
        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
      ];
      warn-dirty = lib.mkForce false;
      experimental-features = lib.mkForce [
        "nix-command"
        "flakes"
      ];
      trusted-users = [
        "@wheel"
        "@admin"
      ];

      builders-use-substitutes = true;
      connect-timeout = lib.mkDefault 5;
      fallback = true;
      log-lines = lib.mkDefault 25;

      max-free = lib.mkDefault (3000 * 1024 * 1024);
      min-free = lib.mkDefault (512 * 1024 * 1024);
    };
    # Garbage collect automatically every week
    gc = {
      automatic = lib.mkDefault true;
      options = lib.mkDefault "--delete-older-than 30d";
    };

    optimise.automatic = lib.mkDefault true;
  };

  nixpkgs = {
    config = {
      # CUDA and ROCm are not applicable on Darwin; those hardware modules are
      # NixOS-only.  Unfree allowance is handled globally via channels-config in
      # the flake.
      allowUnsupportedSystem = true;
    };
  };
}