{ config, lib, pkgs, ... }:

{
  # === Minimal NixOS VM for flake testing (aarch64, UTM) ===

  # Boot
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  # Networking
  networking.hostName = "scobleclaw-vm";
  networking.networkmanager.enable = true;
  networking.useDHCP = false;
  networking.interfaces.eth0.useDHCP = true;

  # Time zone / locale
  time.timeZone = "America/Los_Angeles";
  i18n.defaultLocale = "en_US.UTF-8";

  # User
  users.users.sscoble = {
    isNormalUser = true;
    extraGroups = [ "wheel" "networkmanager" ];
    initialPassword = "changeme";  # Change on first login
  };

  # Security: allow passwordless sudo for wheel
  security.sudo.wheelNeedsPassword = false;

  # SSH for remote access
  services.openssh = {
    enable = true;
    settings.PasswordAuthentication = true;
  };

  # Standard packages (keep it minimal)
  environment.systemPackages = with pkgs; [
    git
    curl
    wget
    vim
    htop
    tmux
    tree
  ];

  # Enable flakes
  nix.settings.experimental-features = [ "nix-command" "flakes" ];

  # State version
  system.stateVersion = "25.11";
}