{ config, lib, pkgs, ... }:
{
  services.home-assistant = {
    enable = true;
    configDir = "/var/lib/hass";

    # disables config generation, i don't wanna configure home assistant
    # through nix at the moment
    config = null;

    extraComponents = [
      "esphome"
      "met"
      "radio_browser"
    ];

    extraPackages = python3Packages: with python3Packages; [
      getmac
    ];
  };

  systemd.tmpfiles.rules = [
    # configures the config directory to be mounted
    # correclty with the right permissions
    "z /var/lib/hass 0755 hass hass -"
    "z /var/lib/hass/lost+found 0755 hass hass -"
  ];

  networking = {
    nftables.enable = true;

    firewall = {
      enable = true;
      allowedTCPPorts = [
        8123
      ];
    };
  };

  users.users.nixos = {
    isNormalUser = true;
    uid = 1000;
    extraGroups = ["wheel"];

    hashedPassword = "$2b$05$94fPE/15g7ix7glKOaN0AeVMpitMivtQtcFL.aZIouQngOJ6nGMSC";
  };

  system.stateVersion = "25.11";
}