{
  pkgs,
  ...
}:
let
  onlyoffice-with-fonts = pkgs.buildFHSEnv {
    name = "onlyoffice-desktopeditors";
    targetPkgs =
      pkgs': with pkgs'; [
        onlyoffice-desktopeditors
        corefonts
        vista-fonts
        fira-code
        fira-code-symbols
        nerd-fonts.fira-code
        dejavu_fonts
        liberation_ttf
      ];
    runScript = "onlyoffice-desktopeditors";
    extraInstallCommands = ''
      mkdir -p $out/share/applications
      cp -r ${pkgs.onlyoffice-desktopeditors}/share/icons $out/share/
      cp -r ${pkgs.onlyoffice-desktopeditors}/share/applications/* $out/share/applications/
      substituteInPlace $out/share/applications/onlyoffice-desktopeditors.desktop \
        --replace-fail "${pkgs.onlyoffice-desktopeditors}/bin/onlyoffice-desktopeditors" "$out/bin/onlyoffice-desktopeditors"
    '';
  };
in
{
  networking.networkmanager.enable = true;

  hardware.bluetooth.enable = true;
  # Allow the desktop user to pair/connect devices through bluez without root
  # (bluetoothctl's device flows surface the org.bluez.agent polkit action).
  security.polkit.extraConfig = ''
    polkit.addRule(function(action, subject) {
      if (action.id === "org.bluez.agent" && subject.user === "petere")
        return polkit.Result.YES;
    });
  '';

  # GNOME Keyring: credential store for desktop apps (Nextcloud OAuth tokens,
  # Element session keys, etc.). The PAM module auto-unlocks the keyring at
  # login so apps get seamless access to stored secrets across reboots.
  services.gnome.gnome-keyring.enable = true;

  services.flatpak = {
    enable = true;
    packages = [
      "it.mijorus.gearlever"
      "com.github.tchx84.Flatseal"
    ];
    # Pin Flathub remote explicitly with GPG verification.
    remotes = [
      {
        name = "flathub";
        location = "https://dl.flathub.org/repo/flathub.flatpakrepo";
      }
    ];
  };

  # Weekly Flatpak garbage collection: remove unused runtimes and orphaned refs.
  systemd.services.flatpak-gc = {
    description = "Flatpak garbage collection (remove unused runtimes)";
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      Type = "oneshot";
      ExecStart = "${pkgs.flatpak}/bin/flatpak uninstall --unused -y";
    };
  };

  systemd.timers.flatpak-gc = {
    description = "Run Flatpak garbage collection weekly";
    wantedBy = [ "timers.target" ];
    timerConfig = {
      OnCalendar = "weekly";
      Persistent = true;
    };
  };

  # Enable CUPS to print documents.
  services.printing.enable = true;

  # Enable Avahi for network printer discovery.
  services.avahi = {
    enable = true;
    nssmdns4 = true;
    openFirewall = true;
    publish = {
      enable = true;
      addresses = true;
      userServices = true;
    };
  };

  # avahi requires /run/avahi-daemon to be owned by the avahi user, and
  # restarts during `nixos-rebuild switch` leave a stale pid file that makes
  # the next start fail ("Failed to create PID file: File exists"). Without
  # both fixes avahi-daemon fails on every rebuild, which also breaks
  # `nixos-rebuild switch` (switch-to-configuration exits non-zero).
  systemd.services.avahi-daemon.preStart = "rm -f /run/avahi-daemon/pid";
  systemd.tmpfiles.rules = [
    "d /run/avahi-daemon 0755 avahi avahi -"
  ];

  services.printing.drivers = [
    pkgs.brlaser
    pkgs.brgenml1lpr
    pkgs.brgenml1cupswrapper
  ];

  hardware.printers.ensurePrinters = [
    {
      name = "Brother_MFC_L2710DW";
      deviceUri = "implicitclass://Brother_MFC_L2710DW_series/";
      model = "drv:///brlaser.drv/brl2710w.ppd"; # Let CUPS determine the PPD from installed drivers
    }
  ];

  programs.firefox.enable = true;

  environment.systemPackages = with pkgs; [
    vim
    git
    wget
    appimage-run
    bitwarden-desktop
    chromium
    vlc
    python3Packages.python-vlc
    stable.element-desktop
    pkgs.kdePackages.kdenlive
    thunderbird
    nextcloud-client
    nautilus-python
    onlyoffice-with-fonts
  ];
}