{ lib, ... }: {
  hardware.raspberry-pi.firmware.enable = true;
  hardware.enableRedistributableFirmware = true;
  hardware.enableAllHardware = lib.mkForce false;
  boot.initrd.availableKernelModules."tpm-crb" = lib.mkForce false;

  # Enable the OpenSSH daemon
  services.openssh = {
    enable = true;
    # Require SSH keys for login (disable passwords)
    settings.PasswordAuthentication = false;
  };

  # Define a user account
  users.users.jonathan = {
    isNormalUser = true;
    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFGgP6NnoYmgtork7XWkIy/k9lFs91y718S8Ez0PsagC Jonathan@Berrisch.biz"
    ];
  };

  # Allow passwordless sudo for the wheel group (convenient for headless setup)
  # security.sudo.wheelNeedsPassword = false;
}