{
  # Network / domains
  lanDomain = "gitea.lan.ddnsgeek.com"; # Gitea/DDNS domain
  homeDomain = "sweet.home"; # base LAN domain for service subdomains (pve., docker.)
  tailnetDomain = "tail13f623.ts.net"; # Tailscale MagicDNS suffix
  lanCidr = "192.168.2.0/24"; # LAN subnet
  pxeServerIp = "192.168.2.247"; # pxe-boot host's LAN IP
  pbsIp = "192.168.2.108"; # Proxmox Backup Server LAN IP

  # Cross-host references (LAN hostnames/users other hosts reach over the network)
  nixCacheHost = "nix-cache"; # substituter/remote-builder hostname
  nfsServerHost = "server"; # NFS export source hostname
  dockerHost = "docker"; # docker-compose stack host

  remoteBuilderUser = "nixremote"; # remote builder SSH user

  # Public keys authorized to SSH in as remoteBuilderUser on the nix-cache
  # host (modules/nix-cache/server.nix) — one per client host that's allowed
  # to use it as a distributed builder.
  remoteBuilderAuthorizedKeys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFDEA1S2ikpObREgbP5uVBWMxIOGbY8B+Wx7VTZK1m6t root@server"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAYIT9ormlmxZ0SziyDQaUntnKI8HK9/s3Qac1ZKjP2 root@docker"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKKKzoEPl/ZW9KBRHBcp6/ThOngGpwMv5EhkTlgC4aDf root@nixos"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGtOWOCS+ImHc7NehguoyD7PbonGosKMZqc9+QR3v/h root@nixos"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHxXTQxFnArK5HXG7czeoybZebCGfxpUdusJkPn+BCSp root@server"
  ];

  # System
  timeZone = "Australia/Brisbane";
  primaryUser = "nixos"; # main interactive user on every host

  # Storage
  storageRoot = "/tank"; # ZFS pool root on `server`

  # Well-known ports for LAN services referenced from multiple hosts
  beszelHubPort = 8090;
  pveWebPort = 8006;
  pbsWebPort = 8007;
}