{
  config,
  lib,
  pkgs,
  ...
}:
{
  networking.hostName = "public01";
  # TODO: make it the default
  networking.domain = "infra.forkos.org";

  bagel.sysadmin.enable = true;
  # Newsletter is proxied.
  bagel.raito.v6-proxy-awareness.enable = true;
  bagel.newsletter = {
    enable = true;
    domain = "news.forkos.org";
  };
  bagel.hardware.raito-vm = {
    enable = true;
    networking = {
      nat-lan-mac = "BC:24:11:A4:F7:D3";
      wan = {
        address = "2001:bc8:38ee:100:1000::60/64";
        mac = "BC:24:11:DB:B8:10";
      };
    };
  };

  bagel.services.s3-revproxy = {
    enable = true;
    domain = "forkos.org";
    s3.apiUrl = "s3.delroth.net";
    targets = {
      channels = "bagel-channels";
      releases = "bagel-releases";
      channel-scripts-test = "bagel-channel-scripts-test";
    };
  };

  i18n.defaultLocale = "en_US.UTF-8";

  system.stateVersion = "24.05";
  deployment.targetHost = "public01.infra.forkos.org";
}