{
  config,
  lib,
  pkgs,
  nodes,
  ...
}:
{
  networking.hostName = "buildbot";
  # TODO: make it the default
  networking.domain = "infra.forkos.org";

  bagel.sysadmin.enable = true;
  # Buildbot is proxied.
  bagel.raito.v6-proxy-awareness.enable = true;
  bagel.hardware.raito-vm = {
    enable = true;
    networking = {
      nat-lan-mac = "BC:24:11:E7:42:8B";
      wan = {
        address = "2001:bc8:38ee:100:1000::50/64";
        mac = "BC:24:11:C9:BA:6C";
      };
    };
  };

  bagel.services.buildbot = {
    enable = true;
    domain = "buildbot.forkos.org";
    gerrit =
      let
        cfgGerrit = nodes.gerrit01.config.bagel.services.gerrit;
      in
      {
        domain = cfgGerrit.canonicalDomain;
        port = cfgGerrit.port;
        username = "buildbot";
      };
    cors.allowedOrigins = [
      "https://*.forkos.org"
    ];
    projects = [
      "buildbot-test"
      "nixpkgs"
      "infra"
    ];
    builders = [ "builder-4" ];
  };

  i18n.defaultLocale = "en_US.UTF-8";

  system.stateVersion = "24.05";
  deployment.targetHost = "buildbot.infra.forkos.org";
}