{
  config,
  inputs,
  lib,
  pkgs,
  ...
}:
{
  imports = [
    inputs.matthew-hardware.nixosModules.mt7986a-glinet-gl-mt6000
  ];

  # matthew-hardware's common/generic-uefi-image.nix still sets
  # `image.repart.enable = true`; nixpkgs removed that option (importing
  # image/repart.nix now always defines system.build.image). Declare it so the
  # definition has somewhere to land. Drop once upstream stops setting it.
  options.image.repart.enable = lib.mkOption {
    type = lib.types.bool;
    default = true;
    internal = true;
  };

  config = {
    hardware.mt7986a-glinet-gl-mt6000.enable = true;
    hardware.mt7986a-glinet-gl-mt6000.zealous = true;
    hardware.mt7986a-glinet-gl-mt6000.image.repart.enable = true;

    nixpkgs.hostPlatform.system = "aarch64-linux";
    nixpkgs.buildPlatform.system = "x86_64-linux";

    system.stateVersion = "26.11";
    clan.core.sops.defaultGroups = [ "admins" ];

    clan.core.settings.name = "stellio";
    clan.core.settings.machine.description = "Flint-2 router";

    # Root is ext4 on the Flint 2's eMMC: keep steady-state writes off it.
    # Logs live in RAM (64M; the router needs them for pppd/kea debugging,
    # unlike sirius which drops them), /tmp is tmpfs, no core dumps, and
    # ext4 skips atime updates and flushes its journal every 60 s instead
    # of 5 s so the small periodic writes (Kea leases, timesyncd clock,
    # speedtest textfile) coalesce. A power cut loses at most a minute of
    # that state, none of which matters on a gateway.
    fileSystems."/".options = [
      "noatime"
      "commit=60"
    ];
    boot.tmp.useTmpfs = true;
    services.journald.settings.Journal = {
      Storage = "volatile";
      RuntimeMaxUse = "64M";
    };
    systemd.coredump.enable = false;

    # nixpkgs' services.blocky check runs the aarch64 blocky in a
    # system.checks derivation, which an x86_64 builder without binfmt cannot
    # execute (`--max-jobs 0` -> Exec format error). Validate the same YAML
    # with the build host's blocky instead. Drop once cnx-network's router
    # service carries this itself (router/dns: validate the Blocky config
    # with the build host's binary).
    services.blocky.enableConfigCheck = false;
    system.checks = [
      (pkgs.runCommand "check-blocky-config" { } ''
        ${lib.getExe pkgs.buildPackages.blocky} --config ${
          (pkgs.formats.yaml { }).generate "blocky-config.yaml" config.services.blocky.settings
        } validate && touch $out
      '')
    ];
  };
}