{ pkgs, config, ... }: {
  environment.systemPackages = with pkgs; [
    #== Essential libraries ==#
    dbus
    at-spi2-atk
    libnotify
    gtk3
    yad  # GUI dialogs in shell scripts
    cairo  # 2D graphics
    zenity  # display dialogs from cli
    gnome.gvfs  # virtual filesystem

    #== Primary applications ==#
    openbox lxappearance obconf  # window manager and tools
    picom  # compositor
    nixpkgs-2305.tint2  # taskbar
    dunst dunst-applet  # notifications
    jgmenu  # app menu
    i3lock-color  # lockscreen
    lightdm lightdm-gtk-greeter  # session manager

    #== X11 tools ==#
    lxqt.lxqt-policykit
    xautolock  # lock on inactivity
    xkbmon  # keyboard language/layout monitor

    #== System tools ==#
    gnome-disk-utility
    nixpkgs-mint.gnome.gnome-system-monitor  # system monitor
    nixpkgs-mint.gnome.baobab  # disk usage analyzer
    nixpkgs-2305.simple-scan  # document scanner

    #== Freedesktop ==#
    xdg-desktop-portal-gtk
    xdg-desktop-portal-xapp
    menu-cache  # read menu files

    #== Tray applications ==#
    libappindicator
    pnmixer  # audio control

    #== File viewers/editors ==#
    atril  # PDF/PostScript/DJVU/...
    eom  # PNG/JPEG/...
    engrampa  # archives
    nixpkgs-2305.cinnamon.nemo-with-extensions  # file manager
    seahorse  # GnomeKeyring manager

    #== Themes ==#
    nixpkgs-mint.cinnamon.mint-themes
    nixpkgs-mint.cinnamon.mint-y-icons
    oreo-black-bordered-cursor
    openbox-theme-collections
    openbox-blocks-dark
  ] ++
  (if config.hardware.bluetooth.enable then
  [
    blueman  # bluetooth configuration
  ]
  else []) ++
  (if config.networking.networkmanager.enable then
  [
    networkmanagerapplet
  ]
  else []);

  security = {
    polkit.enable = true;
    pam.services.i3lock.enable = true;
  };

  xdg.portal = {
    enable = true;
    configPackages = with pkgs; [ xdg-desktop-portal-gtk xdg-desktop-portal-xapp ];
    config.common = {
      default = [ "gtk" "xapp" ];
      "org.freedesktop.impl.portal.Screenshot" = [ "xapp" ];
    };
  };

  programs = {
    dconf = {
      enable = true;
      profiles.user.databases = [{
        lockAll = true;
        settings."org/cinnamon/desktop/applications/terminal" = {
          exec = "${pkgs.terminator}/bin/terminator";
        };
        settings."org/cinnamon/desktop/default-applications/terminal" = {
          exec = "${pkgs.terminator}/bin/terminator";
        };
      }];
    };
    gnome-disks.enable = true;
  };

  services = {
    dbus.packages = with pkgs; [ gnome2.GConf ];
    udev.packages = with pkgs; [ gnome-settings-daemon ];

    udisks2.enable = true; # gnome-disks disk access
    gnome.gnome-keyring.enable = true;
    gvfs.enable = true; # MTP (for nemo)

    logind.settings.Login = {
      InhibitDelayMaxSec = 1;
      HoldoffTimeoutSec = "1s";
      HandlePowerKey = "poweroff";
    };
  };

  services.xserver = {
    enable = true;
    # Window manager
    windowManager.openbox.enable = true;

    xautolock = {
      enable = true;
      time = 15;
      locker = "/home/kamen/bin/lock";
      extraOptions = [ "-detectsleep" "-secure" ];
    };
  };

  systemd.services = {
    lockscreen = {
      wantedBy = [ "sleep.target" ];
      before = [ "suspend.target" ];
      serviceConfig = {
        User = "kamen";
        Environment = [ "DISPLAY=:0" "PATH=/run/current-system/sw/bin" "DBUS_SESSION_BUS_ADDRESS=\"unix:path=/run/user/1000/bus\"" ];
        ExecStart = "/home/kamen/bin/lock suspend";
      };
    };
  };

  systemd.user.services = {
    lxqt-policykit = {
      description = "lxqt-policykit runner";
      wantedBy = [ "graphical-session.target" ];
      wants = [ "graphical-session.target" ];
      after = [ "graphical-session.target" ];
      serviceConfig = {
        Type = "simple";
        ExecStart = "${pkgs.lxqt.lxqt-policykit}/bin/lxqt-policykit-agent";
        Restart = "on-failure";
        RestartSec = 1;
        TimeoutStopSec = 10;
      };
    };

    # This is kinda gross, because the xautolock service is already defined and configured
    # inside services.xserver.xautolock, but it's the only way I know
    xautolock.serviceConfig.Environment = [ "DISPLAY=:0" "PATH=/run/current-system/sw/bin" ];
  };
}