{
  pkgs,
  inputs,
  ...
}:
let
  vars = import ../vars.nix;
in
{
  systemd = {
    services = {
      plex_permission = {
        description = "maintains /zfs/storage/plex permissions";
        serviceConfig = {
          Type = "oneshot";
          ExecStart = "${pkgs.bash}/bin/bash ${../scripts/plex_permission.sh}";
        };
      };
      # The unused onboard i350 port hangs ~90s after every boot ("PCIe
      # link lost", MMIO reads return all-Fs) even with pcie_aspm=off.
      # Remove it from the PCI bus so nothing (hwmon temperature polls,
      # networkd) touches the dead hardware. Reversible via
      # `echo 1 > /sys/bus/pci/rescan`.
      remove_dead_igb_port = {
        wantedBy = [ "multi-user.target" ];
        description = "removes hung i350 port 0000:61:00.0 from the PCI bus";
        unitConfig.ConditionPathExists = "/sys/bus/pci/devices/0000:61:00.0/remove";
        serviceConfig = {
          Type = "oneshot";
          ExecStart = "${pkgs.bash}/bin/bash -c 'echo 1 > /sys/bus/pci/devices/0000:61:00.0/remove'";
        };
      };
      startup_validation = {
        requires = [ "network-online.target" ];
        after = [ "network-online.target" ];
        wantedBy = [ "multi-user.target" ];
        description = "validates startup";
        path = [ pkgs.zfs ];
        environment = {
          PYTHONPATH = "${inputs.self}/";
        };
        serviceConfig = {
          EnvironmentFile = "${vars.secrets}/services/server-validation";
          Type = "oneshot";
          ExecStart = "${pkgs.my_python}/bin/python -m python.system_tests.validate_system '${./validate_system.toml}'";
        };
      };
    };
    timers = {
      plex_permission = {
        wantedBy = [ "timers.target" ];
        timerConfig = {
          OnBootSec = "1h";
          OnCalendar = "daily 03:00";
          Unit = "plex_permission.service";
        };
      };
      startup_validation = {
        wantedBy = [ "timers.target" ];
        timerConfig = {
          OnBootSec = "10min";
          Unit = "startup_validation.service";
        };
      };
    };
  };
}