{
  config,
  lib,
  pkgs,
  ...
}:
{
  virtualisation = {
    # GPU virtualisation (Intel GVT-g)
    kvmgt.enable = true;
    # Incus (Virtual Machine and System Container management)
    incus = {
      enable = true;
      ui.enable = true;
      package = pkgs.incus-lts; # use 'pkgs.incus' for feature releases
      preseed = {
        networks = [
          {
            name = "internalbr0";
            type = "bridge";
            description = "Internal/NATted bridge";
            config = {
              "ipv4.address" = "auto";
              "ipv4.nat" = "true";
              "ipv6.address" = "auto";
              "ipv6.nat" = "true";
            };
          }
        ];
        profiles = [
          {
            name = "default";
            description = "Default Incus Profile";
            devices = {
              eth0 = {
                name = "eth0";
                network = "internalbr0";
                type = "nic";
              };
              root = {
                path = "/";
                pool = "default";
                type = "disk";
              };
            };
          }
          {
            name = "bridged";
            description = "Instances bridged to LAN";
            devices = {
              eth0 = {
                name = "eth0";
                nictype = "bridged";
                parent = "externalbr0";
                type = "nic";
              };
              root = {
                path = "/";
                pool = "default";
                type = "disk";
              };
            };
          }
        ];
        storage_pools = [
          {
            config = {
              source = "/var/lib/incus/storage-pools/default";
            };
            driver = "dir";
            name = "default";
          }
        ];
      };
    };
  };
  networking.nftables.enable = true;
  users.users.phoenix.extraGroups = ["incus-admin"];
  networking.firewall.trustedInterfaces = [ "incusbr*" "internalbr0" ];
}