{ config, lib, pkgs, ... }: {
  imports = [
    ../common/default.nix
  ];

  networking.hostName = "dogma-wsl";

  # WSL-specific: no bootloader, no hardware-configuration.nix
  boot.loader.systemd-boot.enable = lib.mkForce false;
  boot.loader.efi.canTouchEfiVariables = lib.mkForce false;

  # WSL uses nixos-wsl module injected via flake; ensure systemd is enabled
  wsl.enable = true;
  wsl.defaultUser = "mask";

  # Headless - explicitly disable desktop/server features that may leak via common
  # (common/default.nix is minimal, but ensure graphics/desktop stays off)
  services.xserver.enable = lib.mkForce false;
  programs.hyprland.enable = lib.mkForce false;
  services.pipewire.enable = lib.mkForce false;
  services.sunshine.enable = lib.mkForce false;
  virtualisation.libvirtd.enable = lib.mkForce false;
  virtualisation.docker.enable = lib.mkForce false;

  # No bridged networking in WSL
  networking.firewall.trustedInterfaces = lib.mkForce [];
}