{ ... }:

{
  # File indexer (gvfs) + thumbnailer (tumbler) for the desktop shell.
  services.gvfs.enable = true;
  services.tumbler.enable = true;
  # GNOME Keyring: stores secrets for Chrome/keepassxc seams etc.
  services.gnome.gnome-keyring.enable = true;
  # dconf is the config DB used by GSettings-backed apps (nautilus, etc.).
  programs.dconf.enable = true;

  # Keep the journal bounded so it can't fill the root partition.
  services.journald.extraConfig = ''
    SystemMaxUse=50M
    MaxRetentionSec=1month
  '';

  # Cap core dumps so a crashing app can't fill the root partition with
  # multi-GB crash dumps (e.g. java/electron segfaults).
  systemd.coredump.settings.Coredump = {
    ProcessSizeMax = "512M";
    Storage = "external";
  };
}