#
#  Main system configuration. More information available in configuration.nix(5) man page.
#
#  flake.nix
#   ├─ ./hosts
#   │   └─ configuration.nix *
#   └─ ./modules
#       └─ ./editors
#           └─ ./nvim
#               └─ default.nix
#

{ config, lib, pkgs, inputs, user, location, agenix, ... }:

{
  imports =                                 # Import window or display manager.
    [
      #../modules/editors/nvim              # ! Comment this out on first install !
    ];

  users.users.${user} = {                   # System User
    isNormalUser = true;
    extraGroups = [ "wheel" "video" "audio" "camera" "networkmanager" "lp" "kvm" "libvirtd" "adb" "dialout" "tss" ];
    shell = pkgs.zsh;                       # Default shell
    uid = 2000;
#    initialPassword = "password95";
    openssh.authorizedKeys.keys = [
      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIANmaraVJ/o20c4dqVnGLp/wGck9QNHFPvO9jcEbKS29AAAABHNzaDo= kabbone@kabc"
      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIIgo4IP8ISUohyAMiDc3zEe6ESUE3un7eN5FhVtxZHmcAAAABHNzaDo= kabbone@kabc"
      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKVDApb3vZ+i97V4xLJh8rUF6z5OVYfORlXYbLhdQO15AAAABHNzaDo= kabbone@hades.home.opel-online.de"
      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB0q++epdX7feQxvmC2m/CJEoJbkqtAJy6Ml6WKHxryZAAAABHNzaDo= kabbone@hades.home.opel-online.de"
    ];
  };

  time.timeZone = "Europe/Berlin";        # Time zone and internationalisation
  i18n = {
    defaultLocale = "en_US.UTF-8";
    extraLocaleSettings = {                 # Extra locale settings that need to be overwritten
      LC_TIME = "de_DE.UTF-8";
      LC_MONETARY = "de_DE.UTF-8";
    };
  };

  console = {
    font = "Lat2-Terminus16";
    keyMap = "us";	                    # or us/azerty/etc
  };

  security = {
    rtkit.enable = true;
    pki.certificateFiles = [
      ./rootCA.pem
    ];
    #tpm2 = {
    #    enable = true;
    #    pkcs11.enable = true;
    #    tctiEnvironment.enable = true;
    #  };
  };

  #sound = {                                 # ALSA sound enable
  #  #enable = true;
  #  mediaKeys = {                           # Keyboard Media Keys (for minimal desktop) enable = true;
  #    enable = true;
  #  };
  #};

  fonts.packages = with pkgs; [                # Fonts
    carlito                                 # NixOS
    vegur                                   # NixOS
    source-code-pro
    font-awesome                            # Icons
    hack-font
    corefonts                               # MS
    intel-one-mono
    cascadia-code
    (nerdfonts.override {                   # Nerdfont Icons override
      fonts = [
        "FiraCode"
      ];
    })
  ];

  environment = {
    variables = {
      TERMINAL = "alacritty";
      EDITOR = "nvim";
      VISUAL = "nvim";
      BROWSER = "firefox";
    };
    systemPackages = with pkgs; [           # Default packages install system-wide
      vim
      git
      killall
      pciutils
      usbutils
      wget
      file
      powertop
      cpufrequtils
      lm_sensors
      libva-utils
      at-spi2-core
      bind
      dig
      qmk-udev-rules
      gptfdisk
      agenix.packages.x86_64-linux.default
      age-plugin-yubikey
      pwgen
      cryptsetup
      python311Packages.powerline
      powerline-fonts
      powerline-symbols
      tree
      direnv
      linuxPackages_latest.cpupower
      btop
      sbctl
      ausweisapp
      e2fsprogs
    ];
  };

  services = {
    pipewire = {                            # Sound
      enable = true;
      alsa = {
        enable = true;
      #  support32Bit = true;
      };
      pulse.enable = true;
      wireplumber.enable = true;
    };
    openssh = {                             # SSH: secure shell (remote connection to shell of server)
      enable = true;                        # local: $ ssh <user>@<ip>
      settings = {
        PasswordAuthentication = false;
        PermitRootLogin = "no";
      };
#      extraConfig = ''
#        HostKeyAlgorithms +ssh-rsa
#      '';                                   # Temporary extra config so ssh will work in guacamole
    };
    pcscd.enable = true;
    yubikey-agent.enable = true;
    udev.packages = [ pkgs.yubikey-personalization pkgs.nitrokey-udev-rules ];
    #flatpak.enable = true;                  # download flatpak file from website - sudo flatpak install <path> - reboot if not showing up
                                            # sudo flatpak uninstall --delete-data <app-id> (> flatpak list --app) - flatpak uninstall --unused
                                            # List:
                                            # com.obsproject.Studio
                                            # com.parsecgaming.parsec
                                            # com.usebottles.bottles
    gvfs.enable = true;
    fwupd.enable = true;
  };

  programs = {                              # No xbacklight, this is the alterantive
    zsh.enable = true;
    dconf.enable = true;
    ssh = {
        startAgent = true;
        agentTimeout = "1h";
        askPassword = "${pkgs.lxqt.lxqt-openssh-askpass}/bin/lxqt-openssh-askpass";
    };
  };
  

  #xdg.portal = {                            # Required for flatpak
  #  enable = true;
  #  extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
  #};

  nix = {                                   # Nix Package Manager settings
    settings ={
      auto-optimise-store = true;           # Optimise syslinks
    };
    gc = {                                  # Automatic garbage collection
      automatic = true;
      dates = "weekly";
      options = "--delete-older-than 7d";
    };
    package = pkgs.nixVersions.stable;               # Enable nixFlakes on system
    extraOptions = ''
      experimental-features = nix-command flakes
    '';
  };
  nixpkgs.config.allowUnfree = true;        # Allow proprietary software.

  system = {                                # NixOS settings
    autoUpgrade = {                         # Allow auto update
      enable = false;
      flake = "git+https://git.kabtop.de/Kabbone/nixos-config";
      randomizedDelaySec = "5m";
      allowReboot = true;
      rebootWindow = {
          lower = "02:00";
          upper = "05:00";
      };
      #channel = "https://nixos.org/channels/nixos-unstable";
    };
    stateVersion = "23.05";
  };
}