# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page, on
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).

{
  config,
  home-manager,
  lib,
  pkgs,
  inputs,
  ...
}:

{
  imports = [
    ./hardware.nix
    home-manager.nixosModules.default
  ];

  # decrypt agenix secrets
  age.secrets = {
    wg0_hastur.file = ../../secrets/wg0_hastur.age;
    wg1_hastur.file = ../../secrets/wg1_hastur.age;
    wpa_supplicant.file = ../../secrets/wpa_supplicant.age;
  };

  # boot options
  boot.loader.grub = {
    enable = true;
    zfsSupport = true;
    efiSupport = true;
    efiInstallAsRemovable = true;
    mirroredBoots = [
      {
        devices = [ "nodev" ];
        path = "/boot";
      }
    ];
  };

  networking = {
    hostName = "hastur";
    hostId = "deadcafe";

    wireless = {
      enable = true;
      userControlled = true;
      allowAuxiliaryImperativeNetworks = true;
    };

    firewall = {
      #      allowedTCPPorts = [ ];
      #      allowedUDPPorts = [ ];
    };

    wg-quick.interfaces = {
      # mullvad
      wg0 = {
        address = [
          "10.75.226.117/32"
          "fc00:bbbb:bbbb:bb01::c:e274/128"
        ];
        privateKeyFile = config.age.secrets.wg0_hastur.path;

        peers = [{
            allowedIPs = [
              "0.0.0.0/0"
              "::0/0"
            ];
            endpoint = "45.134.142.206:51820";
            publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=";
        }];
      };

      # epistemia
      wg1 = {
        address = [
          "10.0.13.3/24"
          "fd00:b0ba:cafe:babe::3/64"
        ];
        privateKeyFile = config.age.secrets.wg1_hastur.path;

        peers = [
          # saklas
          {
            allowedIPs = [
              "10.0.13.1/32"
              "fd00:b0ba:cafe:babe::1/128"
            ];
            endpoint = "vineetk.net:51820";
            persistentKeepalive = 25;
            publicKey = "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=";
          }
          # demiurge (and lab through it)
          {
            allowedIPs = [
              "10.0.13.2/32"
              "10.0.13.5/32"
              "fd00:b0ba:cafe:babe::2/128"
              "fd00:b0ba:cafe:babe::5/128"
            ];
            endpoint = "carcosa.13f0.net:51820";
            persistentKeepalive = 25;
            publicKey = "FMLvbSxY6vA8CRV4S1vl4+pMeCr/kR9n0G5w9buNqh4=";
          }
        ];
      };
    };
  };

  # Set your time zone.
  time.timeZone = "America/Toronto";

  # Select internationalisation properties.
  i18n.defaultLocale = "en_US.UTF-8";
  console = {
    font = "Lat2-Terminus16";
  };

  # enable flakes and nix cli
  nix.settings.experimental-features = [
    "nix-command"
    "flakes"
  ];

  # Define a user account.
  users.users.vin = {
    isNormalUser = true;

    extraGroups = [
      "transmission"
      "wheel"
    ];

    shell = pkgs.zsh;

    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH vin@hastur"
    ];

    packages = with pkgs; [
      acpi
      acpilight
    ];
  };

  # default packages for both me and root
  environment = {
    systemPackages = with pkgs; [
      distrobox
      doas-sudo-shim
      git
      wget
    ];

    pathsToLink = [ "/share/zsh" ];

    etc."wpa_supplicant.conf".source = config.age.secrets.wpa_supplicant.path;
  };

  # enable bluetooth and add some udev rules
  hardware = {
    bluetooth.enable = true;
    flipperzero.enable = true;
    keyboard.qmk.enable = true;
  };

  programs = {
    # for gtk in home-manager
    dconf.enable = true;

    # gpg
    gnupg.agent = {
      enable = true;
      enableSSHSupport = false;
      pinentryPackage = pkgs.pinentry-rofi;
      settings.default-cache-ttl = 600;
    };

    # disable nano. I don't like nano.
    nano.enable = false;

    # configuration in home-manager
    zsh.enable = true;
  };

  security = {
    # I prefer doas over sudo for simplicity
    doas = {
      enable = true;
      extraRules = [
        {
          users = [ "vin" ];
          keepEnv = true;
          persist = true;
        }
      ];
    };

    sudo.enable = false;
  };

  services = {
    # dns
    unbound = {
      enable = true;
      settings = {
	      server = {
	        interface = [ "127.0.0.1" "10.0.13.2" "fd00:b0ba:cafe:babe::2" "::1" ];
          access-control = [ "0.0.0.0/0 allow" "::0/0 allow" ];

	        hide-identity = yes;
	        hide-version = yes;

	        # Synthesize NXDOMAINs from DNSSEC NSEC chains.
	        # https://tools.ietf.org/html/rfc8198
	        aggressive-nsec = no;

	        local-zone = "saklas.epistemia." redirect;
	        local-data = "saklas.epistemia. 86400 IN A 10.0.13.1";
	        local-data = "saklas.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::1";
	        local-zone = "demiurge.epistemia." redirect;
	        local-data = "demiurge.epistemia. 86400 IN A 10.0.13.2";
	        local-data = "demiurge.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::2";
	        local-zone = "hastur.epistemia." redirect;
	        local-data = "hastur.epistemia. 86400 IN A 10.0.13.3";
	        local-data = "hastur.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::3";
	        local-zone = "iphonebob.epistemia." redirect;
	        local-data = "iphonebob.epistemia. 86400 IN A 10.0.13.4";
	        local-data = "iphonebob.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::4";
	        local-zone = "lab.epistemia." redirect;
	        local-data = "lab.epistemia. 86400 IN A 10.0.13.5";
	        local-data = "lab.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::5";
	        local-zone = "paraclete.epistemia." redirect;
	        local-data = "paraclete.epistemia. 86400 IN A 10.0.13.6";
	        local-data = "paraclete.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::6";
        };

        # hagezi for dns-based adblocking (in addition to others)
        rpz = {
          name = "hagezi.ultimate";
          zonefile = "hagezi.ultimate";
          url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt";
        };

        # go through mullvad for regular dns queries
	      forward-zone = {
	        name = ".";
	        forward-addr = [ "100.64.0.3" ];
        };
      };
    };

    # graphical input
    libinput = {
      enable = true;

      mouse.accelProfile = "flat";

      touchpad = {
        accelProfile = "flat";
        tapping = true;
        tappingButtonMap = "lrm";
      };
    };

    # ssh
    openssh = {
      enable = true;

      settings = {
        KbdInteractiveAuthentication = false;
        PasswordAuthentication = false;
        PermitRootLogin = "no";
        X11Forwarding = true;
      };
    };

    # for yubikey
    pcscd.enable = true;

    # sound. for some reason, pipewire enabled itself when I tried
    # using pulseaudio and home-manager, so had to disable pulseaudio.
    pipewire = {
      enable = true;
      alsa.enable = true;
      audio.enable = true;
      pulse.enable = true;

      extraConfig.pipewire = {
        "99-filter-airpods.conf" = {
          "context.modules" = [
            {
              name = "libpipewire-module-filter-chain";
              args = {
                node.name = "peq-airpods-pro-2-sink";
                node.description = "PEQ AirPods Pro 2 (auto)";
                playback.props = {
                  media.class = "Audio/Sink";
                  "filter.smart" = true;
                  "filter.smart.name" = "peq-airpods-pro-2";
                };
                filter.graph = [
                  {
                    type = "builtin";
                    name = "param_eq";
                    label = "param_eq_airpods";
                    config.filename = "/etc/pipewire/parametric/airpods-pro-2.txt";
                  }
                ];
              };
            }
          ];
        };
      };

      # TODO run nixfmt to fix indenting of below (can't right now because on gentoo without nixfmt)
      wireplumber = {
        enable = true;
        extraConfig."50-smartfilters-airpods.conf".text = ''
        {
          "monitor.bluez.rules" : [
          # When a BlueZ device is detected we set an identifying property that the smart filter will match.
          # (This fragment adds nothing by default; we're using a policy to match target.node later.)
        ],

        "policy.rules" : [
          # The core smart filter matching is done by matching the target.node properties
          # WirePlumber's smart filters will look for filter.smart.target (set below).
        ],

        "policy" : {
          "smart_filters" : {
            "rules" : [
              {
                "matches" : [
                  { "device.props" : { "bluez5.device.name" : "AirPods Pro 2" } }
                ],
                "actions" : {
                  # If target device matches, set the 'target.node' metadata for smart filters to use
                  "update-metadata" : {
                    "target.node" : { "name" : "bluez_output.*AirPods.*" }
                  }
                }
              }
            ]
          }
        },

        "endpoint.rules" : [
          {
            "matches" : [
              { "node.name" : "peq-airpods-pro-2-sink" }
            ],
            "actions" : {
              "update-props" : {
                "filter.smart.target" : { "bluez5.device.name" : "AirPods Pro 2" }
              }
            }
          }
        ]
      }
      '';
      };
    };

    # enable better power management
    tlp.enable = true;

    # to get startx and use amdgpu driver
    # WM in home-manager
    xserver = {
      enable = true;
      autorun = false;
      displayManager.startx.enable = true;
      videoDrivers = [ "modesetting" ];
    };
  };

  systemd.services."wg-quick@wg1" = {
    after = [ "wg-quick@wg0.service" ];
    requires = [ "wg-quick@wg0.service" ];
  };

  # create caches and use mandoc
  documentation.man = {
    enable = true;
    generateCaches = true;
    man-db.enable = false;
    mandoc.enable = true;
  };

  system.stateVersion = "24.05";
}