nixos-config/configuration.nix

# Edit this configuration file to define what should be installed on
# your system.  Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).

{ config, pkgs, lib, ... }:

{
  imports = [
    nixos/desktop/printing
  ];

  # Bootloader.
  boot.loader.grub.enable = true;
  boot.loader.grub.device = "/dev/sda";
  boot.loader.grub.useOSProber = false;

  # Setup keyfile
  boot.initrd.secrets = {
    "/crypto_keyfile.bin" = null;
  };

  # Enable grub cryptodisk
  boot.loader.grub.enableCryptodisk = true;

  boot.initrd.luks.devices."luks-efc0285c-812e-4946-936b-37e737fb72eb".keyFile = "/crypto_keyfile.bin";

  # allow crosscompiling for raspberrypi
  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];

  networking.hostName = "lift";
  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.

  networking.networkmanager.enable = true;
  systemd.network.wait-online.enable = false;
  boot.initrd.systemd.network.wait-online.enable = false;

  nix.settings.experimental-features = ["nix-command" "flakes"];

  # Set your time zone.
  time.timeZone = "Europe/Berlin";

  # Select internationalisation properties.
  i18n.defaultLocale = "en_US.UTF-8";

  i18n.extraLocaleSettings = {
    LC_ADDRESS = "de_DE.UTF-8";
    LC_IDENTIFICATION = "de_DE.UTF-8";
    LC_MEASUREMENT = "de_DE.UTF-8";
    LC_MONETARY = "de_DE.UTF-8";
    LC_NAME = "de_DE.UTF-8";
    LC_NUMERIC = "de_DE.UTF-8";
    LC_PAPER = "de_DE.UTF-8";
    LC_TELEPHONE = "de_DE.UTF-8";
    LC_TIME = "de_DE.UTF-8";
  };


  # Configure console keymap
  console.keyMap = "de-latin1-nodeadkeys";

  # Enable scanning
  hardware.sane.enable = true;
  # Workaround for https://github.com/NixOS/nixpkgs/issues/273280
  hardware.sane.backends-package = pkgs.sane-backends.overrideAttrs (old: {
    configureFlags = (old.configureFlags or []) ++ [
      "--disable-locking"
    ];
  });

  hardware.keyboard.zsa.enable = true;
  hardware.opengl.enable = true;

  # bluetooth
  hardware.bluetooth.enable = true;

  # Enable sound with pipewire.
  sound.enable = true;
  # hardware.pulseaudio.enable = false;
  security.rtkit.enable = true;

  # Define a user account. Don't forget to set a password with ‘passwd’.
  users.users.rothe = {
    isNormalUser = true;
    description = "rothe";
    extraGroups = [ "networkmanager" "wheel" "video" "scanner" "lp" "incus-admin" "dialout" ];
    shell = pkgs.fish;
    packages = with pkgs; [
      chromium
      firefox
      logseq
      thunderbird
    ];
  };
  # TODO remove with the next major release, workaround for logseq not working
  nixpkgs.config.permittedInsecurePackages = [
    "electron-27.3.11"
  ];
  nixpkgs.config.allowUnfree = true;

  environment.systemPackages = with pkgs; [
    ack
    avrdude
    bind
    calibre
    cmake
    cryptsetup
    curl
    dracula-theme
    evince
    ffmpeg
    fish
    foot
    fzf
    gammastep
    gcc
    gimp
    git
    glib
    gnome.eog
    gnome.nautilus
    gnome.simple-scan
    gnucash
    gnumake
    gnupg
    google-cloud-sdk
    inkscape
    ispell
    keychain
    libreoffice
    hugo
    mosquitto
    mypy
    nmap
    pass-secret-service
    pavucontrol
    portfolio
    prusa-slicer
    pulseaudio
    signal-desktop
    spotify
    sqlite
    syncthing
    tailscale
    tmux
    tree
    unzip
    vim-full
    vlc
    wally-cli
    wayshot
    wdisplays
    wget
    wl-clipboard
    xdg-utils
    yt-dlp
  ];

  xdg.portal = {
    enable = true;
    wlr.enable = true;
    # gtk portal needed to make gtk apps happy
    extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
    config.common.default = "*";
  };

  programs = {
    fish.enable = true;
    gnupg.agent = {
        enable = true;
        enableSSHSupport = true;
    };
    light.enable = true;
  };
  # List services that you want to enable:
  services.resolved = {
    enable = true;
  };
  services.pcscd.enable = true;
  # xdg-desktop-portal works by exposing a series of D-Bus interfaces
  # known as portals under a well-known name
  # (org.freedesktop.portal.Desktop) and object path
  # (/org/freedesktop/portal/desktop).
  # The portal interfaces include APIs for file access, opening URIs,
  # printing and others.
  services.dbus.enable = true;
  services.pipewire = {
    enable = true;
    alsa.enable = true;
    pulse.enable = true;
  };
  services.passSecretService.enable = true;
  services.tailscale.enable = true;
  services.gvfs.enable = true;

  services.greetd = {
    enable = true;
    settings = {
      default_session = {
        command = "${pkgs.greetd.tuigreet}/bin/tuigreet --time --asterisks --cmd sway";
        user = "rothe";
      };
    };
  };


  services.blueman.enable = true;
  services.fwupd.enable = true;
  services.syncthing = {
    enable = true;
    user = "rothe";
    group = "users";
    dataDir = "/home/rothe";
    overrideFolders = false;
    overrideDevices = false;
  };

  networking.nftables = {
    enable = true;
  };
  networking.firewall.trustedInterfaces = [ "incusbr0" ];
  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "23.05"; # Did you read the comment?

  virtualisation = {
    incus.enable = false;
    podman.enable = true;
  };

  programs.nh = {
    enable = true;
    clean.enable = true;
    clean.extraArgs = "--keep-since 4d --keep 3";
    flake = "/home/rothe/src/nixos-config";
  };

  programs.steam = {
    enable = true;
    remotePlay.openFirewall = true;
    dedicatedServer.openFirewall = true;
    localNetworkGameTransfers.openFirewall = true;
  };
}