# Edit this configuration file to define what should be installed on
# your system.  Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running 'nixos-help').

{ config, pkgs, pkgs-unstable, ... }:

{
  imports = [
    ./hardware-configuration.nix
    # home-manager is imported via flake.nix
  ];

 ## Commented out as defined at the end of the page

  # Bootloader. 
#  boot.loader.systemd-boot.enable = true;
#  boot.loader.efi.canTouchEfiVariables = true;

  networking.hostName = "nixos"; # Define your hostname.
  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.

  # Configure network proxy if necessary
  # networking.proxy.default = "http://user:password@proxy:port/";
  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";

  # Enable networking
  networking.networkmanager.enable = true;

  # Set your time zone.
  time.timeZone = "America/New_York";

  # Select internationalisation properties.
  i18n.defaultLocale = "en_US.UTF-8";

  i18n.extraLocaleSettings = {
    LC_ADDRESS = "en_US.UTF-8";
    LC_IDENTIFICATION = "en_US.UTF-8";
    LC_MEASUREMENT = "en_US.UTF-8";
    LC_MONETARY = "en_US.UTF-8";
    LC_NAME = "en_US.UTF-8";
    LC_NUMERIC = "en_US.UTF-8";
    LC_PAPER = "en_US.UTF-8";
    LC_TELEPHONE = "en_US.UTF-8";
    LC_TIME = "en_US.UTF-8";
  };

  # Enable the X11 windowing system.
  # You can disable this if you're only using the Wayland session.
  services.xserver.enable = true;

  # Enable the KDE Plasma Desktop Environment.
  #services.displayManager.sddm.enable = true;
  #services.desktopManager.plasma6.enable = true;

  # Enable Gnome
  services.displayManager.gdm.enable = true;
  services.desktopManager.gnome.enable = true;
  # Configure keymap in X11
  services.xserver.xkb = {
    layout = "us";
    variant = "";
  };

  # Enable CUPS to print documents.
  services.printing.enable = true;

  # Enable sound with pipewire.
  services.pulseaudio.enable = false;
  security.rtkit.enable = true;
  services.pipewire = {
    enable = true;
    alsa.enable = true;
    alsa.support32Bit = true;
    pulse.enable = true;
    # If you want to use JACK applications, uncomment this
    #jack.enable = true;

    # use the example session manager (no others are packaged yet so this is enabled by default,
    # no need to redefine it in your config for now)
    #media-session.enable = true;
  };

  # Enable touchpad support (enabled default in most desktopManager).
  # services.xserver.libinput.enable = true;

  # Enable zsh
  programs.zsh.enable = true;
  # Define a user account. Don't forget to set a password with ‘passwd’.
  users.users.l-wyatt = {
    isNormalUser = true;
    description = "Wyatt";
    shell = pkgs.zsh;
    linger = true;
    extraGroups = [ "networkmanager" "wheel" "docker" "dialout" ];
  };

  nixpkgs.config.allowUnfree = true;
  # List packages installed in system profile. To search, run:
  # $ nix search wget
  environment.systemPackages = with pkgs; [
    home-manager
    firefox
    cacert
    code-cursor
    adwaita-icon-theme
    pkgs-unstable.claude-code  # Use unstable for latest version
    yubikey-manager
    # iOS interop
    uxplay
    libimobiledevice
    ifuse
  ];

  # Some programs need SUID wrappers, can be configured further or are
  # started in user sessions.
  # programs.mtr.enable = true;
  programs.gnupg.agent = {
    enable = true;
    enableSSHSupport = true;
    pinentryPackage = pkgs.pinentry-gnome3;
  };

  # AirDrop-style file transfer (LocalSend)
  programs.localsend = {
    enable = true;
    openFirewall = true;
  };

  # List services that you want to enable:

  # Enable the OpenSSH daemon.
  # services.openssh.enable = true;

  # Open ports in the firewall.
  # networking.firewall.allowedTCPPorts = [ ... ];
  # networking.firewall.allowedUDPPorts = [ ... ];
  # Or disable the firewall altogether.
  networking.firewall.enable = false;

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "25.11"; # Did you read the comment?

  # Home Manager Configuration is handled in flake.nix

  ### Start of self configuration
  # Configure grub to provide ubuntu option
  boot.loader.grub.enable = true;
  boot.loader.grub.useOSProber = true;
  boot.loader.grub.devices = [ "nodev" ];
  boot.loader.grub.efiSupport = true;
#  boot.loader.grub.efiInstallAsRemovable = true;
  boot.loader.efi.canTouchEfiVariables = true;
   
  # Enable fingerprint sensor
  services.fprintd.enable = true;

  # Enable bluetooth
  hardware.bluetooth.enable = true;
  services.blueman.enable = true;

  # Allow /etc/hosts to be modified without system rebuild
  environment.etc.hosts.mode = "0644";

  # Enable flakes and extras
  nix.settings.experimental-features = [ "nix-command" "flakes" ];

  # Enable docker
  boot.kernel.sysctl = {
    "kernel.unprivileged_userns_clone" = 1;
    "user.max_user_namespaces" = 28633;
  };

  virtualisation.docker = {
  enable = true;
    rootless = {
      enable = true;
      setSocketVariable = true;
    };
  };
  

  # WireGuard VPN
  networking.wg-quick.interfaces.wg0 = {
    address = [ "10.0.1.67/32" ];
    dns = [ "1.1.1.1" ];
    privateKeyFile = "/etc/wireguard/private.key";

    # Route endpoint via local gateway to avoid routing loop
    preUp = ''
      GW=$(ip route show default | awk '{print $3; exit}')
      DEV=$(ip route show default | awk '{print $5; exit}')
      ip route add 69.48.243.22/32 via "$GW" dev "$DEV" || true
    '';
    postDown = ''
      ip route del 69.48.243.22/32 || true
    '';

    peers = [{
      publicKey = "VEpzr/CeGdS6Wsy0NDDfmlB/bCYxS55A155HWGCIIzc=";
      endpoint = "69.48.243.22:51820";
      # Route all traffic through VPN EXCEPT the local 10.0.0.0/24 network
      allowedIPs = [
        "0.0.0.0/5"
        "8.0.0.0/7"
        "10.0.1.0/24"
        "10.0.2.0/23"
        "10.0.4.0/22"
        "10.0.8.0/21"
        "10.0.16.0/20"
        "10.0.32.0/19"
        "10.0.64.0/18"
        "10.0.128.0/17"
        "10.1.0.0/16"
        "10.2.0.0/15"
        "10.4.0.0/14"
        "10.8.0.0/13"
        "10.16.0.0/12"
        "10.32.0.0/11"
        "10.64.0.0/10"
        "10.128.0.0/9"
        "11.0.0.0/8"
        "12.0.0.0/6"
        "16.0.0.0/4"
        "32.0.0.0/3"
        "64.0.0.0/2"
        "128.0.0.0/1"
      ];
      persistentKeepalive = 25;
    }];
  };


  # Open firewall for Tailscale + UxPlay AirPlay receiver
  networking.firewall = {
    checkReversePath = "loose";
    trustedInterfaces = [ "tailscale0" "wg0" ];
    allowedTCPPorts = [ 7000 7001 7100 ];
    allowedUDPPorts = [ config.services.tailscale.port 6000 6001 7011 ];
  };

  # Auto-connect tailscale on boot
  #systemd.services.tailscale-autoconnect = {
  #  description = "Automatic connection to Tailscale";
  #  after = [ "network-pre.target" "tailscale.service" ];
  #  wants = [ "network-pre.target" "tailscale.service" ];
  #  wantedBy = [ "multi-user.target" ];
#
 #   serviceConfig.Type = "oneshot";
 #   script = with pkgs; ''
  #    sleep 2

  #    status="$(${tailscale}/bin/tailscale status -json | ${jq}/bin/jq -r .BackendState)"
  #    if [ $status = "Running" ]; then
  #      exit 0
  #    fi

  #    ${tailscale}/bin/tailscale up \
  #      --login-server=https://headscale.leeworks.dev \
  #     --authkey=d85e89d91521ca6bbbfeaa026f9de99265894095a4cab2a1 \
  #      --accept-routes \
	#      --exit-node=69.48.240.37 \
  #      --exit-node-allow-lan-access
  #  '';
  #};

#  security.pki.certificateFiles = [ /etc/nixos/certs/ipa-ca.crt ];

  # Enable necessary services
  xdg.portal = {
    enable = true;
    extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
  };

  services.pcscd.enable = true;

  # iPhone USB mount (libimobiledevice)
  services.usbmuxd.enable = true;

  # mDNS for AirPlay receiver (UxPlay) discovery from iPhone
  services.avahi = {
    enable = true;
    nssmdns4 = true;
    openFirewall = true;
    publish = {
      enable = true;
      addresses = true;
      userServices = true;
    };
  };

  # Auto-start UxPlay with the graphical session so iOS Screen Mirroring
  # can find this host without manually launching it.
  systemd.user.services.uxplay = {
    description = "UxPlay AirPlay Mirror Receiver";
    partOf = [ "graphical-session.target" ];
    after = [ "graphical-session.target" "pipewire.service" ];
    wantedBy = [ "graphical-session.target" ];
    serviceConfig = {
      ExecStart = "${pkgs.uxplay}/bin/uxplay";
      Restart = "on-failure";
      RestartSec = 5;
    };
  };

  security.pam.services = {
    login.u2fAuth = true;
    sudo.u2fAuth = true;
  };

  services.udev.extraRules = ''
      ACTION=="remove",\
       ENV{ID_BUS}=="usb",\
       ENV{ID_MODEL_ID}=="0407",\
       ENV{ID_VENDOR_ID}=="1050",\
       ENV{ID_VENDOR}=="Yubico",\
       RUN+="${pkgs.systemd}/bin/loginctl lock-sessions"
  '';

  # Optimize shutdown handling to prevent user manager hangs
  # Reduce timeout for user manager service during shutdown (default is 90s, reducing to 30s)
  # This prevents the 2-minute hang when shutting down with linger enabled
  systemd.services."user@".serviceConfig = {
    TimeoutStopSec = "30s";
  };
  # Reduce default timeout for all user services
  systemd.user.extraConfig = ''
    DefaultTimeoutStopSec=30s
  '';

  # Gnome Configuration
  fonts.packages = [ 
    pkgs.adwaita-icon-theme
    pkgs.nerd-fonts._0xproto
  ];
  fonts.fontconfig.enable = true;
  services.gnome = {
    core-apps.enable = true;
    core-developer-tools.enable = true;
    games.enable = false;
  };
  
  services.desktopManager.gnome.extraGSettingsOverrides = ''
    [org.gnome.mutter]
    experimental-features=['scale-monitor-framebuffer']
  '';
  
  environment.gnome.excludePackages = with pkgs; [
    gnome-tour gnome-user-docs gnome-console
  ];
  
  qt = {
    enable = true;
    platformTheme = "gnome";
    style = "adwaita-dark";
  };

  
  security.wrappers = {
    # Low-level unprivileged sandboxing tool, see <https://github.com/containers/bubblewrap>.
    bwrap = {
      owner = "root";
      group = "root";
      source = "${pkgs.bubblewrap}/bin/bwrap";
      setuid = true;
    };
  };

}