nixos-configurations/configuration.nix

# Edit this configuration file to define what should be installed on
# your system.  Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).

{ config, pkgs, ... }:

{
  imports =
    [ # Include the results of the hardware scan.
      /etc/nixos/hardware-configuration.nix
    ];

 ## Commented out as defined at the end of the page

  # Bootloader. 
#  boot.loader.systemd-boot.enable = true;
#  boot.loader.efi.canTouchEfiVariables = true;

  networking.hostName = "nixos"; # Define your hostname.
  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.

  # Configure network proxy if necessary
  # networking.proxy.default = "http://user:password@proxy:port/";
  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";

  # Enable networking
  networking.networkmanager.enable = true;

  # Set your time zone.
  time.timeZone = "America/New_York";

  # Select internationalisation properties.
  i18n.defaultLocale = "en_US.UTF-8";

  i18n.extraLocaleSettings = {
    LC_ADDRESS = "en_US.UTF-8";
    LC_IDENTIFICATION = "en_US.UTF-8";
    LC_MEASUREMENT = "en_US.UTF-8";
    LC_MONETARY = "en_US.UTF-8";
    LC_NAME = "en_US.UTF-8";
    LC_NUMERIC = "en_US.UTF-8";
    LC_PAPER = "en_US.UTF-8";
    LC_TELEPHONE = "en_US.UTF-8";
    LC_TIME = "en_US.UTF-8";
  };

  # Enable the X11 windowing system.
  # You can disable this if you're only using the Wayland session.
  services.xserver.enable = true;

  # Enable the KDE Plasma Desktop Environment.
  #services.displayManager.sddm.enable = true;
  #services.desktopManager.plasma6.enable = true;

  # Enable Gnome
  services.displayManager.gdm.enable = true;
  services.desktopManager.gnome.enable = true;
  # Configure keymap in X11
  services.xserver.xkb = {
    layout = "us";
    variant = "";
  };

  # Enable CUPS to print documents.
  services.printing.enable = true;

  # Enable sound with pipewire.
  services.pulseaudio.enable = false;
  security.rtkit.enable = true;
  services.pipewire = {
    enable = true;
    alsa.enable = true;
    alsa.support32Bit = true;
    pulse.enable = true;
    # If you want to use JACK applications, uncomment this
    #jack.enable = true;

    # use the example session manager (no others are packaged yet so this is enabled by default,
    # no need to redefine it in your config for now)
    #media-session.enable = true;
  };

  # Enable touchpad support (enabled default in most desktopManager).
  # services.xserver.libinput.enable = true;

  # Enable zsh
  programs.zsh.enable = true;
  # Define a user account. Don't forget to set a password with ‘passwd’.
  users.users.l-wyatt = {
    isNormalUser = true;
    description = "Wyatt";
    shell = pkgs.zsh;
    linger = true;
    extraGroups = [ "networkmanager" "wheel" "docker" "dialout" ];
  };

  nixpkgs.config.allowUnfree = true;
  # List packages installed in system profile. To search, run:
  # $ nix search wget
  environment.systemPackages = with pkgs; [
    home-manager
    firefox
    vmware-workstation
    cacert
    lunar-client
    jetbrains.rust-rover
    code-cursor
    adwaita-icon-theme
    obsidian
    claude-code
  ];

  # Some programs need SUID wrappers, can be configured further or are
  # started in user sessions.
  # programs.mtr.enable = true;
  # programs.gnupg.agent = {
  #   enable = true;
  #   enableSSHSupport = true;
  # };

  # List services that you want to enable:

  # Enable the OpenSSH daemon.
  # services.openssh.enable = true;

  # Open ports in the firewall.
  # networking.firewall.allowedTCPPorts = [ ... ];
  # networking.firewall.allowedUDPPorts = [ ... ];
  # Or disable the firewall altogether.
  # networking.firewall.enable = false;

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "25.11"; # Did you read the comment?
  
  ### Start of self configuration
  # Configure grub to provide ubuntu option
  boot.loader.grub.enable = true;
  boot.loader.grub.useOSProber = true;
  boot.loader.grub.devices = [ "nodev" ];
  boot.loader.grub.efiSupport = true;
#  boot.loader.grub.efiInstallAsRemovable = true;
  boot.loader.efi.canTouchEfiVariables = true;
   
  # Enable fingerprint sensor
  services.fprintd.enable = true;

  # Enable bluetooth
  hardware.bluetooth.enable = true;
  services.blueman.enable = true;

  # Allow /etc/hosts to be modified without system rebuild
  environment.etc.hosts.mode = "0644";

  # Enable flakes and extras
  nix.settings.experimental-features = [ "nix-command" "flakes" ];

  # Enable docker
  boot.kernel.sysctl = {
    "kernel.unprivileged_userns_clone" = 1;
    "user.max_user_namespaces" = 28633;
  };

  virtualisation.docker = {
  enable = true;
    rootless = {
      enable = true;
      setSocketVariable = true;
    };
  };
  
  virtualisation.vmware.host.enable = true; 

  services.tailscale = {
    enable = true;
    useRoutingFeatures = "client";  # or "both" for subnet routing
  };

  # Open firewall for Tailscale
  networking.firewall = {
    checkReversePath = "loose";
    trustedInterfaces = [ "tailscale0" ];
    allowedUDPPorts = [ config.services.tailscale.port ];
  };

  # Auto-connect tailscale on boot
  #systemd.services.tailscale-autoconnect = {
  #  description = "Automatic connection to Tailscale";
  #  after = [ "network-pre.target" "tailscale.service" ];
  #  wants = [ "network-pre.target" "tailscale.service" ];
  #  wantedBy = [ "multi-user.target" ];
#
 #   serviceConfig.Type = "oneshot";
 #   script = with pkgs; ''
  #    sleep 2

  #    status="$(${tailscale}/bin/tailscale status -json | ${jq}/bin/jq -r .BackendState)"
  #    if [ $status = "Running" ]; then
  #      exit 0
  #    fi

  #    ${tailscale}/bin/tailscale up \
  #      --login-server=https://headscale.leeworks.dev \
  #     --authkey=d85e89d91521ca6bbbfeaa026f9de99265894095a4cab2a1 \
  #      --accept-routes \
	#      --exit-node=69.48.240.37 \
  #      --exit-node-allow-lan-access
  #  '';
  #};

#  security.pki.certificateFiles = [ /etc/nixos/certs/ipa-ca.crt ];

  # Enable necessary services
  xdg.portal = {
    enable = true;
  };

  security.pam.services = {
    login.u2fAuth = true;
    sudo.u2fAuth = true;
  };

  services.udev.extraRules = ''
      ACTION=="remove",\
       ENV{ID_BUS}=="usb",\
       ENV{ID_MODEL_ID}=="0407",\
       ENV{ID_VENDOR_ID}=="1050",\
       ENV{ID_VENDOR}=="Yubico",\
       RUN+="${pkgs.systemd}/bin/loginctl lock-sessions"
  '';

  # Optimize shutdown handling to prevent user manager hangs
  # Reduce timeout for user manager service during shutdown (default is 90s, reducing to 30s)
  # This prevents the 2-minute hang when shutting down with linger enabled
  systemd.services."user@".serviceConfig = {
    TimeoutStopSec = "30s";
  };
  # Reduce default timeout for all user services
  systemd.user.extraConfig = ''
    DefaultTimeoutStopSec=30s
  '';

  # Gnome Configuration
  fonts.packages = [ 
    pkgs.adwaita-icon-theme
    pkgs.nerd-fonts._0xproto
  ];
  fonts.fontconfig.enable = true;
  services.gnome = {
    core-apps.enable = true;
    core-developer-tools.enable = true;
    games.enable = false;
  };
  
  services.desktopManager.gnome.extraGSettingsOverrides = ''
    [org.gnome.mutter]
    experimental-features=['scale-monitor-framebuffer', 'xwayland-native-scaling']
  '';
  
  environment.gnome.excludePackages = with pkgs; [
    gnome-tour gnome-user-docs
  ];
  
  qt = {
    enable = true;
    platformTheme = "gnome";
    style = "adwaita-dark";
  };

  
  security.wrappers = {
    # Low-level unprivileged sandboxing tool, see <https://github.com/containers/bubblewrap>.
    bwrap = {
      owner = "root";
      group = "root";
      source = "${pkgs.bubblewrap}/bin/bwrap";
      setuid = true;
    };
  };

}