# Edit this configuration file to define what should be installed on
# your system.  Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).

{ config, pkgs, lib, ... }:

{
  imports =
    [ # Include the results of the hardware scan.
      ./hardware-configuration.nix
    ];

# Bootloader.
boot.loader = {
#  efi.canTouchEfiVariables = true;
  grub = {
    efiInstallAsRemovable = true;
    enable = true;
    device = "nodev";
    efiSupport = true;
  };
};
boot.kernelModules = [ "rfcomm" "i2c-dev" ];
boot.kernel.sysctl."net.ipv4.ip_unprivileged_port_start" = "80";
hardware.bluetooth = {
  enable = true;
  powerOnBoot = true;
  settings = {
    General = {
      # Shows battery charge of connected devices on supported
      # Bluetooth adapters. Defaults to 'false'.
      Experimental = true;
      # When enabled other devices can connect faster to us, however
      # the tradeoff is increased power consumption. Defaults to
      # 'false'.
      FastConnectable = true;
    };
    Policy = {
      # Enable all controllers when they are found. This includes
      # adapters present on start as well as adapters that are plugged
      # in later on. Defaults to 'true'.
      AutoEnable = true;
    };
  };
};

services.blueman.enable = true;
  networking.hostName = "la2410"; # Define your hostname.
#  networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.

  # Configure network proxy if necessary
  # networking.proxy.default = "http://user:password@proxy:port/";
  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";

  # Enable networking
  networking.networkmanager.enable = true;
  networking.networkmanager.plugins = with pkgs; [ networkmanager-openvpn ];
  networking.networkmanager.dns = "default";
  services.resolved.enable = false;
  networking.extraHosts =
  ''
10.0.1.2 dns01.sarlink.net
10.0.1.22 piped.shihaam.me pipedapi.shihaam.me pipedproxy.shihaam.me typetype.shihaam.me
10.0.1.3 mapmaker.sarlink.net
10.0.1.16 git.shihaam.dev
  '';

nixpkgs.config.allowUnfree = true;
nix.settings.experimental-features = [ "nix-command" "flakes" ];

virtualisation.docker.rootless = {
  enable = true;
  setSocketVariable = true;
  daemon.settings = {
   "insecure-registries" = [ "git.shihaam.dev" ];
  };
};
virtualisation = {
  containers.enable = true;
  podman = {
    enable = true;
    dockerCompat = false;
    defaultNetwork.settings.dns_enabled = false; # Required for containers under podman-compose to be able to talk to each other.
  };
};

#security.pam.services.login.kwallet.enable = true;
#programs.kdeconnect.enable = true;
#services.dbus.packages = [ pkgs.kwallet ];
services.gnome.gnome-keyring.enable = true;
  # Set your time zone.
  time.timeZone = "Indian/Maldives";

  # Select internationalisation properties.
  i18n.defaultLocale = "en_US.UTF-8";

  i18n.extraLocaleSettings = {
#    LC_ADDRESS = "dv_MV";
#    LC_IDENTIFICATION = "dv_MV";
#    LC_MEASUREMENT = "dv_MV";
#    LC_MONETARY = "dv_MV";
#    LC_NAME = "dv_MV";
#    LC_NUMERIC = "dv_MV";
#    LC_PAPER = "dv_MV";
#    LC_TELEPHONE = "dv_MV";
#    LC_TIME = "dv_MV";
LC_ALL = "en_US.UTF-8";
  };

  # Configure keymap in X11
  services.xserver.xkb = {
    layout = "us";
    variant = "";
  };

  # Define a user account. Don't forget to set a password with ‘passwd’.
  users.users.shihaam = {
    isNormalUser = true;
    description = "shihaam";
    extraGroups = [ "adbusers" "networkmanager" "wheel"  "podman" "dialout" "wireshark" "i2c" ];
    packages = with pkgs; [];
  };
nix.settings.trusted-users = [ "shihaam" ];
hardware.i2c.enable = true;
#  programs.adb.enable = true;

  # List packages installed in system profile. To search, run:
  # $ nix search wget
  environment.systemPackages = with pkgs; [
    pkgs.devenv
    pkgs.jdk25
    steam-run
    nmap
    openssl
#    blesh
#    wireshark
    picocom
    minicom
    tio
#    direnv
    android-tools
    traceroute
    usbutils
    apktool
    file
    tesseract
    vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
    wget
    jq
    wl-clipboard
    swappy
#    firefox
    pavucontrol
    rofi
    networkmanagerapplet
    libsecret
    oath-toolkit
    git
    git-lfs
    slurp
#    fastfetch
    btop
    htop
#    brave
#    vlc
#    obs-studio
#    claude-code
    cmatrix
    speedtest-cli
    android-studio
    gnupg
    pinentry-curses
    imagemagick
    tree
    unzip
    zip
#    codex
    ncdu
    bc
#    httptoolkit
#    libreoffice
#    opencode
#    lmstudio
    wdisplays
    scrcpy
#    opentofu
#    anydesk
    python3
    ffmpeg
#    jre
#    feh
    dig
#    mpv
#    _64gram
    davfs2
    arch-install-scripts
#    glab
    ddcui 
    ddcutil
  ];

nixpkgs.config.android_sdk.accept_license = true;
programs.nix-ld.enable = true;


# Nix reads flakes out of git via libgit2, which refuses a repository owned
# by a different user than the one evaluating it. The flake lives in
# /home/shihaam but `doas nixos-rebuild` evaluates as root, so root has to be
# told this repo is trustworthy. Without it:
#   error: repository path '...' is not owned by current user
environment.etc."gitconfig".text = ''
  [safe]
      directory = /home/shihaam/git/sargit/dotfiles
'';

security.doas.enable = true;
security.doas.extraRules = [
	{
	users = ["shihaam"];
	noPass = true;
	keepEnv = true;
	}
];

 programs.sway = {
   enable = true;
   wrapperFeatures.gtk = true;
#  extraPackages = with pkgs; [
#    swaylock
#    swayidle
#    swaybg
#    grim
#  ];
 };
 # Screen sharing on sway (browsers, OBS).
 xdg.portal = {
   enable = true;
   # Without chooser_type=simple, xdpw hunts for wmenu/rofi/bemenu/fuzzel/wofi,
   # finds none, and every screencast fails with "no output found". slurp needs
   # an absolute path -- the user service runs with a minimal PATH.
   wlr = {
     enable = true;
     settings.screencast = {
       chooser_type = "simple";
       chooser_cmd = "${pkgs.slurp}/bin/slurp -f %o -or";
     };
   };
   extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
   config.common = {
     default = [ "wlr" "gtk" ];
     "org.freedesktop.impl.portal.ScreenCast" = [ "wlr" ];
     "org.freedesktop.impl.portal.Screenshot" = [ "wlr" ];
   };
 };

 programs.waybar.enable = true;
programs.xfconf.enable = true;
  
services.pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
};


services.displayManager.ly = {
  enable = true;
  settings = {
#    auto_login_user = "shihaam";
#    auto_login_session = "sway";
#    auto_login_service = "ly-autologin";
    animation = "matrix";
    bigclock = "en";
    asterisk = null; 
    battery_id = "BAT0";
    brightness_up_cmd = "${pkgs.brightnessctl}/bin/brightnessctl -q -n s +10%";
    brightness_down_cmd = "${pkgs.brightnessctl}/bin/brightnessctl -q -n s 10%-";
  };
};
#boot.kernelModules = [ "i2c-dev" ];
#hardware.i2c.enable = true;

#environment.sessionVariables = {
#  PATH = "/home/shihaam/.local/bin:$PATH";
#};
# Some programs need SUID wrappers, can be configured further or are
  # started in user sessions.
  # programs.mtr.enable = true;
  # programs.gnupg.agent = {
  #   enable = true;
  #   enableSSHSupport = true;
  # };

  # List services that you want to enable:

  # Enable the OpenSSH daemon.
  services.openssh.enable = true;

  # Open ports in the firewall.
  # 5173 = Vite dev server, 8000 = Django backend (sarlinkportal LAN access)
  networking.firewall.allowedTCPPorts = [ 22 ];
  # networking.firewall.allowedUDPPorts = [ ... ];
  # Or disable the firewall altogether.
  # networking.firewall.enable = false;

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "25.11"; # Did you read the comment?
}