{ config, pkgs, ... }:

let
  my-python-packages = python-packages: with python-packages; [
    pip
    pipx
    #recipe-scrapers
    #tldextract
    #setuptools
  ];
  python-with-my-packages = pkgs.python311Full.withPackages my-python-packages;
in
{
  imports = 
    [
      ./detect-reboot-needed.nix
      ./systemd.nix
    ];
  # Bootloader.
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  boot.loader.efi.efiSysMountPoint = "/boot";
  boot.kernelPackages = pkgs.linuxPackages_latest;

  # Enable networking
  networking.networkmanager.enable = true;
  networking.enableIPv6 = false; # FIXME this is to test connectivity @ the office via wireguard
  networking.networkmanager.wifi.powersave = true;
  networking.useDHCP = false;

  # Set your time zone.
  time.timeZone = "America/Chicago";

  # Select internationalisation properties.
  i18n.defaultLocale = "en_US.utf8";
  i18n.inputMethod = {
    enabled = "fcitx5";
    fcitx5.addons = with pkgs; [
      fcitx5-mozc
      fcitx5-gtk
    ];
  };

  # Splash screen
  boot.plymouth.enable = true;
  boot.plymouth.theme = "breeze";

  security.polkit.enable = true;
  # Enable doas instead of sudo
  security.sudo.enable = false;
  security.doas.enable = true;
  security.doas.extraRules = [{
    users = [ "don" ];
    keepEnv = true;
    noPass = true;
  }];

  services = {
    avahi = {
      enable = true;
      nssmdns = true;
    };
    printing = {
      enable = true;
    };
    udisks2 = {
      enable = true;
    };
    nscd = {
      enableNsncd = true;
    };
    flatpak = {
      enable = true;
    };
    pipewire = {
      enable = true;
      alsa = {
        enable = true;
        support32Bit = true;
      };
      pulse = {
        enable = true;
      };
    };
    tailscale = {
      enable = true;
    };
    logind = {
      lidSwitchExternalPower = "ignore";
      lidSwitchDocked = "ignore";
    };
    locate = {
      enable = true;
      locate = pkgs.mlocate;
      localuser = null;
    };
    openssh = {
      enable = true;
      settings = {
        passwordAuthentication = false;
        kbdInteractiveAuthentication = false;
        #permitRootLogin = "yes";
      };
    };
  };

  # Enable sound with pipewire.
  sound.enable = true;
  hardware.bluetooth.enable = true;
  hardware.pulseaudio.enable = false;
  hardware.sane = {
    enable = true;
    extraBackends = [ pkgs.sane-airscan ];
  };
  security.rtkit.enable = true;

  xdg.portal.enable = true; # only needed if you are not doing Gnome

  users.users.don = {
    isNormalUser = true;
    description = "Don Harper";
    extraGroups = [ "networkmanager" "wheel" "scanner" "lp" "video" "mlocate" "disk" ];
    openssh.authorizedKeys.keys = [
      "git ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINd8AdVbQQ/Fmw+b9mI8EMYqIoRkwmSwAOtmlte3incL don@loki"
    ];
  };

  # Allow unfree packages
  nixpkgs.config.allowUnfree = true;
  nixpkgs.config.permittedInsecurePackages = [ "electron-21.4.0" ];

  environment.systemPackages = with pkgs; [
    python-with-my-packages
    acpi
    aspell
    authy
    bash-completion
    nix-bash-completions
    bc
    bitwarden
    bitwarden-cli
    blueberry
    btop
    cantarell-fonts
    citrix_workspace
    clipman
    cura
    darktable
    diff-so-fancy
    dmenu-wayland
    espeak-classic
    exiftool
    feh
    figlet
    file
    firefox
    flameshot
    font-awesome
    fractal-next
    fuzzel
    fzf
    git-crypt
    gitFull
    gnome.gnome-tweaks
    gnome.simple-scan
    gnumake
    gnumeric
    gnupg
    gtop
    headset-charge-indicator
    headsetcontrol
    hugo
    hunspell
    hunspellDicts.en_US
    imagemagick
    imv
    isync
    jellyfin-media-player
    jq
    kanshi
    keychain
    keyutils
    khal
    khard
    kitty
    ktimer
    libappindicator
    libnotify
    libreoffice-fresh
    links2
    lsb-release
    mairix
    moreutils
    mosh
    #mpv
    mutt
    mutt-ics
    ncdu
    neofetch
    neovim-qt
    nerdfonts
    newsboat
    nextcloud-client
    nmap
    noto-fonts
    obsidian
    pandoc
    pasystray
    pavucontrol
    pkg-config
    playerctl
    poppler_utils
    poweralertd
    powerline-fonts
    ps_mem
    psmisc
    pulseaudio
    python3
    qpwgraph
    qutebrowser
    ranger
    rapid-photo-downloader
    rofi
    ruby
    signal-desktop
    sshuttle
    source-code-pro
    steam
    stellarium
    sublime-music
    syncthing
    tailscale
    tasksh
    taskwarrior
    tdesktop
    terminus-nerdfont
    texlive.combined.scheme-medium
    tig
    timewarrior
    thunderbird
    tmux
    tmux-cssh
    tmuxp
    toot
    topgrade
    tut
    ubuntu_font_family
    udiskie
    urlview
    vdirsyncer
    vifm-full
    vit
    wget
    widevine-cdm
    wlsunset
    xdg-utils
    xfce.thunar
    zathura
    zoom-us
  ];

  programs.steam = {
    enable = true;
    remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
    dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server
  };
  programs.dconf.enable = true;
  programs.light.enable = true;
  programs.mtr.enable = true;
  #programs.mtr.package = "pkgs.mtr-gui";
  programs.kdeconnect.enable = true;


  nixpkgs.overlays = [
    (final: prev: { qutebrowser = prev.qutebrowser.override     { enableWideVine = true; }; })
    (final: super:{ khal        = super.khal.overridePythonAttrs (_: { doCheck = false; }); })
  ];

  systemd.services = {
    tailscale-autoconnect = {
      description = "Automatic connection to Tailscale";

      # make sure tailscale is running before trying to connect to tailscale
      after = [ "network-pre.target" "tailscale.service" ];
      wants = [ "network-pre.target" "tailscale.service" ];
      wantedBy = [ "multi-user.target" ];

      # set this service as a oneshot job
      serviceConfig.Type = "oneshot";

      # have the job run this shell script
      script = with pkgs; ''
        # wait for tailscaled to settle
        sleep 2

        # check if we are already authenticated to tailscale
        status="$(${tailscale}/bin/tailscale status -json | ${jq}/bin/jq -r .BackendState)"
        if [ $status = "Running" ]; then # if so, then do nothing
          exit 0
        fi

        # otherwise authenticate with tailscale
        ${tailscale}/bin/tailscale up --operator=don --authkey tskey-api-kDQcva6CNTRL-kvcJzSix6yLb2dgjr1Pi
      '';
    };

    clean-keychain = {
      description = "Clean up .keychain on boot";
      wantedBy = [ "multi-user.target" ];
      serviceConfig = {
        Type = "oneshot";
        ExecStart = "${pkgs.coreutils-full}/bin/rm -rf /home/don/.keychain";
      };
    };
  };




  # Open ports in the firewall.
  networking.firewall = {
    enable = true;
    # always allow traffic from your Tailscale network
    trustedInterfaces = [ "tailscale0" ];
    checkReversePath = "loose";

    # allow the Tailscale UDP port through the firewall
    allowedUDPPorts = [ config.services.tailscale.port ];
    #allowedUDPPortRanges = [ { from = 1714 ; to = 1764; }];

    # allow you to SSH in over the public internet
    allowedTCPPorts = [ 22 ];
    #allowedTCPPortRanges = [ { from = 1714 ; to = 1764; } ];
  };


  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It's perfectly fine and recommended to leavecatenate(variables, "bootdev", bootdev)
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "22.11"; # Did you read the comment?
  programs.msmtp = {
    enable = true;
    accounts = {
      default = {
        auth = true;
        tls = true;
        port = 587;
        from = "duck@duckland.org";
        host = "smtp.gmail.com";
        user = "duckunix@gmail.com";
        passwordeval = "cat /home/don/.smtp_password.txt";
      };
    };
  };
  nix.gc = {
    automatic = true;
    options = "-d";
  };
  xdg.mime.enable = true;
  xdg.mime.defaultApplications = {
    "text/html" = "org.qutebrowser.qutebrowser.desktop";
    "x-scheme-handler/http" = "org.qutebrowser.qutebrowser.desktop";
    "x-scheme-handler/https" = "org.qutebrowser.qutebrowser.desktop";
    "x-scheme-handler/about" = "org.qutebrowser.qutebrowser.desktop";
    "x-scheme-handler/unknown" = "org.qutebrowser.qutebrowser.desktop";
  };
  environment.sessionVariables.DEFAULT_BROWSER = "${pkgs.qutebrowser}/bin/qutebrowser";
}