# Edit this configuration file to define what should be installed on
# your system.  Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).

{ config, pkgs, ... }:

{
  imports =
    [ # Include the results of the hardware scan.
      ./hardware-configuration.nix
    ];

  # Bootloader.
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

#   services.openssh.settings.PasswordAuthentication = true;

  networking.hostName = "nixos"; # Define your hostname.
  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.

  # Configure network proxy if necessary
  # networking.proxy.default = "http://user:password@proxy:port/";
  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";

  # Enable networking
  networking.networkmanager.enable = true;

  # Set your time zone.
  time.timeZone = "America/New_York";

  # Select internationalisation properties.
  i18n.defaultLocale = "en_US.UTF-8";

  i18n.extraLocaleSettings = {
    LC_ADDRESS = "en_US.UTF-8";
    LC_IDENTIFICATION = "en_US.UTF-8";
    LC_MEASUREMENT = "en_US.UTF-8";
    LC_MONETARY = "en_US.UTF-8";
    LC_NAME = "en_US.UTF-8";
    LC_NUMERIC = "en_US.UTF-8";
    LC_PAPER = "en_US.UTF-8";
    LC_TELEPHONE = "en_US.UTF-8";
    LC_TIME = "en_US.UTF-8";
  };

  # Enable the X11 windowing system.
  # You can disable this if you're only using the Wayland session.
  services.xserver.enable = true;
  boot.supportedFilesystems = [ "ntfs" "xfs"];


#   fileSystems."/media/backup" = {
#     device = "/dev/disk/by-uuid/d418fb75-427a-408c-8703-7d8c183b7b51";
#     fsType = "xfs";
#     options = [
#       "nofail"
#       "x-systemd.automount"
#       "x-systemd.device-timeout=1s"
#       "x-systemd.idle-timeout=10min"
#     ];
#   };

#   # NTFS: pick ONE of the fsType choices below (see notes)
#   fileSystems."/media/external" = {
#     device = "/dev/disk/by-uuid/901E7D2E1E7D0E8A";
#
#     # Option A (recommended on modern kernels): in-kernel ntfs3
#     fsType = "ntfs3";
#
#     # Option B: userspace ntfs-3g (more forgiving for some edge cases)
#     # fsType = "ntfs-3g";
#
#     options = [
#       "rw"
#       "nofail"
#       "x-systemd.automount"
#       "x-systemd.device-timeout=1s"
#       "x-systemd.idle-timeout=10min"
#
#       # Make files owned by your user on mount (adjust if needed)
#       "uid=1000"
#       "gid=100"
#       "umask=022"
#     ];
#   };

  # Enable the KDE Plasma Desktop Environment.
  services.displayManager.sddm.enable = true;
  services.desktopManager.plasma6.enable = true;

  # Configure keymap in X11
  services.xserver.xkb = {
    layout = "us";
    variant = "";
  };

  # Enable CUPS to print documents.
  services.printing.enable = true;

  # Enable sound with pipewire.
  services.pulseaudio.enable = false;
  security.rtkit.enable = true;
  services.pipewire = {
    enable = true;
    alsa.enable = true;
    alsa.support32Bit = true;
    pulse.enable = true;
    # If you want to use JACK applications, uncomment this
    #jack.enable = true;

    # use the example session manager (no others are packaged yet so this is enabled by default,
    # no need to redefine it in your config for now)
    #media-session.enable = true;
  };

  # Enable touchpad support (enabled default in most desktopManager).
  # services.xserver.libinput.enable = true;

  # Define a user account. Don't forget to set a password with ‘passwd’.
  users.users.thallock = {
    isNormalUser = true;
    description = "thallock";
    extraGroups = [ "networkmanager" "wheel" "docker" ];
    packages = with pkgs; [
      kdePackages.kate
    #  thunderbird
    ];
  };

  # Install firefox.
  programs.firefox.enable = true;

  # Allow unfree packages
  nixpkgs.config.allowUnfree = true;

  # List packages installed in system profile. To search, run:
  # $ nix search wget
  environment.systemPackages = with pkgs; [
  #  vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
  vim
   wget
   git
   uv
   brave
   fish
   zellij
#   lean4
  elan
  zed-editor
  rustup
  pkg-config
  openblas
  gcc
  alacritty
  logseq
  qbittorrent
  xclip
  python3
  playwright-driver.browsers
  vlc
  vscode
  docker-compose
  ripgrep
  ntfs3g
  ffmpeg
  p7zip
  claude-code
  sqlite
#   tig
  meld
  eza
  tree
  nmap
  lazygit
  nodejs
  ncdu
  file
  fzf

    pkgs.python313Packages.vllm
  aider-chat
  # You'll likely want these for the full local experience
  ollama
];

  services.ollama = {
    enable = true;
    acceleration = "cuda";
  host = "0.0.0.0";
  port = 11434;
  # optional
  environmentVariables = {
    OLLAMA_CONTEXT_LENGTH = "32768";
    OLLAMA_KEEP_ALIVE = "-1";
  };
  };

  services.open-webui = {
    enable = true;
    environment = {
      OLLAMA_API_BASE_URL = "http://127.0.0.1:11434/api";
      OLLAMA_BASE_URL = "http://127.0.0.1:11434";
    };
  };

virtualisation.docker = {
  enable = true;
};

#   shellHook = ''
#   export PLAYWRIGHT_BROWSERS_PATH=${pkgs.playwright-driver.browsers}
#   export PLAYWRIGHT_SKIP_VALIDATE_HOST_REQUIREMENTS=true
#   export PLAYWRIGHT_HOST_PLATFORM_OVERRIDE="ubuntu-24.04"
# '';

  security.sudo.wheelNeedsPassword = false;
  programs.fish.enable = true;

#   programs.chromium = { enable = true; package = pkgs.brave; };


  hardware.bluetooth.enable = true;
    hardware.graphics = { # or hardware.opengl on older NixOS versions
    enable = true;
#     driSupport = true;
#     driSupport32Bit = true;
  };


  services.xserver.videoDrivers = ["nvidia"];

    hardware.nvidia = {
    # Modesetting is required
    modesetting.enable = true;
    open=true;

    # Power management (experimental, can cause issues)
    powerManagement.enable = false;
    # Enable the Nvidia settings menu
    nvidiaSettings = true;

    # Use the stable driver branch
    package = config.boot.kernelPackages.nvidiaPackages.stable;
  };


  networking.firewall.trustedInterfaces = [ "docker0" ];
/*
  services.pia-vpn = {
    enable = true;

    certificateFile = ./ca.rsa.4096.crt;

    environmentFile = "/run/secrets/pia.env";

    portForward = {
      enable = true;
      script = ''
        echo "PIA forwarded port is: $port"
        # example: write to a file other services can read
        echo -n "$port" > /run/pia-forwarded-port
      '';
    };
  };

  systemd.services.pia-env-file = {
    description = "Prepare PIA env file";
    wantedBy = [ "multi-user.target" ];
    before = [ "pia-vpn.service" ];
    serviceConfig = {
      Type = "oneshot";
      ExecStart = "${pkgs.bash}/bin/bash -c 'install -d -m 700 /run/secrets && install -m 600 /etc/pia.env /run/secrets/pia.env'";
    };
  };



  # configuration.nix
  services.pia-vpn.networkConfig = ''
    [Match]
    Name = ''${interface}

    [Network]
    Description = WireGuard PIA network interface
    Address = ''${peerip}/32

    [RoutingPolicyRule]
    To = ''${wg_ip}/32
    Priority = 1000

    # if port forwarding is required, make an exception for that service
    # as it's not accessible from inside the VPN
    [RoutingPolicyRule]
    To = ''${meta_ip}/32
    Priority = 1000

    [RoutingPolicyRule]
    To = 0.0.0.0/0
    Priority = 2000
    Table = 42

    [Route]
    Destination = 0.0.0.0/0
    Table = 42
  '';



  # Make dependent services follow the VPN lifecycle (optional but nice)
  systemd.services.myapp = {
    after = [ "pia-vpn.service" ];
    bindsTo = [ "pia-vpn.service" ];
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      # ...
    };
  };*/


  nix.settings.experimental-features = [ "nix-command" "flakes" ];
  systemd.network.wait-online.enable = false;

#   This is for pywright:
programs.nix-ld = {
  enable = true;
  libraries = pkgs.steam-run.args.multiPkgs pkgs;
/*
    libraries = with pkgs; [
    stdenv.cc.cc.lib
    glib
    gtk3
    cairo
    pango
    atk
    gdk-pixbuf
    dbus
    alsaLib
    freetype
    fontconfig
    xorg.libX11
    xorg.libX11_xcb
    xorg.libxcb
    xorg.libXcomposite
    xorg.libXcursor
    xorg.libXdamage
    xorg.libXext
    xorg.libXfixes
    xorg.libXi
    xorg.libXrandr
    xorg.libXrender
  ];*/
};

  # Some programs need SUID wrappers, can be configured further or are
  # started in user sessions.
  # programs.mtr.enable = true;
  # programs.gnupg.agent = {
  #   enable = true;
  #   enableSSHSupport = true;
  # };

  # List services that you want to enable:

  # Enable the OpenSSH daemon.
  # services.openssh.enable = true;

  # Open ports in the firewall.
  # networking.firewall.allowedTCPPorts = [ ... ];
  # networking.firewall.allowedUDPPorts = [ ... ];
  # Or disable the firewall altogether.
  # networking.firewall.enable = false;

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "25.11"; # Did you read the comment?



}