# Edit this configuration file to define what should be installed on
# your system.  Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).

{ config, pkgs, ... }:

{
  imports =
    [ # Include the results of the hardware scan.
      ./hardware-configuration.nix
	(
	#let revision = "e74e57a37de55ecfdc62f49fe5a7463b2a52499a"; in
	let revision = "98a61cf0708885abddebc6938ca7282928981d5e"; in
	builtins.fetchTarball {
	 url = "https://github.com/Jovian-Experiments/Jovian-NixOS/archive/${revision}.tar.gz";
	 sha256 = "sha256:0f1c3ilr9rm6jrs3nfhvf8ni0jccfy1810s6a94iywa9416w1k7c";
	 } + "/modules"
	) 
    ];

  jovian = {
    devices.steamdeck = {
      enable = true;
      autoUpdate = false;
      enableGyroDsuService = true;
    };
    steam = {
      enable = true;
      autoStart = true;
      user = "wieerwill";
      desktopSession = "sway";
      updater.splash = "jovian";
    };
    decky-loader = {
      enable = true;
      #extraPackages = [pkgs.curl pkgs.unzip];
      #user = "wieerwill";
    };
  };
  programs.xwayland.enable = true;
  programs.sway = {
    enable = true;
    wrapperFeatures.gtk = true;
  };
  programs.light.enable = true;
  
  nixpkgs.config.permittedInsecurePackages = [
    "electron-27.3.11"
  ];

  # Bootloader.
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  networking.hostName = "decky"; # Define your hostname.
  networking.networkmanager.enable = true;
  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
  # Configure network proxy if necessary
  # networking.proxy.default = "http://user:password@proxy:port/";
  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";

  # Set your time zone.
  time.timeZone = "Europe/Berlin";

  # Select internationalisation properties.
  i18n.defaultLocale = "de_DE.UTF-8";

  i18n.extraLocaleSettings = {
    LC_ADDRESS = "de_DE.UTF-8";
    LC_IDENTIFICATION = "de_DE.UTF-8";
    LC_MEASUREMENT = "de_DE.UTF-8";
    LC_MONETARY = "de_DE.UTF-8";
    LC_NAME = "de_DE.UTF-8";
    LC_NUMERIC = "de_DE.UTF-8";
    LC_PAPER = "de_DE.UTF-8";
    LC_TELEPHONE = "de_DE.UTF-8";
    LC_TIME = "de_DE.UTF-8";
  };

  # Enable the X11 windowing system.
  services.xserver.enable = false;
  security.polkit.enable = true;
  environment.systemPackages = with pkgs; [
    xwayland
    (writers.writeDashBin "sway-logout" ''
      ${systemd}/bin/systemctl --user unset-environment WAYLAND_DISPLAY SWAYSOCK
      ${sway}/bin/swaymsg exit
    '')
  ];
  # Enable the gnome-keyring secrets vault. 
  # Will be exposed through DBus to programs willing to store secrets.
  services.gnome.gnome-keyring.enable = true;

  # Configure keymap in X11
  services.xserver.xkb = {
    layout = "de";
    variant = "";
  };

  # Configure console keymap
  console.keyMap = "de";

  # Enable CUPS to print documents.
  services.printing.enable = true;

  # Enable sound with pipewire.
  hardware.pulseaudio.enable = false;
  security.rtkit.enable = true;
  services.pipewire = {
    enable = true;
    alsa.enable = true;
    alsa.support32Bit = true;
    pulse.enable = true;
    # If you want to use JACK applications, uncomment this
    #jack.enable = true;
  };

  # Enable touchpad support (enabled default in most desktopManager).
  services.libinput.enable = true;

  # Define a user account. Don't forget to set a password with ‘passwd’.
  users.groups.steamos.gid = 1000;
  users.users.wieerwill = {
    isNormalUser = true;
    description = "wieerwill";
    #groups = "steamos";
    extraGroups = [ "networkmanager" "wheel" "users" "video" "audio" "input"];
    packages = with pkgs; [];
  };

  # Allow unfree packages
  nixpkgs.config.allowUnfree = true;

  # Enable the OpenSSH daemon.
  services.openssh = {
    enable = true;
    ports = [22];
    settings = {
      AllowUsers = ["wieerwill"];
      X11Forwarding = false;
      PasswordAuthentication = false; # disable to enforce SSH key login
      PermitRootLogin = "prohibit-password";
    };
  };
  
  hardware.bluetooth = {
    enable = true;
    powerOnBoot = true;
    settings = {
      General = {
	Experimental = true;
      };
    };
  };
	  
  # Open ports in the firewall.
  networking.firewall = {
    enable = true;
    allowedTCPPorts = [22 80 443];
    allowedUDPPorts = [];
  };

  services.fail2ban = {
    enable = true;
    maxretry = 5;
    bantime = "1m";
  };


  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "24.05"; # Did you read the comment?

}