nix-config/nixos/stolas/default.nix

{ config, lib, pkgs, ... }:
{

  imports = [
    ../modules/profiles/laptop.nix
    ./disks.nix
    # TODO ./paperless.nix
  ];

  nixpkgs = {
    hostPlatform = "x86_64-linux";
  };

  boot = {
    # TODO lanzaboote = {
    #  enable = true;
    #  pkiBundle = "/var/lib/sbctl";
    #};
    kernelModules = [ "kvm-amd" ];
    extraModulePackages = [ pkgs.linuxPackages.v4l2loopback ];
    initrd = {
      availableKernelModules = [
        "nvme"
        "xhci_pci"
        "thunderbolt"
        "usb_storage"
        "sd_mod"
      ];
      # TODO disable for lanzaboote
      systemd.enable = true;
      # Lanzaboote currently replaces the systemd-boot module.
      # This setting is usually set to true in configuration.nix
      # generated at installation time. So we force it to false
      # for now.
      #boot.loader.systemd-boot.enable = lib.mkForce false;
      luks.devices = {
        root = {
          # TODO 
          device = "/dev/disk/by-uuid/81dfbfa5-d578-479c-b11c-3ee5abd6848a";
          allowDiscards = true;
          # TODO lanzaboote + TPM2 unlock with PIN https://www.freedesktop.org/software/systemd/man/251/systemd-cryptenroll.html#--tpm2-with-pin=BOOL
          #crypttabExtraOpts = [ "fido2-device=auto" ];
        };
      };
    };
  };

  environment.systemPackages = [
    # For debugging and troubleshooting Secure Boot.
    pkgs.sbctl
  ];

  hardware = {
    # NOTE: hardware.framework.enableKmod requires kernel patching, but enables access to some EC features
    bluetooth.enable = true;
    cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
    framework.laptop13.audioEnhancement.enable = true;
    graphics = {
      enable = true;
      extraPackages = with pkgs; [
        vaapiVdpau
        libvdpau-va-gl
      ];
    };
  };

  powerManagement = {
    enable = true;
    cpuFreqGovernor = "schedutil";
    # TODO: Limit charge of battery, does this work without kernel patches from hardware.frameworkenableKmod?
    powerUpCommands = ''
      echo 80 > /sys/class/power_supply/BAT0/charge_control_stop_threshold
    '';
  };

  networking = {
    hostName = "stolas";
    firewall = {
      enable = true;
      allowedTCPPorts = [
        22000 # Syncthing
      ];
      allowedUDPPorts = [
        21027 # Syncthing
      ];
    };
  };

  nix = {
    settings.max-jobs = lib.mkDefault 16;
  };

  dadada.backupClient.backup1.enable = true;
  dadada.backupClient.backup2 = {
    enable = true;
    repo = "u355513-sub5@u355513-sub5.your-storagebox.de:/home/backup";
  };

  programs = {
    adb.enable = true;
    firefox = {
      enable = true;
      package = pkgs.firefox-wayland;
    };
    gnupg.agent.enable = true;
    ssh.startAgent = true;
    wireshark.enable = true;
  };

  services = {
    avahi.enable = true;
    desktopManager.plasma6.enable = true;
    displayManager = {
      sddm.enable = true;
      sddm.wayland.enable = true;
    };
    gnome.gnome-keyring.enable = lib.mkForce false;
    smartd.enable = true;
    printing = {
      enable = true;
      browsing = true;
    };
    tlp.enable = false;
  };

  system = {
    stateVersion = "25.05";
  };

  systemd.services = {
    modem-manager.enable = lib.mkForce false;
    "dbus-org.freedesktop.ModemManager1".enable = lib.mkForce false;
  };

  systemd.sleep.extraConfig = ''
    HibernateDelaySec=1h
  '';

  virtualisation.libvirtd.enable = true;

  users = {
    users = {
      dadada = {
        initialHashedPassword = "$y$j9T$43qGBeY6hg6AXQmcVkS131$6AeRDOe6XAnmgA/AkJGaSIYTj5dbQLd9vrQ7zSyi5TA";
        isNormalUser = true;
        extraGroups = [
          "wheel"
          "networkmanager"
          "libvirtd"
          "adbusers"
          "kvm"
          "video"
          "scanner"
          "lp"
          "docker"
          "dialout"
          "wireshark"
          "paperless"
        ];
        shell = "/run/current-system/sw/bin/zsh";
      };
    };
  };

  age.secrets = {
    paperless = {
      file = "${config.dadada.secrets.path}/paperless.age";
      mode = "700";
      owner = "paperless";
    };
  };
  
  # Create compressing swap space in RAM
  zramSwap.enable = true;
}