nixos/modules/common/configuration.nix

{ config, lib, pkgs, vars, ... }:

let
  switchCmd = ''
    sudo nixos-rebuild switch \
      --no-write-lock-file \
      --refresh \
      --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target)
  '';
  testCmd = ''
    sudo nixos-rebuild test \
      --no-write-lock-file \
      --refresh \
      --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target)
  '';
  buildImageFn = ''
    buildImage() {
      if [ -z "$1" ]; then
        echo "usage: buildImage <flake-target>  (e.g. lxc-docker)" >&2
        return 1
      fi
      NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" nix build --impure \
        ".#nixosConfigurations.$1.config.system.build.tarball"
    }
  '';
in
{
  imports =
    [
      # Include the results of the hardware scan.
      #      ./hardware-configuration.nix
      ./set-locale.nix
      ../ipa/client.nix
    ];

  # System-wide shell config so all users (including IPA accounts) get the
  # same management aliases as the local nixos user's Home Manager provides.
  programs.bash = {
    shellAliases = {
      "Switch-nix" = switchCmd;
      "Test-nix" = testCmd;
    };
    interactiveShellInit = buildImageFn;
  };
  # Use the GRUB 2 boot loader.
  # boot.loader.grub.enable = true;
  #boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only

  networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.

  # Recommended over the true default (bypasses ZFS's own import safeguards)
  # per the option's own docs; matches hosts/docker/host.nix and
  # modules/services/zfs/enable-service.nix, which already set this
  # explicitly. Harmless no-op on hosts that don't use ZFS at all.
  boot.zfs.forceImportRoot = false;

  # Set your time zone.
  time.timeZone = vars.timeZone;

  # Enable QEMU agent
  services.qemuGuest.enable = true;

  # Enable docker-compose
  environment.systemPackages = with pkgs; [
    vim
    btop
    git
    gcr
    jq
  ];

  # Secrets shared by every host, decrypted at activation via each host's
  # existing SSH host key (sops-nix derives the age key from
  # /etc/ssh/ssh_host_ed25519_key automatically — see modules/common/README
  # or docs/ for the sops workflow). hashedPassword/hashedPasswordFile need
  # neededForUsers so they're available before the normal secret-activation
  # step, since user creation happens very early in boot.
  sops = {
    defaultSopsFile = ../../secrets/common.yaml;

    secrets = {
      "root-hashedPassword".neededForUsers = true;
      "nixos-hashedPassword".neededForUsers = true;
      "nix-github-token" = { };
    };

    # nix.conf doesn't support a *File-style option for access-tokens, so the
    # token is rendered into a runtime-only file (never touches the Nix store)
    # and pulled in via nix.conf's native !include directive.
    templates."nix-github-token.conf".content = ''
      access-tokens = github.com=${config.sops.placeholder."nix-github-token"}
    '';
  };

  nix.extraOptions = ''
    !include ${config.sops.templates."nix-github-token.conf".path}
  '';

  users = {
    # With mutableUsers = false, update-users-groups.pl enforces hashedPasswordFile
    # on every activation regardless of whether the account already exists in
    # /etc/shadow. The default (true) only applies hashedPasswordFile to newly-
    # created accounts — which means a freshly-built proxmox disk image (where
    # activation runs without a usable sops key, so both accounts land in shadow
    # with ‘!’) will never have its passwords fixed by subsequent boots.
    mutableUsers = false;

    users.root = {
      hashedPasswordFile = config.sops.secrets."root-hashedPassword".path;
    };

    users.${vars.primaryUser} = {
      isNormalUser = true;
      extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
      packages = with pkgs; [
        tree
      ];
      hashedPasswordFile = config.sops.secrets."nixos-hashedPassword".path;
      openssh.authorizedKeys.keys = [
        vars.adminSshKey
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGygkCljN6uKpdJbHTOQtn8ZnH+wKXDLAwrDFbLrE/65 nixos@nixos"
      ];
    };
  };


  # Enable the OpenSSH daemon.
  services.openssh.enable = true;

  #Enable flakes

  nix.settings = {
    experimental-features = [ "nix-command" "flakes" ];
    auto-optimise-store = true;
  };


  programs.git = {
    enable = true;
    package = pkgs.git;
    config = {
      credential.helper = "store";
    };
  };



}