# NixOS configuration for mcf-server
# Headless server environment (Command Line Interface only)

{ config
, pkgs
, lib
, inputs
, ...
}:

{
  imports = [
    ../../modules/core/common.nix
    (import ../../modules/storage/disko.nix {
      inherit inputs lib config;
      diskoConfigPath = ./disko-config.nix;
    })
    ./hardware-configuration.nix
    ../../modules/core/management.nix
    ../../modules/core/podman.nix
  ];

  networking.hostName = "mcf-server";

  # Create restic user for homeserver-1 backups
  users.users.restic-homeserver1 = {
    isSystemUser = true;
    group = "restic-homeserver1";
    shell = pkgs.zsh;
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICwGZFEr6OMm7SIPrYlt6wuuesvlmBIezqQVDxhXOHjD restic@homeserver-1"
    ];
  };

  users.groups.restic-homeserver1 = { };

  # Standard user account (shared definition in modules/core/users.nix).
  # SSH-key-only access; no password on this host.

  # SSH configuration
  services.openssh.enable = true;

  # Glances system monitor - exposed to the tailnet so homeserver-1's
  # Homepage dashboard can display real-time stats for this machine.
  services.glances = {
    enable = true;
    port = 61208;
    # Webserver mode (default). Binds to 0.0.0.0; the firewall rule below
    # restricts access to the Tailscale interface only.
    extraArgs = [ "--webserver" ];
  };

  # Expose Glances (61208) on Tailscale only
  networking.firewall.interfaces.tailscale.allowedTCPPorts = [ 61208 ];
}