# /hosts/nixos/configuration.nix
{ config
, pkgs
, inputs
, lib
, ...
}:

{
  imports = [
    ./hardware-configuration.nix
    ../../modules/core/common.nix
    ../../modules/desktop/gui.nix
    (import ../../modules/storage/disko.nix {
      inherit inputs lib config;
      diskoConfigPath = ./disko-config.nix;
    })
    ../../modules/desktop/hyprland.nix
    ../../modules/desktop/apps/soundux.nix
    ../../modules/desktop/apps/freeshow.nix
    ../../modules/desktop/apps/x32edit.nix
    ../../modules/desktop/apps/mixing-station.nix
    ../../modules/desktop/apps/opencode.nix
    ../../modules/core/management.nix
    ../../modules/hardware/laptop.nix
    ../../modules/hardware/nvidia.nix
    ../../modules/hardware/thinkpad-battery-limit.nix
    ../../modules/hardware/tablet-mode.nix
    ../../modules/core/known-hosts.nix
    ../../modules/core/podman.nix
    ../../modules/core/dev.nix
    ../../modules/services/paperless.nix
  ];

  sops.secrets = {
    "x1carbon/borg-passphrase" = {
      mode = "0600";
      owner = "root";
    };
    "x1carbon/borg-ssh-key" = {
      mode = "0600";
      owner = "root";
    };
    # Nextcloud CalDAV credentials for the QuickShell calendar popup. Rendered
    # to /run/secrets/hp-laptop/nextcloud-cal-env (the default path the
    # qs-cal-sync backend expects) — reuse the same secret for both hosts.
    "hp-laptop/nextcloud-cal-env" = {
      owner = "petere";
      group = "users";
      mode = "0440";
    };
    "users/petere-password" = {
      neededForUsers = true;
    };
    "x1carbon/telegram-bot-token" = {
      owner = "petere";
      group = "users";
      mode = "0440";
    };
    "opencode-api-key" = {
      owner = "petere";
      group = "users";
      mode = "0440";
    };
    "x1carbon/gitea-mcp-token" = {
      owner = "petere";
      group = "users";
      mode = "0440";
    };
  };

  #TEMPORARY FIX
  # nixpkgs.overlays = [
  #   (final: prev: {
  #     pnpm = prev.pnpm // { nodejs-slim = final.nodejs-slim; };
  #     pnpm_10 = prev.pnpm_10 // { nodejs-slim = final.nodejs-slim; };
  #     pnpm_11 = prev.pnpm_11 // { nodejs-slim = final.nodejs-slim; };
  #   })
  # ];

  services.paperless-service.enable = true;

  hardware.sensor.iio.enable = true;

  home-manager.users.petere.imports = [
    ../../home-manager/modules/hyprland.nix
    ../../home-manager/modules/quickshell-cal.nix
    ../../home-manager/modules/quickshell-apps.nix
    ../../home-manager/modules/opencode.nix
    ../../home-manager/modules/nix-lsp.nix
    ../../home-manager/modules/matugen.nix
  ];

  home-manager.users.petere.services.quickshell-cal.enable = true;

  home-manager.users.petere.services.quickshell-apps = {
    enable = true;
    apps = [
      {
        name = "Element";
        cmd = "element-desktop";
      }
      {
        name = "Nextcloud";
        cmd = "nextcloud";
      }
      {
        name = "Bitwarden";
        cmd = "bitwarden";
      }
    ];
  };

  networking.hostName = "x1carbon";
  networking.modemmanager.enable = true;

  # Laptop-specific hardware (fingerprint reader, fwupd)
  my.hardware.laptop.enable = true;

  # Charging cap at 80% via the ThinkPad's native sysfs thresholds
  # (charge_control_start/end_threshold). The EC at 76% won't resume charging
  # until it drops to/below the resume threshold (75) — expect the level to
  # hover between ~76 and ~80 while "on". Despite the name, this is the
  # standard ThinkPad behaviour; the QML gear toggle drives this via
  # `battery-charge-limit on|off|status`.
  my.hardware.thinkpadBatteryLimit.enable = true;

  my.hardware.nvidia = {
    enable = true;
    nvidiaSettings = true;
    package = config.boot.kernelPackages.nvidiaPackages.legacy_580;
  };

  my.hardware.tabletMode.enable = true;

  programs.steam.enable = true;

  services.hardware.bolt.enable = true;

  # Establish trust for SSH to richmond-server (borg backup target, now using Backrest).
  my.knownHosts.richmondServer = true;

  # Borg Backup removed - migrated to Backrest (see hosts/homeserver-1/configuration.nix)
  my.users.petere = {
    hashedPasswordFile = config.sops.secrets."users/petere-password".path;
    subUidStart = 100000;
    subGidStart = 100000;
  };

  networking.firewall = {
    enable = true;
    allowedTCPPorts = [
      9756 # TeleportFling screen/audio streaming
    ];
    allowedUDPPorts = [
      9999 # TeleportFling multicast discovery
    ];
    allowedTCPPortRanges = [
      {
        from = 1714;
        to = 1764;
      } # KDE Connect / GSConnect
      {
        from = 5960;
        to = 6000;
      } # NDI streams
    ];
    allowedUDPPortRanges = [
      {
        from = 1714;
        to = 1764;
      } # KDE Connect / GSConnect discovery
      {
        from = 5960;
        to = 6000;
      } # NDI reliable UDP
    ];
  };

  boot.kernelModules = [
    "sg"
    "v4l2loopback"
  ];
  boot.extraModulePackages = [ pkgs.linuxPackages.v4l2loopback ];
  boot.extraModprobeConfig = ''
    options v4l2loopback devices=1 video_nr=1 card_label="OBS Cam" exclusive_caps=1
  '';

  environment.systemPackages = with pkgs; [
    openshot-qt
    (
      (wrapOBS.override {
        obs-studio = obs-studio.override { cudaSupport = true; };
      })
        {
          plugins = with obs-studio-plugins; [
            distroav
            obs-backgroundremoval
            obs-teleport
          ];
        }
    )
    vorta
    xournalpp
    winbox
    steam
    lmstudio
    lm_sensors
    gimp
    scribus
    ventoy
  ];
}