{ config
, pkgs
, lib
, ...
}:

{
  imports = [
    ./settings.nix
    ./fonts.nix
    ./sops.nix
    ./users.nix
  ];

  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  programs.zsh.enable = true;

  # SSH is key-only on all hosts. petere (the only SSH user) authenticates with
  # an authorized key; GUI users keep their local password for console/GUI login
  # but cannot use it over SSH. Root SSH is fully disabled.
  services.openssh = {
    enable = true;
    settings = {
      PasswordAuthentication = false;
      KbdInteractiveAuthentication = false;
      PermitRootLogin = "no";
    };
  };

  # Passwordless sudo for the admin/agent user only. Other wheel members
  # (e.g. caitlin, mary) must enter their password for sudo.
  security.sudo.extraRules = [
    {
      users = [ "petere" ];
      commands = [
        {
          command = "ALL";
          options = [ "NOPASSWD" ];
        }
      ];
    }
  ];

  system.activationScripts.exportAgeKey = {
    text = ''
      if [ -f /root/.config/sops/age/keys.txt ]; then
        ${pkgs.age}/bin/age-keygen -y < /root/.config/sops/age/keys.txt > /tmp/age-public-key.txt
        chmod 644 /tmp/age-public-key.txt
      fi
    '';
    deps = [ ];
  };

  # Automatic Nix store garbage collection and optimisation to prevent disk
  # creep. Runs every 2 hours; persistent ensures missed runs are caught up on boot.
  nix.gc = {
    automatic = true;
    dates = "*-*-* 0/2:00:00";
    persistent = true;
  };

  # Keep the last 5 system generations (regardless of age), then collect garbage.
  # nix.gc.options only accepts nix-collect-garbage flags (age-based), so we
  # override the service to add count-based generation pruning.
  systemd.services.nix-gc.script = lib.mkForce ''
    ${pkgs.nix}/bin/nix-env --profile /nix/var/nix/profiles/system --delete-generations +5
    exec ${pkgs.nix}/bin/nix-collect-garbage
  '';

  nix.optimise.automatic = true;

  environment.systemPackages = with pkgs; [
    # Antigravity removed - no longer used
  ];

  system.stateVersion = "23.11";
}