{ config, pkgs, lib, ... }: 
let
  # Add nixpkgs-unstable channel with the following command:
  # nix-channel --add https://nixos.org/channels/nixpkgs-unstable nixpkgs-unstable && nix-channel --update
  # 09/15/24: Use nixpkgs-unstable for logseq, see https://github.com/NixOS/nixpkgs/pull/340427
  unstable = import <nixpkgs-unstable> { config = config.nixpkgs.config; };
  host_name = "litten";
  host_fqdn = "${host_name}.brenise.dev";
in
{
  imports = [
    ./hardware-configuration.nix
  ];

  nixpkgs.config = {
    allowUnfreePredicate = pkg:
      builtins.elem (lib.getName pkg) [
        "obsidian"
        "packer"
        "vscode"
        "terraform"
        "zoom"
      ];
  };

  boot = {
    loader = {
      systemd-boot.enable = true;
      efi.canTouchEfiVariables = true;
    };
  };

  hardware = {
    bluetooth.enable = true;
    keyboard.qmk.enable = true;

    opengl = { # https://wiki.nixos.org/wiki/Accelerated_Video_Playback
      enable = true;
      extraPackages = with pkgs; [
        intel-media-driver
      ];
    };
  };

  networking = {
    hostName = "${host_name}";
  # networkmanager.enable = true;
    firewall.enable = false;
    interfaces = {
      enp100s0.ipv4.addresses = [{
        address = "192.168.1.35";
        prefixLength = 24;
      }];
    };
    defaultGateway = {
      address = "192.168.1.1";
      interface = "enp100s0";
    };
    # TODO https://nixos.wiki/wiki/Encrypted_DNS
    nameservers = [ "1.1.1.1" "8.8.8.8" ];
    extraHosts = ''
      192.168.1.1 shinx.${host_fqdn}
    '';
  };

  time.timeZone = "America/Los_Angeles";

  i18n.defaultLocale = "en_US.UTF-8";
  console = {
    font = "Lat2-Terminus16";
#   keyMap = "us";
    useXkbConfig = true; # use xkbOptions in tty.
  };

  users = {
    groups.glance = {};
    users = {

      root = {
        openssh.authorizedKeys.keyFiles = [
          /etc/nixos/ssh/authorized_keys
        ];
      };

      blee = {
        openssh.authorizedKeys.keyFiles = [
          /etc/nixos/ssh/authorized_keys
        ];
        isNormalUser = true;
        extraGroups = [
          "wheel"
        # "docker"
          "glance"
          ];
        packages = with pkgs; [
          chromium
          coreutils # base64
          element-desktop
          firefox
          gimp
          jellyfin-media-player
          kate # kwrite
          kdenlive
          libsForQt5.kcalc
        # unstable.logseq # warning: https://github.com/logseq/logseq/issues/10851#issuecomment-2402925912
          moonlight-qt
          obs-studio
          obsidian
          pavucontrol
        # qbittorrent
          rtorrent
          spek # beat saber mapping
          sq
          synergy
          tenacity
          thunderbird
          tor-browser
          via
          vlc
          vscode
          xcaddy # warning: awfuly hacky
          yt-dlp
          zoom-us

          # Build vim huge with clipboard support
          (vim_configurable.overrideAttrs (oldAttrs: {
            features = "huge";
          }))

          awscli2
         #aws-sam-cli # broken, fails to init. use pip install aws-sam-cli
          packer
          terraform
          ansible
          python311 # Not working in 3.12 yet: openwebui
          python311Packages.pip
          python311Packages.ipython
          python311Packages.jmespath # for Ansible playbooks with json_query (grafana, caddy)
          libreoffice-qt
          hunspell
          hunspellDicts.uk_UA
          hunspellDicts.th_TH
        # postman # nope, auth is broken
          nodejs_20
          yarn
          deno
          nix-init
          nix-tree
          nurl
        ];
      };

      glance = {
        isSystemUser = true;
        group = "glance";
        home = "/var/lib/glance";
        createHome = true;
        description = "Glance service user";
      # shell = pkgs.bash;
      };

    };
  };

  environment = {
    systemPackages = with pkgs; [
      # GPU tools
      android-tools
      arp-scan
      cryptsetup
      curl
      difftastic
      dig
      dnscontrol
      dnsutils
      doas
      exiftool
      ffmpeg
      file
      fzf
      git
      go
      htop
      iftop
      imagemagick
      iperf
      jq
      lego
      libressl
      mediainfo
      net-snmp # snmpwalk
      netcat
      nettools
      parted
      pass
      pciutils # lspci
      psmisc
      qrencode
      rsync
      screen
      tcpdump
      tmux
      tree
      unzip
      vim
      vulkan-tools
      wget
      whois
      wireguard-tools
      zbar
      zip
    ];

    shellInit = ''
      pheonix() {
          systemctl restart "$1"
          journalctl -fu "$1"
      }
    '';

    plasma5.excludePackages = with pkgs.libsForQt5; [
      plasma-browser-integration
    ];
    etc."gitconfig".text = ''
      [init]
        defaultBranch = main
    '';
    # vscode on Wayland
    #sessionVariables.NIXOS_OZONE_WL = "1";
  };

  programs = {
    appimage = {
      enable = true;
      binfmt = true;
      package = pkgs.appimage-run.override {
        extraPkgs = pkgs: [
          pkgs.libthai # lume
        ];
      };
    };
  # hyprland = {
  #   enable = true;
  #   xwayland.enable = true;
  # };

    fish.enable = true;
    vim.defaultEditor = true;
    bash = {
      shellAliases = {
        ll = "ls -lAF --classify --group-directories-first";
        l  = "ls -lF --classify --group-directories-first";
      };
      # https://nixos.wiki/wiki/Fish
      interactiveShellInit = ''
        if [[ $(${pkgs.procps}/bin/ps --no-header --pid=$PPID --format=comm) != "fish" && -z ''${BASH_EXECUTION_STRING} ]]
        then
          shopt -q login_shell && LOGIN_OPTION='--login' || LOGIN_OPTION=""
          exec ${pkgs.fish}/bin/fish $LOGIN_OPTION
        fi
      '';
    };
    mtr.enable = true;
    gnupg.agent = {
      enable = true;
      enableSSHSupport = true;
    };
    kdeconnect.enable = true;
    chromium = {
      enable = true;
      extraOpts = {
        "SpellcheckEnabled" = false;
      };
    };
  };

  security = {
    sudo.enable = false;
    doas = {
      enable = true;
      extraRules = [
        {
          users = [ "blee" ];
          persist = true;
        }
      ];
    };
    pki.certificateFiles = [
      "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
    # "/etc/ssl/certs/dotted-turbans.pem"
    ];
  };

  services = {

    openssh.enable = true;
    udev.packages = [ pkgs.via ];

    # https://discourse.nixos.org/t/bluetooth-a2dp-sink-not-showing-up-in-pulseaudio-on-nixos/32447/4?u=bleetube
    pipewire = {
      enable = true;
      pulse.enable = true;
      alsa.enable = true; # for tenacity
    };
    avahi = { # for resolving start9 hostname
      enable = true;
      nssmdns4 = true; # Enable NSS support for mDNS
    };

    syncthing = {
        enable = true;
        user = "blee";
        dataDir = "/home/blee/Documents";
    };
    journald.extraConfig = "MaxRetentionSec=30day";

    # https://github.com/NixOS/nixpkgs/blob/nixos-23.05/nixos/modules/services/monitoring/prometheus/exporters.nix
    prometheus.exporters.node = {
      enable = true;
      port = 8030;
#     openFirewall = true;
      enabledCollectors = [
        "cpu.info"
        "interrupts"
        "netstat"
        "vmstat"
        "systemd"
        "tcpstat"
        "processes"
      ];
    };

    caddy = {
      enable = true;
      logFormat = "output discard";
      extraConfig = let
        tlsConfig = ''
          tls {
            dns namecheap {
              api_key {env.NAMECHEAP_API_KEY}
              user {env.NAMECHEAP_API_USER}
              api_endpoint https://api.namecheap.com/xml.response
            }
          }
        '';
      in ''
        ${host_fqdn} { # open-webui
          ${tlsConfig}
          reverse_proxy http://127.0.0.1:8080

        # handle /files/* {
        #   root /mnt/usb/
        #   file_server browse
        # }

        }

        ${host_fqdn}:4430 { # node_exporter
          ${tlsConfig}
          reverse_proxy http://127.0.0.1:8030
        }

        ${host_fqdn}:4431 { # litellm
          ${tlsConfig}
          reverse_proxy http://127.0.0.1:8031
        }

        ${host_fqdn}:4432 { # glance
          ${tlsConfig}
          reverse_proxy http://127.0.0.1:8032
        }


      '';
    };

    displayManager = {
      sddm.enable = true;
      #defaultSession = "plasmawayland";
    };
    xserver = {
      enable = true;
      desktopManager.plasma5.enable = true;
    };

  };

  systemd = {
    services.caddy = {
      serviceConfig = {
        EnvironmentFile = "/var/src/secrets/namecheap";
        ExecStart = [
          ""  # This empty string clears the existing ExecStart commands
          "/opt/bin/caddy run --config /etc/caddy/caddy_config --adapter caddyfile"
        ];
        ExecReload = [
          ""  # This empty string clears the existing ExecReload commands
          "/opt/bin/caddy reload --config /etc/caddy/caddy_config --adapter caddyfile --force"
        ];

      };
    };
    services.glance = {
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
      serviceConfig = {
        User = "glance";
        Group = "glance";
        WorkingDirectory = "/var/lib/glance";
      # Environment = "LOG_LEVEL=debug"; # https://github.com/glanceapp/glance/issues/196
        ExecStart = "${pkgs.glance}/bin/glance --config config.yaml";
      };
    };
# TODO: fix errors
#   services.nightly-backups = {
#     description = "Nightly Backup Service";
#     wantedBy = [ "multi-user.target" ];
#     after = [ "network.target" ];
#   # enable = false; # testing
#     serviceConfig = {
#       User = "blee";
#       Type = "oneshot";
#       Environment = "NIX_PATH=nixpkgs=/nix/var/nix/profiles/per-user/root/channels/nixos:nixos-config=/etc/nixos/configuration.nix:/nix/var/nix/profiles/per-user/root/channels";
#       WorkingDirectory = "/home/blee/ops/brenise.dev/scripts/backups";
#       # batch.sh calls other shell scripts which leads to nix environment hell.
#       # As a workaround, I think we could add multiple ExecStart lines for other backup scripts.
#     # ExecStart = "${pkgs.bash}/bin/bash /home/blee/ops/brenise.dev/scripts/backups/batch.sh";
#       ExecStart = "${pkgs.bash}/bin/bash /home/blee/ops/brenise.dev/scripts/backups/hosts/litten.brenise.dev.sh";
#     # Path = [
#     #   "${pkgs.openssh}/bin"
#     #   "${pkgs.coreutils}/bin"
#     #   "${pkgs.gnugrep}/bin"
#     #   "${pkgs.gnused}/bin"
#     # ];
#     };
#   };

#   timers.nightly-backups = {
#     wantedBy = [ "timers.target" ];
#     partOf = [ "nightly-backups.service" ];
#     timerConfig = {
#       OnCalendar = "daily";
#       nCalendar = "*-*-* 03:00:00";
#     # Persistent = true;
#       Unit = "nightly-backups.service";
#     };
#   };

    services.ollama-webui = {
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
      serviceConfig = {
        Type = "forking";
        User = "blee";
        WorkingDirectory = "/opt/open-webui";
        Environment = "NIX_PATH=nixpkgs=/nix/var/nix/profiles/per-user/root/channels/nixos:nixos-config=/etc/nixos/configuration.nix:/nix/var/nix/profiles/per-user/root/channels";
      # ExecStart = "${pkgs.nix}/bin/nix-shell";
      };
      script = "${pkgs.nix}/bin/nix-shell";
    };

  };

# virtualisation.docker = {
#   enable = true;
#   rootless = {
#     enable = true;
#     setSocketVariable = true;
#   };
#   autoPrune = {
#     enable = true;
#     dates = "monthly";
#   };
# };

  system.stateVersion = "23.05";
}