NixOS Configuration

{ config, lib, ... }:
let
  vars = import ../flakevars.nix;
in
{
  options.monorepo.vars = {
    device = lib.mkOption {
      type = lib.types.str;
      default = "/dev/sda";
      example = "/dev/nvme0n1";
      description = "device that NixOS is installed to";
    };
   
    internetName = lib.mkOption {
      type = lib.types.str;
      default = "${vars.internetName}";
      example = "myinternetname";
      description = "Internet name to be used for internet usernames";
    };
   
    sshKey = lib.mkOption {
      type = lib.types.str;
      default = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICts6+MQiMwpA+DfFQxjIN214Jn0pCw/2BDvOzPhR/H2 preston@continuity-dell";
      example = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICts6+MQiMwpA+DfFQxjIN214Jn0pCw/2BDvOzPhR/H2 preston@continuity-dell";
      description = "Admin public key for managing multiple configurations";
    };
   
    dkimKey = lib.mkOption {
      type = lib.types.str;
      default = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsC9GpfjvQlldPrHAC7Yt+ZF0aduUIVV4j2+KUkF0j6NsrpOgvU6COWKQSod/B/qyPBLWf+w5P5YiJ9XnOgw6Db/I9C67eusEHnV/cbvokXLQjSBvXee1OEdrT9i+6iUgDeGWP4CrD1DcwvXzAcCI9exy3yALHVlbkyYvi0KAYofs8dVQ3JCwSCMlol71lA6ULJ2zbCIWeSOv9/C6QZ5HOIeeoFLesX6O/YvF4FYxWbSHy244TXYuczQKuayjKgD6e8gIT5WJRQj8IAWOQ2podWw6hSuB3Ig+ekoOfnl5ivJGOMbAzFTj8FtbS4ncyidLU1kIOeuLfiILeDDLlIeYTwIDAQAB";
      example = "string_after_p=";
      description = "dkim key to put in host record for email";
    };
   
    repoName = lib.mkOption {
      type = lib.types.str;
      default = "monorepo";
      example = "myreponame";
      description = "Name of this repository";
    };
   
    projects = lib.mkOption {
      type = lib.types.listOf lib.types.str;
      default = [
        "monorepo"
        "nullerbot"
      ];
      example = [
        "project1"
        "project2"
        "project3"
      ];
      description = "Names of repos that will have mailing lists";
    };
   
    fileSystem = lib.mkOption {
      type = lib.types.str;
      default = "ext4";
      example = "btrfs";
      description = "filesystem to install with disko";
    };
   
    diskoSpec = lib.mkOption {
      type = lib.types.attrs;
      description = "retains a copy of the disko spec for reflection";
    };
   
    fullName = lib.mkOption {
      type = lib.types.str;
      default = "Preston Pan";
      example = "John Doe";
      description = "Full Name";
    };
   
    userName = lib.mkOption {
      type = lib.types.str;
      default = "preston";
      example = "myUser";
      description = "system username";
    };
   
    gpgKey = lib.mkOption {
      type = lib.types.str;
      default = "AEC273BF75B6F54D81343A1AC1FE6CED393AE6C1";
      example = "1234567890ABCDEF...";
      description = "GPG key fingerprint";
    };
   
    remoteHost = lib.mkOption {
      type = lib.types.str;
      default = "${vars.remoteHost}";
      example = "example.com";
      description = "Address to push to and pull from for website and git repos";
    };
   
    orgHost = lib.mkOption {
      type = lib.types.str;
      default = "${vars.orgHost}";
      example = "orgname.org";
      description = "Domain name of your organization, points to same VPS as remoteHost";
    };
   
    email = lib.mkOption {
      type = lib.types.str;
      default = "${vars.internetName}@${vars.orgHost}";
      example = "example@example.org";
      description = "Admin email address";
    };
   
    timeZone = lib.mkOption {
      type = lib.types.str;
      default = "America/Vancouver";
      example = "America/Chicago";
      description = "Linux timezone";
    };
   
    ntfySecret = lib.mkOption {
      type = lib.types.str;
      default = "ntfy";
      example = "ntfy-env";
      description = "Name of Ntfy secret for notification handling";
    };
   
    ntfyUrl = lib.mkOption {
      type = lib.types.str;
      default = "ntfy.${config.monorepo.vars.remoteHost}";
      example = "ntfy.nullring.xyz";
      description = "Name of ntfy server";
    };
   
    monitors = lib.mkOption {
      type = lib.types.listOf lib.types.str;
      default = [
        "HDMI-A-1"
        "eDP-1"
        "DP-2"
        "DP-3"
        "DP-4"
        "LVDS-1"
      ];
      example = [];
      description = "Monitors that waybar will use";
    };
  };
}

{ lib, config, pkgs, ... }:
let
  dirContents = builtins.readDir ./.;
  files = lib.filterAttrs (name: type: type == "regular" && lib.hasSuffix ".nix" name && name != "default.nix") dirContents;
in
{
  imports = lib.mapAttrsToList (name: _: ./. + "/${name}") files;

  options = {
    monorepo = {
      profiles = {
        cuda.enable = lib.mkEnableOption "Enables CUDA support";
        documentation.enable = lib.mkEnableOption "Enables documentation on system.";
        secureBoot.enable = lib.mkEnableOption "Enables secure boot. See sbctl.";
        pipewire.enable = lib.mkEnableOption "Enables pipewire low latency audio setup";
        tor.enable = lib.mkEnableOption "Enables tor along with torsocks";
       
        server = {
          enable = lib.mkEnableOption "Enables server services";
          interface = lib.mkOption { type = lib.types.str; default = "eth0"; };
          ipv4 = lib.mkOption { type = lib.types.nullOr lib.types.str; default = null; };
          ipv6 = lib.mkOption { type = lib.types.nullOr lib.types.str; default = null; };
          gateway = lib.mkOption { type = lib.types.nullOr lib.types.str; default = null; };
        };
       
        ttyonly.enable = lib.mkEnableOption "TTY only, no xserver";
        grub.enable = lib.mkEnableOption "Enables grub instead of systemd-boot";
        workstation.enable = lib.mkEnableOption "Enables workstation services";
        desktop.enable = lib.mkEnableOption "Enables everything common to desktops";
        impermanence.enable = lib.mkEnableOption "Enables imperamanence";
        home.enable = lib.mkEnableOption "Enables home profiles";
      };
    };
  };

  config = {
    environment.systemPackages = lib.mkIf config.monorepo.profiles.documentation.enable ((with pkgs; [
      linux-manual
      man-pages
      man-pages-posix
      iproute2
      silver-searcher
      ripgrep
    ]) ++
    (if (config.monorepo.vars.fileSystem == "btrfs") then with pkgs; [
      btrfs-progs
      btrfs-snap
      btrfs-list
      btrfs-heatmap
    ] else []));
   
    boot.loader.grub = lib.mkIf config.monorepo.profiles.grub.enable {
      enable = true;
    };
   
    assertions = [
      {
        assertion = !(config.monorepo.profiles.workstation.enable && config.monorepo.profiles.server.enable);
        message = ''
  You can't enable both workstation and server profile together. Please select only one.
  '';
      }
      {
        assertion = !(config.monorepo.profiles.desktop.enable && config.monorepo.profiles.server.enable);
        message = ''
  You can't enable both desktop and server profile together. Please select only one.
  '';
      }
    ];
    monorepo = {
      profiles = {
        desktop.enable = lib.mkDefault config.monorepo.profiles.workstation.enable;
        documentation.enable = lib.mkDefault true;
        pipewire.enable = lib.mkDefault true;
        tor.enable = lib.mkDefault true;
        impermanence.enable = lib.mkDefault false;
        server.enable = lib.mkDefault false;
        ttyonly.enable = lib.mkDefault config.monorepo.profiles.server.enable;
        home.enable = lib.mkDefault config.monorepo.profiles.desktop.enable;
      };
    };
  };
}

{ config, ... }:
{
  sops = {
    defaultSopsFile = if config.monorepo.profiles.server.enable
                      then ../secrets/vps_secrets.yaml
                      else ../secrets/secrets.yaml;
                     
                     
    templates = if config.monorepo.profiles.server.enable then {
      "matterbridge" = {
        owner = "matterbridge";
        content = ''
  [irc.myirc]
  Server="127.0.0.1:6667"
  Nick="bridge"
  RemoteNickFormat="[{PROTOCOL}] <{NICK}> "
  UseTLS=false

  [telegram.mytelegram]
  Token="${config.sops.placeholder.telegram_token}"
  RemoteNickFormat="<({PROTOCOL}){NICK}> "
  MessageFormat="HTMLNick :"
  QuoteFormat="{MESSAGE} (re @{QUOTENICK}: {QUOTEMESSAGE})"
  QuoteLengthLimit=46
  IgnoreMessages="^/"

  [discord.mydiscord]
  Token="${config.sops.placeholder.discord_token}"
  Server="Null Identity"
  AutoWebHooks=true
  RemoteNickFormat="[{PROTOCOL}] <{NICK}> "
  PreserveThreading=true

  [[gateway]]
  name="gateway1"
  enable=true

  [[gateway.inout]]
  account="irc.myirc"
  channel="#nullring"

  [[gateway.inout]]
  account="discord.mydiscord"
  channel="ID:996282946879242262"

  [[gateway.inout]]
  account="telegram.mytelegram"
  channel="-5290629325"
  '';
      };
    } else {};
   
    age = {
      keyFile = "/home/${config.monorepo.vars.userName}/.config/sops/age/keys.txt";
    };
   
    secrets = if config.monorepo.profiles.desktop.enable then {
      mail = {
        format = "yaml";
      };
      cloudflare-dns = {
        format = "yaml";
      };
      digikey = {
        format = "yaml";
      };
      dn42 = {
        format = "yaml";
      };
    } else (if config.monorepo.profiles.server.enable then {
      znc = {
        format = "yaml";
      };
     
      znc_password_salt = {
        format = "yaml";
      };
     
      znc_password_hash = {
        format = "yaml";
      };
     
      matrix_bridge = {
        format = "yaml";
      };
     
      mail_password = {
        format = "yaml";
        owner = "maddy";
      };
     
      mail_monorepo_password_pi = {
        format = "yaml";
        owner = "public-inbox";
      };
     
      mautrix_env = {
        format = "yaml";
      };
     
      telegram_token = {
        format = "yaml";
      };
     
      discord_token = {
        format = "yaml";
      };
     
      mpd_password = {
        format = "yaml";
        owner = "nginx";
      };
    } else {});
  };
}

{ config, ... }:
{
  services.xserver = {
    enable = (! config.monorepo.profiles.ttyonly.enable);
    displayManager = {
      startx.enable = (! config.monorepo.profiles.ttyonly.enable);
    };
   
    desktopManager = {
      runXdgAutostartIfNone = true;
    };
   
    videoDrivers = (if config.monorepo.profiles.cuda.enable then [ "nvidia" ] else []);
  };
}

{ lib, ... }:
{
  virtualisation = {
    oci-containers = {
      backend = "podman";
      containers = {};
    };
    containers.enable = lib.mkDefault false;
    podman = {
      enable = lib.mkDefault false;
      dockerCompat = true;
      defaultNetwork.settings.dns_enabled = true;
    };
  };
}

{ lib, config, ... }:
{
  services.pipewire = {
    enable = lib.mkDefault config.monorepo.profiles.pipewire.enable;
    alsa = {
      enable = lib.mkDefault config.monorepo.profiles.pipewire.enable;
      support32Bit = true;
    };
    pulse.enable = lib.mkDefault config.monorepo.profiles.pipewire.enable;
    jack.enable = lib.mkDefault config.monorepo.profiles.pipewire.enable;
    wireplumber.enable = lib.mkDefault config.monorepo.profiles.pipewire.enable;
   
    extraConfig = {
      pipewire."92-clock" = {
        "context.properties" = {
          "default.clock.rate" = 48000;
          "default.clock.allowed-rates" = [ 48000 ];
         
          "default.clock.quantum" = 2048;
          "default.clock.min-quantum" = 1024;
          "default.clock.max-quantum" = 4096;
         
          "default.clock.quantum-limit" = 8192;
        };
      };
     
      pipewire-pulse."92-obs-very-stable" = {
        "pulse.properties" = {
          "pulse.min.req" = "1024/48000";
          "pulse.default.req" = "2048/48000";
          "pulse.max.req" = "4096/48000";
         
          "pulse.min.quantum" = "512/48000";
          "pulse.max.quantum" = "4096/48000";
        };
       
        "stream.properties" = {
          "node.latency" = "2048/48000";
          "node.max-latency" = "4096/48000";
          "resample.quality" = 10;
        };
      };
    };
  };
}

{ config, lib, ... }:
{
  services.openssh = {
    enable = true;
    settings = {
      PasswordAuthentication = false;
      AllowUsers = [ config.monorepo.vars.userName "git" ];
      PermitRootLogin = "no";
      KbdInteractiveAuthentication = false;
    };
  };
  networking.firewall.allowedTCPPorts = lib.mkIf config.services.openssh.enable [ 22 ];
}

{ config, lib, ... }:
{
  services.tor = {
    enable = lib.mkDefault config.monorepo.profiles.tor.enable;
    openFirewall = true;
    client = {
      enable = lib.mkDefault config.monorepo.profiles.tor.enable;
      socksListenAddress = {
        IsolateDestAddr = true;
        addr = "127.0.0.1";
        port = 9050;
      };
      dns.enable = true;
    };
    torsocks = {
      enable = lib.mkDefault config.monorepo.profiles.tor.enable;
      server = "127.0.0.1:9050";
    };
  };
}

{ config, lib, ... }:
{
  services.kubo = {
    enable = lib.mkDefault config.monorepo.profiles.workstation.enable;
    autoMount = false;
    enableGC = true;
    settings = {
      Addresses.API = [
        "/ip4/127.0.0.1/tcp/5001"
      ];
      Bootstrap = [
        "/ip4/128.199.219.111/tcp/4001/ipfs/QmSoLSafTMBsPKadTEgaXctDQVcqN88CNLHXMkTNwMKPnu"
        "/ip4/162.243.248.213/tcp/4001/ipfs/QmSoLueR4xBeUbY9WZ9xGUUxunbKWcrNFTDAadQJmocnWm"
      ];
      Datastore = {
        StorageMax = "20GB";
      };
    };
  };
}

{ lib, ... }:
{
  services.i2pd = {
    enable = lib.mkDefault false;
    address = "0.0.0.0";
    inTunnels = {
    };
    outTunnels = {
    };
  };
}

{ lib, ... }:
{
  services.icecast = {
    enable = lib.mkDefault false;
    listen.address = "0.0.0.0";
    extraConfig = ''
  <mount type="default">
    <public>0</public>
    <intro>/stream.m3u</intro>
    <max-listener-duration>3600</max-listener-duration>
    <authentication type="url">
      <option name="mount_add" value="http://auth.example.org/stream_start.php"/>
    </authentication>
    <http-headers>
      <header name="foo" value="bar" />
    </http-headers>
  </mount>
  '';
  };
}

{ config, lib, ... }:
let
  livekitListenPort = 8443;
  # secrets.yaml
  livekit_secret = "livekit_secret";
  conduit_secret = "conduit_secrets";
in
{
  sops.secrets = lib.mkIf config.services.matrix-conduit.enable {
    "${livekit_secret}" = lib.mkIf config.services.livekit.enable {
      format = "yaml";
      mode = "0444";
    };
   
    "${conduit_secret}" = {
      format = "yaml";
    };
  };

  services.matrix-conduit = {
    enable = lib.mkDefault config.monorepo.profiles.server.enable;
    secretFile = "/run/secrets/${conduit_secret}";
    settings.global = {
      server_name = "matrix.${config.monorepo.vars.orgHost}";
      trusted_servers = [
        "matrix.org"
        "nixos.org"
        "conduit.rs"
      ];
      address = "0.0.0.0";
      port = 6167;
      allow_registration = false;
    };
  };


  services.livekit = {
    enable = lib.mkDefault (config.services.matrix-conduit.enable || config.services.matrix-synapse.enable);
    keyFile = "/run/secrets/${livekit_secret}";
    settings = {
      port = 7880;
      turn = {
        enabled = true;
        domain = "livekit.${config.monorepo.vars.orgHost}";
        cert_file = "/var/lib/acme/livekit.${config.monorepo.vars.orgHost}/fullchain.pem";
        key_file = "/var/lib/acme/livekit.${config.monorepo.vars.orgHost}/key.pem";
        tls_port = 5349;
        udp_port = 3478;
      };
     
      rtc = {
        use_external_ip = true;
        tcp_port = 7881;
        udp_port = 7882;
        port_range_start = 50000;
        port_range_end = 60000;
      };
    };
  };

  services.lk-jwt-service = {
    enable = lib.mkDefault config.services.livekit.enable;
    port = 6495;
    livekitUrl = "wss://livekit.${config.monorepo.vars.orgHost}";
    keyFile = "/run/secrets/${livekit_secret}";
  };

  # TODO: split into conduit and livekit
  networking.firewall.allowedTCPPorts = lib.mkIf config.services.matrix-conduit.enable [ 8448 7881 5349 livekitListenPort ];

  # this is fine though
  networking.firewall.allowedUDPPorts = lib.mkIf config.services.livekit.enable [ 7882 3478 ];
  networking.firewall.allowedUDPPortRanges = lib.mkIf config.services.livekit.enable [
    { from = 49152; to = 65535; }
  ];

  networking.domains.subDomains."matrix.${config.monorepo.vars.orgHost}" = lib.mkIf config.services.matrix-conduit.enable {};
  networking.domains.subDomains."livekit.${config.monorepo.vars.orgHost}" = lib.mkIf config.services.livekit.enable {};

  services.nginx.virtualHosts."matrix.${config.monorepo.vars.orgHost}" = lib.mkIf config.services.matrix-conduit.enable {
    enableACME = lib.mkDefault config.monorepo.profiles.server.enable;
    forceSSL = true;
    listen = [
      {
        addr = "0.0.0.0";
        port = 443;
        ssl = true;
      }
      {
        addr = "[::]";
        port = 443;
        ssl = true;
      }
      {
        addr = "0.0.0.0";
        port = 8448;
        ssl = true;
      }
      {
        addr = "[::]";
        port = 8448;
        ssl = true;
      }
    ];
    locations."/_matrix/" = {
      proxyPass = "http://127.0.0.1:${toString config.services.matrix-conduit.settings.global.port}";
      extraConfig = ''
              proxy_set_header Host $host;
              proxy_buffers 32 16k;
              proxy_read_timeout 5m;
            '';
    };
   
    locations."= /.well-known/matrix/server" = {
      extraConfig = ''
        default_type application/json;
        add_header Content-Type application/json;
        add_header Access-Control-Allow-Origin *;
      '';
      
      return = ''200 '{"m.server": "matrix.${config.monorepo.vars.orgHost}:443"}' ''; 
    };
   
    locations."/.well-known/matrix/client" = {
      extraConfig = ''
      default_type application/json;
      add_header Access-Control-Allow-Origin *;
    '';
     
      return = "200 '{\"m.homeserver\": {\"base_url\": \"https://matrix.${config.monorepo.vars.orgHost}\"}, \"org.matrix.msc4143.rtc_foci\": [{\"type\": \"livekit\", \"livekit_service_url\": \"https://matrix.${config.monorepo.vars.orgHost}:${toString livekitListenPort}\"}]}'";
    };
   
    extraConfig = ''
            merge_slashes off;
          '';
  };


  services.nginx.virtualHosts."matrix.${config.monorepo.vars.orgHost}-livekit" = lib.mkIf config.services.livekit.enable {
    serverName = "matrix.${config.monorepo.vars.orgHost}";
    listen = [
      { 
        addr = "0.0.0.0"; 
        port = livekitListenPort;
        ssl = true; 
      }
      {
        addr = "[::]";
        port = livekitListenPort;
        ssl = true;
      }
    ];
    addSSL = true;
    enableACME = false;
    forceSSL = false;
    useACMEHost = "matrix.${config.monorepo.vars.orgHost}";
    
    locations."/" = {
      proxyPass = "http://127.0.0.1:${toString config.services.lk-jwt-service.port}"; 
      proxyWebsockets = true;
      extraConfig = ''
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
      '';
    };
  };

  services.nginx.virtualHosts."livekit.${config.monorepo.vars.orgHost}" = lib.mkIf config.services.livekit.enable {
    enableACME = true;
    forceSSL = true;
    locations."/" = {
      proxyPass = "http://127.0.0.1:${toString config.services.livekit.settings.port}";
      proxyWebsockets = true;
      extraConfig = ''
              proxy_read_timeout 3600s;
              proxy_send_timeout 3600s;
       
              # Standard headers for LiveKit
              proxy_set_header Host $host;
              proxy_set_header X-Real-IP $remote_addr;
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $scheme;
              proxy_set_header Upgrade $http_upgrade;
              proxy_set_header Connection "upgrade";
       
              # --- CORS CONFIGURATION START ---
              # 1. Allow all origins (including app.element.io)
              add_header 'Access-Control-Allow-Origin' '*' always;
              
              # 2. Allow specific methods (POST is required for /sfu/get)
              add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE' always;
              
              # 3. Allow headers (Content-Type is crucial for JSON)
              add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
              
              # 4. Handle the OPTIONS preflight request immediately
              if ($request_method = 'OPTIONS') {
                 add_header 'Access-Control-Allow-Origin' '*' always;
                 add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE' always;
                 add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
                 add_header 'Access-Control-Max-Age' 1728000;
                 add_header 'Content-Type' 'text/plain; charset=utf-8';
                 add_header 'Content-Length' 0;
                 return 204;
                  }
              # --- CORS CONFIGURATION END ---
            '';
    };
  };
}

{ lib, config, ... }:
{
  services.gotosocial = {
    enable = lib.mkDefault false;
    setupPostgresqlDB = true;
    settings = {
      application-name = "Nullring GoToSocial Instance";
      host = "gotosocial.${config.monorepo.vars.orgHost}";
      protocol = "https";
      bind-address = "127.0.0.1";
      port = 8080;
    };
  };
}

{ ... }:
{
  # enable = lib.mkDefault config.monorepo.profiles.server.enable;
  # registrationUrl = "localhost";

  # settings = {
  #   homeserver.url = "https://matrix.nullring.xyz";
  #   homserver.domain = "matrix.nullring.xyz";
  # };
}

{ lib, config, ... }:
{
  services.gitolite = {
    enable = lib.mkDefault config.monorepo.profiles.server.enable;
    description = "My Gitolite User";
    adminPubkey = config.monorepo.vars.sshKey;
  };
}

{ lib, config, ... }:
{
  services.matterbridge = {
    enable = lib.mkDefault config.monorepo.profiles.server.enable;
    configPath = "${config.sops.templates.matterbridge.path}";
  };
}

{ config, lib, pkgs, ... }:
{
  services.open-webui = {
    enable = lib.mkDefault config.services.ollama.enable;
    port = 11111;
    host = "127.0.0.1";
    environment = {
      OLLAMA_API_BASE_URL = "http://127.0.0.1:11434";
      # Disable authentication
      WEBUI_AUTH = "False";
    };
  };

  services.ollama = {
    enable = lib.mkDefault config.monorepo.profiles.desktop.enable;
    package = if (config.monorepo.profiles.cuda.enable) then pkgs.ollama-cuda else pkgs.ollama-vulkan;
    loadModels = if (config.monorepo.profiles.cuda.enable) then [
    ] else [
    ];
    host = "0.0.0.0";
    openFirewall = true;
  };
}

{ config, lib, ... }:
{
  services.bitcoind."${config.monorepo.vars.userName}" = {
    enable = lib.mkDefault false;
    prune = 10000;
  };
}

{ config, lib, ... }:
{
  services.gitDaemon = {
    enable = lib.mkDefault config.monorepo.profiles.server.enable;
    exportAll = true;
    basePath = "${config.users.users.git.home}";
  };
  networking.firewall.allowedTCPPorts = lib.mkIf config.services.gitDaemon.enable [
    9418
  ];
}

{ pkgs, lib, config, ... }:
let
  serverName = "${config.monorepo.vars.ntfyUrl}";
  port = 2586;
  ntfySecret = config.monorepo.vars.ntfySecret;
in
{
  sops.secrets."${ntfySecret}" = lib.mkIf config.services.ntfy-sh.enable {
    format = "yaml";
    owner = "ntfy-sh";
    sopsFile = ../secrets/common_secrets.yaml;
  };

  services.ntfy-sh = {
    enable = lib.mkDefault config.monorepo.profiles.server.enable;
    settings = {
      base-url = "https://${serverName}";
      listen-http = "127.0.0.1:${toString port}";
      envrionmentFile = "/run/secrets/${ntfySecret}";
      auth-file = "/var/lib/ntfy-sh/user.db";
      auth-default-access = "deny-all";
      enable-login = true;
    };
  };

  services.nginx.enable = config.services.ntfy-sh.enable;

  systemd.services.ntfy-sh = lib.mkIf config.services.ntfy-sh.enable {
    serviceConfig = {
      EnvironmentFile = "/run/secrets/${ntfySecret}";
    };
    postStart = lib.mkForce ''
        # 1. Wait for the server to initialize the database
        echo "Waiting for ntfy auth database to appear..."
        TIMEOUT=30
        while [ ! -f /var/lib/ntfy-sh/user.db ]; do
          sleep 1
          TIMEOUT=$((TIMEOUT-1))
          if [ $TIMEOUT -le 0 ]; then
            echo "Timed out waiting for database creation!"
            exit 1
          fi
        done
        
        echo "Database found. Configuring admin user..."
     
        # 2. Define the username
        ADMIN_USER="ret2pop"
     
        # 3. Check if user exists, create if missing
        # We pipe the password twice because 'ntfy user add' asks for confirmation
        if ! ${pkgs.ntfy-sh}/bin/ntfy user list | grep -q "$ADMIN_USER"; then
          echo "Creating admin user $ADMIN_USER..."
          printf "$ADMIN_PASSWORD\n$ADMIN_PASSWORD" | \
            ${pkgs.ntfy-sh}/bin/ntfy user add --role=admin "$ADMIN_USER"
          echo "User created."
        else
          echo "Admin user already exists."
        fi
      '';
  };

  networking.domains.subDomains."${serverName}" = lib.mkIf config.services.ntfy-sh.enable {};
  services.nginx.virtualHosts."${serverName}" = lib.mkIf config.services.ntfy-sh.enable {
    serverName = "${serverName}";
    enableACME = true;
    forceSSL = true;
    locations."/" = {
      proxyPass = "http://127.0.0.1:${toString port}";
      proxyWebsockets = true;
      extraConfig = ''
  proxy_buffering off;
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
  '';
    };
  };
}

{ pkgs, config, lib, monorepoSelf ? null, ... }:
{
  services.nginx = {
    enable = lib.mkDefault config.monorepo.profiles.server.enable;
    user = "nginx";
    recommendedGzipSettings = true;
    recommendedOptimisation = true;
    recommendedBrotliSettings = true;
    recommendedTlsSettings = true;
    recommendedProxySettings = false;
    virtualHosts = {
      "${config.monorepo.vars.remoteHost}" = lib.mkIf (monorepoSelf != null) {
        serverName = "${config.monorepo.vars.remoteHost}";
        serverAliases = [ "${config.monorepo.vars.internetName}.${config.monorepo.vars.orgHost}" ];
        root = "${monorepoSelf.packages.${pkgs.system}.website}";
        addSSL = true;
        enableACME = true;
        quic = true;
       
        locations."/" = {
          extraConfig = ''
  add_header Cache-Control "no-cache, must-revalidate";
  add_header Alt-Svc 'h3=":443"; ma=86400';
  include ${monorepoSelf.packages.${pkgs.system}.website}/csp_header.conf;
  expires off;
      '';
        };
       
        locations."~* \\.(?:woff2|ttf|otf|eot|woff|ico|css|js|gif|jpe?g|png|svg|mp3|mp4|iso|webmanifest)$" = {
          extraConfig = ''
  add_header Cache-Control "public, max-age=31536000, immutable";
  add_header Alt-Svc 'h3=":443"; ma=86400';
  include ${monorepoSelf.packages.${pkgs.system}.website}/csp_header.conf;
  access_log off;
      '';
        };
        extraConfig = ''
  rewrite ^/graph_view/?(.*)$ https://graph.${config.monorepo.vars.remoteHost}/$1 permanent;
  error_page 404 /404.html;
  '';
      };
     
      # the port comes from ssh tunnelling
      "music.${config.monorepo.vars.remoteHost}" = lib.mkIf config.monorepo.profiles.server.enable {
        addSSL = true;
        enableACME = true;
        basicAuthFile = config.sops.secrets."mpd_password".path;
        locations."/" = {
          proxyPass = "http://localhost:8000";
          extraConfig = ''
  proxy_buffering off;
  proxy_http_version 1.1;
  proxy_set_header Connection "";
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_read_timeout 36000s;
  '';
        };
      };
     
      "${config.monorepo.vars.orgHost}" = {
        serverName = "${config.monorepo.vars.orgHost}";
        root = "/var/www/nullring/";
        addSSL = true;
        enableACME = true;
      };
     
      "graph.${config.monorepo.vars.remoteHost}" = lib.mkIf (monorepoSelf != null) {
        serverName = "graph.${config.monorepo.vars.remoteHost}";
        root = "${monorepoSelf.packages.${pkgs.system}.website}";
        addSSL = true;
        enableACME = true;
        quic = true;
        locations."/" = {
          extraConfig = ''
  add_header Alt-Svc 'h3=":443"; ma=86400';
  rewrite ^/$ /graph_view/index.html break;
  '';
        };
      };
    };
  };

  networking.firewall.allowedTCPPorts = lib.mkIf config.services.nginx.enable [ 80 443 ];
  networking.firewall.allowedUDPPorts = lib.mkIf config.services.nginx.enable [ 443 ];

  networking.domains.subDomains = lib.mkIf config.services.nginx.enable {
    "${config.monorepo.vars.remoteHost}" = {};
    "${config.monorepo.vars.orgHost}" = {};
    "${config.monorepo.vars.internetName}.${config.monorepo.vars.orgHost}" = {};
    "music.${config.monorepo.vars.remoteHost}" = {};
    "graph.${config.monorepo.vars.remoteHost}" = {};
  };
}

{ lib, config, ... }:
let
  serverName = "git.${config.monorepo.vars.orgHost}";
in
{
  services.cgit."my-projects" = {
    enable = lib.mkDefault config.monorepo.profiles.server.enable;
    scanPath = "${config.users.users.git.home}"; 
    settings = {
      root-title = "Nullring Git Server";
      root-desc = "Projects and cool things";
      enable-commit-graph = 1;
      enable-log-filecount = 1;
      enable-log-linecount = 1;
      enable-index-owner = 0;
      clone-prefix = "https://${serverName}";
      enable-tree-linenumbers = 1;
      strict-export = "git-daemon-export-ok";
    };
    gitHttpBackend = {
      enable = true;
      checkExportOkFiles = true;
    };
    nginx = {
      virtualHost = "${serverName}";
    };
  };

  networking.domains.subDomains."${serverName}" = lib.mkIf config.services.cgit."my-projects".enable {};
  services.nginx.virtualHosts."${serverName}" = lib.mkIf config.services.cgit."my-projects".enable {
    forceSSL = true;
    enableACME = true;
  };
}

{ config, lib, pkgs, ... }:
{
  hardware = {
    graphics.extraPackages = (if config.monorepo.profiles.cuda.enable
                              then with pkgs; [
                                libva-vdpau-driver
                                libvdpau-va-gl
                                nvidia-vaapi-driver
                              ] else []);
                             
    nvidia = {
      modesetting.enable = lib.mkDefault config.monorepo.profiles.cuda.enable;
      powerManagement = {
        enable = lib.mkDefault config.monorepo.profiles.cuda.enable;
        finegrained = false;
      };
      open = config.monorepo.profiles.cuda.enable;
      package = config.boot.kernelPackages.nvidiaPackages.stable;
      nvidiaSettings = false;
    };
  };
}

{ config, pkgs, ... }:
{
  environment.systemPackages = (if config.monorepo.profiles.cuda.enable then with pkgs; [
    cudatoolkit
    cudaPackages.cudnn
    cudaPackages.libcublas
    linuxPackages.nvidia_x11
  ] else []);
}

{ lib, config, options, pkgs, ... }:
let
  emailServerName = "mail.${config.monorepo.vars.orgHost}";
  serverName = "list.${config.monorepo.vars.orgHost}";
  password_path = "mail_monorepo_password";
in
{
  sops = lib.mkIf config.services.maddy.enable {
    secrets = {
      "${password_path}" = {
        format = "yaml";
        owner = "maddy";
      };
    };
    templates = lib.mkIf config.services.public-inbox.enable {
      "public-inbox-git-credentials" = {
        owner = "public-inbox";
        group = "public-inbox";
        mode = "0400";
        content = (builtins.concatStringsSep "\n" (builtins.map (x: 
          "imaps://${x}%40${config.monorepo.vars.orgHost}:${config.sops.placeholder."mail_monorepo_password_pi"}@${emailServerName}"
        ) config.monorepo.vars.projects)) + "\nimaps://discussion%40${config.monorepo.vars.orgHost}:${config.sops.placeholder."mail_monorepo_password_pi"}@${emailServerName}";
      };
     
      "public-inbox-netrc" = {
        owner = "public-inbox";
        group = "public-inbox";
        mode = "0400";
        content = (builtins.concatStringsSep "\n" (builtins.map (x: "machine ${emailServerName} login ${x}%40${config.monorepo.vars.orgHost} password ${config.sops.placeholder."mail_monorepo_password_pi"}") config.monorepo.vars.projects)) + ''
  machine ${emailServerName} login discussion%40${config.monorepo.vars.orgHost} password ${config.sops.placeholder."mail_monorepo_password_pi"}'';
      };
    };
  };

  services.maddy = {
    enable = lib.mkDefault config.monorepo.profiles.server.enable;
    openFirewall = true;
    hostname = "${config.monorepo.vars.orgHost}";
    primaryDomain = "mail.${config.monorepo.vars.orgHost}";
    localDomains = [
      "$(primary_domain)"
      "${config.monorepo.vars.orgHost}"
    ];
    tls = {
      loader = "file";
      certificates = [
        {
          keyPath = "/var/lib/acme/mail.${config.monorepo.vars.orgHost}/key.pem";
          certPath = "/var/lib/acme/mail.${config.monorepo.vars.orgHost}/fullchain.pem";
        }
      ];
    };
    config = builtins.replaceStrings [
      "imap tcp://0.0.0.0:143"
      "submission tcp://0.0.0.0:587"
    ] [
      "imap tls://0.0.0.0:993 tcp://0.0.0.0:143"
      "submission tls://0.0.0.0:465 tcp://0.0.0.0:587"
    ] options.services.maddy.config.default;
   
    ensureAccounts = (builtins.map (x: "${x}@${config.monorepo.vars.orgHost}") config.monorepo.vars.projects) ++ [
      "${config.monorepo.vars.internetName}@${config.monorepo.vars.orgHost}"
      "discussion@${config.monorepo.vars.orgHost}"
    ];
    ensureCredentials = lib.genAttrs config.services.maddy.ensureAccounts (_: {
      passwordFile = "/run/secrets/${password_path}";
    }) // {
      "${config.monorepo.vars.internetName}@${config.monorepo.vars.orgHost}" = {
        passwordFile = "/run/secrets/mail_password";
      };
    };
  };

  systemd.tmpfiles.rules = [
    "C+ /var/lib/public-inbox/style.css 0644 public-inbox public-inbox - ${../data/public-inbox.css}"
  ];
  systemd.services.public-inbox-httpd = if config.monorepo.profiles.server.enable then {
    preStart = ''
      # Copy or link the file. 
      # Using 'cp' is often safer for sandboxed services than linking to the store. Lol.
      cp -f ${../data/public-inbox.css} /var/lib/public-inbox/style.css
      chmod 644 /var/lib/public-inbox/style.css
    '';
    
    serviceConfig = {
      BindPaths = [ 
        "/var/lib/public-inbox" 
        "${config.users.users.git.home}"
      ];
      ReadOnlyPaths = [ "/var/lib/public-inbox/style.css" ];
      ReadWritePaths = [ "/var/lib/public-inbox" ];
    };
  } else {};

  systemd.services.public-inbox-watch = if config.services.public-inbox.enable then {
    after = [ "sops-nix.service" ];
    confinement.enable = lib.mkForce false;
    path = [ pkgs.git ];
    preStart = ''
mkdir -p /var/lib/public-inbox/.tmp
chmod 0700 /var/lib/public-inbox/.tmp
ln -sfn ${config.sops.templates."public-inbox-netrc".path} /var/lib/public-inbox/.netrc
export HOME=/var/lib/public-inbox
git config --global credential.helper "store --file /run/secrets/rendered/public-inbox-git-credentials"
'';
    environment = {
      PUBLIC_INBOX_FORCE_IPV4 = "1";
      NETRC = config.sops.templates."public-inbox-netrc".path;
      HOME = "/var/lib/public-inbox";
      TMPDIR = "/var/lib/public-inbox/.tmp";
      GIT_TERMINAL_PROMPT = "0";
      GIT_CONFIG_COUNT = "1";
      GIT_CONFIG_KEY_0 = "credential.helper";
      GIT_CONFIG_VALUE_0 = "store --file /run/secrets/rendered/public-inbox-git-credentials";
    };
   
    serviceConfig = {
      RestrictSUIDSGID = lib.mkForce false;
      ReadWritePaths = [ "/var/lib/public-inbox" ];
      RestrictAddressFamilies = lib.mkForce [ "AF_UNIX" "AF_INET" "AF_INET6" ];
      PrivateNetwork = lib.mkForce false;
      SystemCallFilter = lib.mkForce [];
      RootDirectory = lib.mkForce "";
     
      CapabilityBoundingSet = lib.mkForce [ "~" ];
      UMask = lib.mkForce "0022";
      ProtectSystem = lib.mkForce false;
    };
  } else {};

  services.public-inbox = {
    enable = lib.mkDefault config.services.maddy.enable;
    settings = {
      coderepo = lib.genAttrs config.monorepo.vars.projects (name: {
        dir = "${config.users.users.git.home}/${name}.git";
        # works even if no cgit server running here, this is just the default
        cgitUrl = "https://git.${config.monorepo.vars.orgHost}/${name}.git";
      });
      publicinbox.css = ["/var/lib/public-inbox/style.css"];
      publicinbox.wwwlisting = "all";
    };
    http = {
      enable = true;
      port = 9090;
    };
    inboxes = lib.genAttrs config.monorepo.vars.projects (name: {
      description = "discussion of the ${name} project.";
      address = [ "${name}@${config.monorepo.vars.orgHost}" ];
      inboxdir = "/var/lib/public-inbox/${name}";
      url = "https://list.${config.monorepo.vars.orgHost}/${name}";
      watch = [ "imaps://${name}%40${config.monorepo.vars.orgHost}@${emailServerName}/INBOX" ];
      coderepo = [ "${name}" ];
    }) // {
      "discussion" = {
        description = "Main Nullring Discussion Mailing List";
        address = [ "discussion@${config.monorepo.vars.orgHost}" ];
        inboxdir = "/var/lib/public-inbox/discuss";
        url = "https://${serverName}/discussion";
        watch = [ "imaps://discussion%40${config.monorepo.vars.orgHost}@${emailServerName}/INBOX" ];
      };
    };
  };

  networking.domains.baseDomains."${config.monorepo.vars.orgHost}" = lib.mkIf config.services.maddy.enable {
    mx.data = [
      {
        preference = 10;
        exchange = "${emailServerName}";
      }
    ];
  };

  networking.domains.subDomains = lib.mkIf config.services.maddy.enable {
    "${serverName}" = {};
    "${emailServerName}" = {};
    "_dmarc.${config.monorepo.vars.orgHost}" = {
      txt = {
        data = "v=DMARC1; p=none";
      };
    };
    "default._domainkey.${config.monorepo.vars.orgHost}" = {
      txt = {
        data = "v=DKIM1; k=rsa; p=${config.monorepo.vars.dkimKey}";
      };
    };
  };

  networking.firewall.allowedTCPPorts = lib.mkIf config.services.maddy.enable [
    143
    465
    587
    993
  ];

  services.nginx.virtualHosts."${serverName}" = lib.mkIf config.services.public-inbox.enable {
    forceSSL = true;
    enableACME = true;
    locations."/" = {
      proxyPass = "http://localhost:${toString config.services.public-inbox.http.port}";
      extraConfig = ''
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
          '';
    };
  };

  services.nginx.virtualHosts."${emailServerName}" = lib.mkIf config.services.maddy.enable {
    serverName = "${emailServerName}";
    root = "/var/www/dummy";
    addSSL = true;
    enableACME = true;
  };

}

{ lib, config, ... }:
{
  services.fail2ban = {
    enable = lib.mkDefault config.monorepo.profiles.server.enable;
    # Ban IP after 5 failures for 1 hour
    maxretry = 5;
    bantime = "1h";
    banaction = "iptables-allports";
    banaction-allports = "iptables-allports";
  };
}

{ lib, config, ... }:
{
  assertions = [
    {
      assertion = (! (config.monorepo.profiles.impermanence.enable && (! (config.monorepo.vars.fileSystem == "btrfs"))));
      message = "Impermanence requires btrfs filesystem.";
    }
  ];

  boot.initrd.postResumeCommands = (if config.monorepo.profiles.impermanence.enable then lib.mkAfter ''
      mkdir /btrfs_tmp
      mount -t btrfs -n -o subvol=/ /dev/mapper/crypted /btrfs_tmp
      if [[ -e /btrfs_tmp/root ]]; then
          mkdir -p /btrfs_tmp/old_roots
          timestamp=$(date --date="@$(stat -c %Y /btrfs_tmp/root)" "+%Y-%m-%-d_%H:%M:%S")
          mv /btrfs_tmp/root "/btrfs_tmp/old_roots/$timestamp"
      fi
   
      delete_subvolume_recursively() {
          IFS=$'\n'
          for i in $(btrfs subvolume list -o "$1" | cut -f 9- -d ' '); do
              delete_subvolume_recursively "/btrfs_tmp/$i"
          done
          btrfs subvolume delete "$1"
      }
   
      for i in $(find /btrfs_tmp/old_roots/ -maxdepth 1 -mtime +30); do
          delete_subvolume_recursively "$i"
      done
   
      btrfs subvolume create /btrfs_tmp/root
      umount -n /btrfs_tmp
    '' else "");
   
  boot.initrd.luks.devices = (if (config.monorepo.vars.fileSystem == "btrfs") then {
    crypted = {
      device = "/dev/disk/by-partlabel/disk-main-luks";
    };
  } else {});

  fileSystems = if (config.monorepo.profiles.impermanence.enable) then {
    "/persistent" = {
      neededForBoot = true;
    };
    "/home" = {
      neededForBoot = true;
    };
  } else {};

  environment.persistence."/persistent" = {
    enable = config.monorepo.profiles.impermanence.enable;
    hideMounts = true;
    directories = [
      "/var/log"
      "/var/lib/bluetooth"
      "/var/lib/nixos"
      "/var/lib/systemd/coredump"
      "/etc/NetworkManager/system-connections"
    ];
    files = [
      "/etc/machine-id"
      { file = "/var/keys/secret_file"; parentDirectory = { mode = "u=rwx,g=,o="; }; }
    ];
    users."${config.monorepo.vars.userName}" = {
      directories = [
        "Downloads"
        "music"
        "Pictures"
        "Documents"
        "Videos"
        "Monero"
        "org"
        "monorepo"
        "soundfont"
        "website_html"
        "ardour"
        "audacity"
        "img"
        "email"
        "projects"
        "secrets"
       
        ".emacs.d"
        ".elfeed"
        ".electrum"
        ".mozilla"
        ".bitmonero"
        ".config"
        ".crypto"
        { directory = ".gnupg"; mode = "0700"; }
        { directory = ".ssh"; mode = "0700"; }
        { directory = ".local/share/keyrings"; mode = "0700"; }
        ".local/share/direnv"
      ];
      files = [
        ".emacs"
      ];
    };
  };
}

{ lib, config, isIntegrationTest, system, ... }:
{
  nixpkgs = lib.mkIf (! isIntegrationTest) {
    hostPlatform = lib.mkDefault system;
    buildPlatform = lib.mkIf (system == "aarch64-linux") (lib.mkDefault "x86_64-linux");
    overlays = [
    ];
    config = {
      allowUnfree = true;
      cudaSupport = lib.mkDefault config.monorepo.profiles.cuda.enable;
    };
    config.permittedInsecurePackages = [
      "python3.13-ecdsa-0.19.1"
      "olm-3.2.16"
    ];
  };
}

{ lib, config, ... }:
{
    services.xserver.windowManager.qtile = {
    enable = lib.mkDefault config.monorepo.profiles.desktop.enable;
   
    extraPackages = python3Packages: with python3Packages; [
      qtile-extras
    ];
  };
}

{ lib, config, ... }:
{
  services.libinput = {
    enable = lib.mkDefault config.monorepo.profiles.desktop.enable;
    mouse = {
      dev = "/dev/input/by-id/usb-047d_80fd-event-mouse";
      scrollMethod = "button";
      scrollButton = 276;
    };
  };
}

{ config, pkgs, lib, system, ... }:
let
  userGroups = [
    "nginx"
    "git"
    "ircd"
    "ngircd"
    "conduit"
    "livekit"
    "matterbridge"
    "maddy"
    "ntfy-sh"
    "public-inbox"
    "plugdev"
  ];
  allDomains = 
    (lib.attrNames config.networking.domains.baseDomains) ++ 
    (lib.attrNames config.networking.domains.subDomains);
   
  prodHosts = map (dom: "${config.monorepo.profiles.server.ipv4} ${dom}") allDomains;
  vmHosts = map (dom: "127.0.0.1 ${dom}") allDomains;
in
{
  environment.etc."wpa_supplicant.conf".text = ''
  country=CA
  '';
  systemd.tmpfiles.rules = [
    "d /srv/git 0755 git git -"
  ];

  zramSwap = {
    enable = true;
    algorithm = "zstd";
    memoryPercent = lib.mkDefault 50;
  };

  # Shim for testing
  virtualisation.vmVariant = {
    sops.validateSopsFiles = false;
    disko.devices = lib.mkForce {};
   
    virtualisation.forwardPorts = lib.mkIf config.monorepo.profiles.server.enable [
      { from = "host"; host.port = 10443; guest.port = 443; }
      { from = "host"; host.port = 9080; guest.port = 80; }
    ];
   
    virtualisation.useNixStoreImage = false;
   
    virtualisation.sharedDirectories.sops-keys = {
      source = "/home/preston/.config/sops/age";
      target = "/home/preston/.config/sops/age";
    };
   
    networking.extraHosts = lib.mkForce (lib.concatStringsSep "\n" vmHosts);
    networking.defaultGateway = lib.mkForce null;
   
    networking.interfaces.eth0.useDHCP = lib.mkForce true;
   
    fileSystems."/" = lib.mkForce {
      device = "/dev/disk/by-label/nixos";
      fsType = "ext4";
    };
    systemd.services.sops-nix = {
      unitConfig.RequiresMountsFor = "/home/preston/.config/sops/age";
    };
   
    security.acme.defaults.server = lib.mkForce "https://127.0.0.1:14000/dir";
  };

  documentation = {
    enable = lib.mkDefault config.monorepo.profiles.documentation.enable;
    man.enable = lib.mkDefault config.monorepo.profiles.documentation.enable;
    dev.enable = lib.mkDefault config.monorepo.profiles.documentation.enable;
  };

  environment = {
    etc = {
      securetty.text = ''
          # /etc/securetty: list of terminals on which root is allowed to login.
          # See securetty(5) and login(1).
        '';
    };
  };


  systemd.network.enable = lib.mkDefault config.monorepo.profiles.server.enable;
  systemd.network.networks."40-${config.monorepo.profiles.server.interface}" = lib.mkIf config.monorepo.profiles.server.enable {
    matchConfig.Name = "${config.monorepo.profiles.server.interface}";
    networkConfig = {
      IPv6AcceptRA = true;
      IPv6PrivacyExtensions = false;
    };
    ipv6AcceptRAConfig = {
      UseAutonomousPrefix = false;
    };
  };

  systemd = {
    services.NetworkManager-wait-online.enable = false;
    coredump.enable = false;
    network.config.networkConfig.IPv6PrivacyExtensions = "kernel";
    tmpfiles.settings = {
      "restrictetcnixos"."/etc/nixos/*".Z = {
        mode = "0000";
        user = "root";
        group = "root";
      };
    };
  };


  boot = {
    supportedFilesystems = {
      btrfs = true;
      ext4 = true;
    };
   
    extraModprobeConfig = ''
    options snd-usb-audio vid=0x1235 pid=0x8200 device_setup=1
    options rtw88_core disable_lps_deep=y power_save=0 disable_aspm_l1ss=y
    options rtw88_pci disable_msi=y disable_aspm=y
    options rtw_core disable_lps_deep=y
    options rtw_pci disable_msi=y disable_aspm=y
    options rtw89_core disable_ps_mode=y
    options rtw89_pci disable_aspm_l1=y disable_aspm_l1ss=y disable_clkreq=y
    options iwlwifi 11n_disable=8 uapsd_disable=1 bt_coex_active=0 disable_11ax=1 power_save=0
    options brcmfmac roamoff=1 feature_disable=0x82000
  '';
    extraModulePackages = [ ];
   
    initrd = {
      availableKernelModules = [
        "xhci_pci"
        "ahci"
        "usb_storage"
        "sd_mod"
        "nvme"
        "sd_mod"
        "ehci_pci"
        "rtsx_pci_sdmmc"
        "usbhid"
      ];
     
      kernelModules = [ ];
    };
   
    lanzaboote = {
      enable = config.monorepo.profiles.secureBoot.enable;
      pkiBundle = "/var/lib/sbctl";
    };
   
    loader = {
      systemd-boot.enable = lib.mkForce
        (((! config.monorepo.profiles.grub.enable) &&
          (! config.monorepo.profiles.secureBoot.enable)) && (system != "aarch64-linux"));
      efi.canTouchEfiVariables = lib.mkForce (! config.monorepo.profiles.grub.enable);
    };
   
    kernelModules = [
      "snd-seq"
      "snd-rawmidi"
      "xhci_hcd"
      "kvm_intel"
      "af_packet"
      "ccm"
      "ctr"
      "cmac"
      "arc4"
      "ecb"
      "michael_mic"
      "gcm"
      "sha256"
      "sha384"
      "uvcvideo"
    ];
   
    kernelParams = [
      "cfg80211.reg_alpha2=CA"
      "usbcore.autosuspend=-1"
      "pcie_aspm=off"
      "pci=noaer"
      "page_alloc.shuffle=1"
      "slab_nomerge"
     
      # madaidan
      "pti=on"
      "randomize_kstack_offset=on"
      "vsyscall=none"
     
      # cpu
      "spectre_v2=on"
      "spec_store_bypass_disable=on"
      "tsx=off"
      "l1tf=full,force"
      "kvm.nx_huge_pages=force"
     
      # hardened
      "extra_latent_entropy"
     
      # mineral
      "quiet"
    ];
   
    blacklistedKernelModules = [
      "netrom"
      "rose"
     
      "adfs"
      "affs"
      "bfs"
      "befs"
      "cramfs"
      "efs"
      "erofs"
      "exofs"
      "freevxfs"
      "f2fs"
      "hfs"
      "hpfs"
      "jfs"
      "minix"
      "nilfs2"
      "ntfs"
      "omfs"
      "qnx4"
      "qnx6"
      "sysv"
      "ufs"
    ];
   
    kernel.sysctl = if config.monorepo.profiles.server.enable then {
      "net.ipv6.conf.${config.monorepo.profiles.server.interface}.autoconf" = 0;
      "net.ipv6.conf.${config.monorepo.profiles.server.interface}.accept_ra" = 1; 
    } else {
      "kernel.ftrace_enabled" = false;
      "net.core.bpf_jit_enable" = false;
      "kernel.kptr_restrict" = 2;
     
      # madaidan
      "kernel.smtcontrol" = "on";
      "vm.swappiness" = 1;
      "vm.unprivileged_userfaultfd" = 0;
      "dev.tty.ldisc_autoload" = 0;
      "kernel.kexec_load_disabled" = 1;
      "kernel.sysrq" = 4;
      "kernel.perf_event_paranoid" = 3;
     
      # net
      "net.ipv4.ip_forward" = 1;
      "net.ipv4.icmp_echo_ignore_broadcasts" = true;
    };
  };

  networking = {
    interfaces = lib.mkIf config.monorepo.profiles.server.enable {
      "${config.monorepo.profiles.server.interface}" = {
        ipv4.addresses = [
          {
            address = config.monorepo.profiles.server.ipv4;
            prefixLength = 24;
          }
        ];
        ipv6.addresses = [
          {
            address = config.monorepo.profiles.server.ipv6;
            prefixLength = 64;
          }
        ];
        useDHCP = lib.mkForce false;
      };
    };
   
    defaultGateway = lib.mkIf config.monorepo.profiles.server.enable config.monorepo.profiles.server.gateway;
    useDHCP = false;
    tempAddresses = lib.mkIf config.monorepo.profiles.server.enable "disabled";
    extraHosts = lib.mkIf config.monorepo.profiles.server.enable (lib.concatStringsSep "\n" prodHosts);
   
    domains = lib.mkIf config.monorepo.profiles.server.enable {
      enable = true;
      baseDomains = {
        "${config.monorepo.vars.remoteHost}" = {
          a.data = config.monorepo.profiles.server.ipv4;
          aaaa.data = config.monorepo.profiles.server.ipv6;
        };
        "${config.monorepo.vars.orgHost}" = {
          a.data = config.monorepo.profiles.server.ipv4;
          aaaa.data = config.monorepo.profiles.server.ipv6;
          txt = {
            data = "v=spf1 ip4:${config.monorepo.profiles.server.ipv4} ip6:${config.monorepo.profiles.server.ipv6} -all";
          };
        };
      };
    };
   
   
    nameservers = [ "8.8.8.8" "1.1.1.1"];
    dhcpcd.enable = (! config.monorepo.profiles.server.enable);
    networkmanager = {
      enable = lib.mkForce (! config.monorepo.profiles.server.enable); # rpis need network
      wifi = {
        powersave = false;
      };
      ensureProfiles = {
        profiles = {
          home-wifi = {
            connection = {
              id = "TELUS6572";
              permissions = "";
              type = "wifi";
            };
            ipv4 = {
              dns-search = "";
              method = "auto";
            };
            ipv6 = {
              addr-gen-mode = "stable-privacy";
              dns-search = "";
              method = "auto";
            };
            wifi = {
              mac-address-blacklist = "";
              mode = "infrastructure";
              ssid = "TELUS6572";
            };
            wifi-security = {
              auth-alg = "open";
              key-mgmt = "wpa-psk";
              # when someone actually steals my internet then I will be concerned.
              # This password only matters if you actually show up to my house in real life.
              # That would perhaps allow for some nasty networking related shenanigans.
              # I guess we'll cross that bridge when I get there.
              psk = "b4xnrv6cG6GX";
            };
          };
        };
      };
    };
    firewall = {
      allowedTCPPorts = [ 22 11434 ];
      allowedUDPPorts = [ ];
    };
  };

  hardware = {
    wirelessRegulatoryDatabase = true;
    enableAllFirmware = true;
    cpu.intel.updateMicrocode = lib.mkDefault (system == "x86_64-linux");
    graphics.enable = ! config.monorepo.profiles.ttyonly.enable;
   
    bluetooth = {
      enable = lib.mkDefault config.monorepo.profiles.desktop.enable;
      powerOnBoot = lib.mkDefault config.monorepo.profiles.desktop.enable;
    };
  };

  services = {
    pulseaudio.enable = ! config.monorepo.profiles.pipewire.enable;
    chrony = {
      enable = true;
      enableNTS = true;
      servers = [ "time.cloudflare.com" "ptbtime1.ptb.de" "ptbtime2.ptb.de" ];
    };
   
    jitterentropy-rngd.enable = true;
    resolved.settings.Resolve.DNSSEC = true;
    usbguard.enable = false;
    dbus.apparmor = "enabled";
   
    # Misc.
    udev = {
      extraRules = '''';
      packages = if config.monorepo.profiles.workstation.enable then with pkgs; [ 
        platformio-core
        platformio-core.udev
        openocd
      ] else [];
    };
   
    printing.enable = lib.mkDefault config.monorepo.profiles.workstation.enable;
    udisks2.enable = (! config.monorepo.profiles.ttyonly.enable);
  };

  programs = {
    nix-ld.enable = true;
    zsh.enable = true;
    ssh.enableAskPassword = false;
  };

  security = {
    acme = {
      acceptTerms = true;
      defaults.email = "${config.monorepo.vars.internetName}@gmail.com";
    };
    apparmor = {
      enable = true;
      killUnconfinedConfinables = true;
      packages = with pkgs; [
        apparmor-profiles
      ];
    };
   
    pam.loginLimits = [
      { domain = "*"; item = "nofile"; type = "-"; value = "32768"; }
      { domain = "*"; item = "memlock"; type = "-"; value = "32768"; }
    ];
    rtkit.enable = true;
   
    lockKernelModules = true;
    protectKernelImage = true;
   
    allowSimultaneousMultithreading = true;
    forcePageTableIsolation = true;
   
    tpm2 = {
      enable = system != "aarch64-linux";
      pkcs11.enable = true;
      tctiEnvironment.enable = true;
    };
   
    chromiumSuidSandbox.enable = (! config.monorepo.profiles.ttyonly.enable);
    sudo.enable = true;
  };

  xdg.portal = {
    enable = (! config.monorepo.profiles.ttyonly.enable);
    wlr = {
      enable = (! config.monorepo.profiles.ttyonly.enable);
      settings = {
        screencast = {
          chooser_type = "none";
          output_name = "DP-1";
        };
      };
    };
    extraPortals = with pkgs; if (! config.monorepo.profiles.ttyonly.enable) then [
      xdg-desktop-portal-gtk
      xdg-desktop-portal
      xdg-desktop-portal-wlr
    ] else [];
    config.common.default = "*";
  };

  systemd.user.services.xdg-desktop-portal-wlr = {
    serviceConfig = {
      Restart = lib.mkForce "on-failure";
    };
    environment = {
      XDG_CURRENT_DESKTOP = "qtile";
      XDG_SESSION_TYPE = "wayland";
    };
  };

  environment.etc."gitconfig".text = ''
    [init]
    defaultBranch = main
    '';
  environment.extraInit = ''
    umask 0022
    '';
  environment.systemPackages = with pkgs;  [
    restic
    sbctl
    gitFull
    git-lfs-transfer
    vim
    curl
    nmap
    exiftool
    (writeShellScriptBin "new-repo"
      ''
    #!/bin/bash
    cd ${config.users.users.git.home}
    git init --bare "$1"
    vim "$1/description"
    chown -R git:git "$1"
    ''
    )
  ] ++ (if system != "aarch64-linux" then [ git-lfs ] else []);

  users.groups = lib.genAttrs userGroups (_: lib.mkDefault {});

  users.users = lib.genAttrs userGroups (name: {
    isSystemUser = lib.mkDefault true;
    group = "${name}";
    extraGroups = [ "acme" "nginx" ];
  }) // {
    conduit = {
      isSystemUser = lib.mkDefault true;
      group = "conduit";
      extraGroups = [];
    };
    matterbridge = {
      isSystemUser = lib.mkDefault true;
      group = "matterbridge";
      extraGroups = [];
    };
   
    public-inbox = {
      isSystemUser = lib.mkDefault true;
      group = "public-inbox";
     
      extraGroups = [ "acme" "nginx" "git" ];
    };
   
    ircd = {
      isSystemUser = lib.mkDefault true;
      group = "ircd";
      home = "/home/ircd";
    };
    
    nginx = {
      group = "nginx";
      isSystemUser = lib.mkDefault true;
      extraGroups = [ "acme" ];
    };
   
    root.openssh.authorizedKeys.keys = [
      config.monorepo.vars.sshKey
    ];
   
    git = {
      isSystemUser = true;
      home = "/srv/git";
      shell = "/bin/sh";
      group = "git";
      openssh.authorizedKeys.keys = [
        config.monorepo.vars.sshKey
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIEF+mcL9nDkzVhCYyYWCIrP+b6oRiiaV509jywbD0Vq nix-on-droid@localhost"
        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCedJm0yYB0qLah/Y7PqLVgNh6qp+yujssGtuR05KbZLzSnsLUjUMObMyjFB9xTKrSGDqyoMkNe2l5VXMBJ9wBKLbzqMWbkakAWOj7EC/qZ6dFWA075mniwAuWKY/Q8QYohAJbbeU4j0ObWrltd4ar2Ac9vsVyftYF5efg8PEqVdOxzrBn5taY1zCCRjee5ISeRDIovnBbq7x86jsx5VnXTjMN9FZCI2qmz992Sg/PPXpXat+O1YQlG0eBHEny2Ug9gaAYnGOVr6kZKE4lrjz47nrXVXO6lJsNXmuzTVnEgo30DAA3dV4fws/M5ptM5Pgg2qe94HyHWhhmtXOekWmGtP3YxpVe3M/SPl31UL570ZDuuCcpJTsbe90ZyXC3CiSJkLKbmFkfOgZ6DI2LT8KSp09/2NCtZYriLN/nXObn6gQzByGMxVyKNx2hh8ENt9hzTCAk5lYDK3g3wS8eLCY3EH/caEqT9mLZEZeRHtAhtfozo1VJL7sSZ0Zm7wiIxHylwOshh1sYI1gb1MgMqNnrr1t8+8UK+Q0NERQW3yiphG36HXWy/DdCG0EF+N850KbgH1FFur+m+3hZCZCFVp3tGCcOC+bxWMBT3+9yC6LARi5cFjLQaWLsNO5xEs4vqX3+s3QjJ0pAYDkgtoeY2Fbh+imN+JasWn/cSy5p3UdE4ZQ== andrei@kiss"
      ];
    };
    "${config.monorepo.vars.userName}" = {
      openssh.authorizedKeys.keys = [
        config.monorepo.vars.sshKey
      ];
     
      linger = true;
      initialPassword = "${config.monorepo.vars.userName}";
      isNormalUser = true;
      description = config.monorepo.vars.fullName;
      extraGroups = [ "networkmanager" "wheel" "video" "docker" "jackaudio" "tss" "dialout" "docker" "plugdev" ];
      shell = pkgs.zsh;
      packages = [];
    };
  };

  nix = {
    settings = {
      keep-outputs = true;
      keep-derivations = true;
      auto-optimise-store = true;
      max-jobs = 4; 
      cores = 0;
      substituters = [
        "https://cache.nixos-cuda.org"
      ];
      trusted-public-keys = [
        "cache.nixos-cuda.org:74DUi4Ye579gUqzH4ziL9IyiJBlDpMRn9MBN8oNan9M="
      ];
      experimental-features = "nix-command flakes ca-derivations";
      trusted-users = [ "@wheel" ];
    };
    gc.automatic = true;
  };
  time.timeZone = config.monorepo.vars.timeZone;
  i18n.defaultLocale = "en_CA.UTF-8";
  system.stateVersion = "24.11";
}