{ config, lib, pkgs, ... }:

# Vorhandener Laptop, keine dedizierte Neuanschaffung -- Kriterien in
# docs/operator-prompt.md §0 (vorhandene Hardware weiterverwenden,
# Energieverbrauch als Entscheidungskriterium bei Betriebsentscheidungen).
{

  imports =
    [
      ./hardware-configuration.nix
      ../user/builder.nix
      ../globalServices/default.nix
      ./localServices/default.nix
    ];

# printing
  services.printing.enable = true;
  services.printing.drivers = [ pkgs.brlaser ];

# nixos specific
  documentation.nixos.enable = false;
  nixpkgs.config.allowUnfree = true;
  nixpkgs.config.allowUnsupportedSystems = true;
  nix.settings.experimental-features = [ "nix-command" "flakes" ];

# open ports
  networking.firewall.allowedTCPPorts = [8080];

# hostname
  networking.hostName = "tnix"; # Define your hostname.

# wireless  
  networking = {
    wireless.enable = true;
    # The runtime-only file is assembled from the existing external-password
    # file and the pinix hostapd passphrase below.  Do not place either value
    # in this Nix expression or in the Nix store.
    wireless.secretsFile = "/run/tnix-wpa-secrets/secrets.conf";
    #wireless.networks."berlin.freifunk.net" = {};
    wireless.networks.idea.pskRaw = "ext:psk_mango";
    wireless.networks.iPhone = {
      pskRaw = "ext:psk_iphone";
      priority = 10;
    };
    wireless.networks.pinix = {
      pskRaw = "ext:psk_pinix";
      priority = 20;
    };
    #wireless.networks."AM 10.og".pskRaw = "ext:psk_karla";
    interfaces.wlan0.useDHCP = true;

    # Uplink ist der Mango-Router (WLAN `idea`). Dessen WAN ist IPv6-only
    # (Telekom `festip.telekom` via Nokia-Tethering): IPv4 ins Internet
    # gibt es dort nicht, nur NAT64 (64:ff9b::/96) + DNS64 vom Mango.
    #
    # wlan0: `nooption routers` verwirft die per DHCPv4 angebotene
    # Default-Route auf 192.168.8.1. Die wäre ein schwarzes Loch — hinter
    # dem Nokia wird IPv4 still verworfen, was Timeouts statt eines
    # sauberen Fallbacks auf IPv6 erzeugt. Die IPv6-Default-Route kommt
    # weiterhin regulär per Router Advertisement vom Mango.
    #
    # enp0s31f6: ebenfalls nur die IPv4-Default-Route verwerfen. IPv6
    # muss auch über das Mango-Kabel als Internet-Uplink funktionieren.
    interfaces.enp0s31f6.useDHCP = true;
    # Fester Wartungszugang zu pinix, auch ohne Mango/DHCP/Internet.
    # Kein Gateway: der iPhone-Hotspot bleibt der bevorzugte Uplink.
    interfaces.enp0s31f6.ipv4.addresses = [
      { address = "192.168.50.2"; prefixLength = 24; }
    ];
    #
    # Solange der iPhone-Hotspot steht, soll er den Kabel-Uplink schlagen.
    # dhcpcd vergibt von sich aus 1000 + ifindex und legt für WLAN weitere
    # 2000 drauf — enp0s31f6 landet damit auf 1002, wlan0 auf 3003, und der
    # Hotspot bliebe reiner Standby. `metric 4000` dreht die Reihenfolge um;
    # fällt der Hotspot weg, übernimmt das Kabel automatisch wieder. Das
    # greift auch für die IPv6-Default-Route aus dem Router Advertisement,
    # weil dhcpcd die ebenfalls mit der Interface-Metrik installiert.
    dhcpcd.extraConfig = ''
      interface enp0s31f6
      nooption routers
      metric 4000

      interface wlan0
      nooption routers
    '';
  };

  # `pinix-wifi.age` holds the raw passphrase used by hostapd, whereas
  # wpa_supplicant's ext_password_backend expects key=value entries.  Merge
  # it with the pre-existing wireless secrets only in /run, before the exact
  # active supplicant unit starts.  The resulting file is readable only by
  # wpa_supplicant and is explicitly made available through that unit's
  # existing hardening bind mount via networking.wireless.secretsFile.
  systemd.services.tnix-wpa-secrets = {
    description = "Assemble tnix wpa_supplicant external-password file";
    before = [ "wpa_supplicant.service" ];
    requiredBy = [ "wpa_supplicant.service" ];
    restartTriggers = [
      config.age.secrets.wirelessSecretsFile.file
      config.age.secrets.pinixWifi.file
    ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      RuntimeDirectory = "tnix-wpa-secrets";
      RuntimeDirectoryMode = "0750";
      UMask = "0077";
      PrivateTmp = true;
      ProtectHome = true;
      ProtectSystem = "strict";
      ReadWritePaths = [ "/run/tnix-wpa-secrets" ];
    };
    path = [ pkgs.coreutils ];
    script = ''
      set -euo pipefail
      output=/run/tnix-wpa-secrets/secrets.conf
      temporary="$output.tmp"

      chgrp wpa_supplicant /run/tnix-wpa-secrets
      install -m 0400 /dev/null "$temporary"
      cat ${config.age.secrets.wirelessSecretsFile.path} > "$temporary"
      printf '\npsk_pinix=' >> "$temporary"
      cat ${config.age.secrets.pinixWifi.path} >> "$temporary"
      printf '\n' >> "$temporary"
      chown wpa_supplicant:wpa_supplicant "$temporary"
      mv -f "$temporary" "$output"
    '';
  };

  # Secret rotations must rebuild the runtime file and restart the consumer,
  # even though its configured secretsFile path remains stable in /run.
  systemd.services.wpa_supplicant.restartTriggers = [
    config.age.secrets.wirelessSecretsFile.file
    config.age.secrets.pinixWifi.file
  ];

# Keep LAN and WLAN from answering ARP for each other's addresses.
  boot.kernel.sysctl = {
    "net.ipv4.conf.all.arp_ignore" = 1;
    "net.ipv4.conf.all.arp_announce" = 2;
  };

# can build for other chip structures
  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];


# boot
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  boot.kernelParams = [ "quiet" "loglevel=3" ];
  boot.kernelModules = [ "btusb" ];

# hardware
  hardware.bluetooth.enable = true;
  hardware.bluetooth.package = pkgs.bluez;
  hardware.firmware = with pkgs; [ linux-firmware ];

# time
  time.timeZone = "Europe/Berlin";

  i18n.defaultLocale = "en_US.UTF-8";
  i18n.extraLocaleSettings = {
    LC_ADDRESS = "de_DE.UTF-8";
    LC_IDENTIFICATION = "de_DE.UTF-8";
    LC_MEASUREMENT = "de_DE.UTF-8";
    LC_MONETARY = "de_DE.UTF-8";
    LC_NAME = "de_DE.UTF-8";
    LC_NUMERIC = "de_DE.UTF-8";
    LC_PAPER = "de_DE.UTF-8";
    LC_TELEPHONE = "de_DE.UTF-8";
    LC_TIME = "de_DE.UTF-8";
  };

  programs.sway.enable = true;

  console.keyMap = "de";

  environment.variables = {
    EDITOR = "nvim";
    VISUAL = "nvim";
  };
 

  system.stateVersion = "25.11"; # Did you read the comment?


  # Der Mango-Resolver muss DNS64 liefern, darum läuft Tailscale hier mit
  # `--accept-dns=false` (siehe localServices/tailscale.nix). Damit entfällt
  # MagicDNS; die stabilen Tailnet-Namen deshalb lokal auflösen, sonst
  # scheitert `ssh blunix`.
  networking.hosts =
    lib.mapAttrs' (name: ip: lib.nameValuePair ip [ name ]) config.tailnetIPs
    // {
      "fd7a:115c:a1e0:96::1" = [ "git.${config.domain2}" "ereader.${config.domain2}" ];
    };

  # The Git service is exposed by the technical pinix-dns node directly in
  # the common Headscale tailnet. Keep the same host key after removing the
  # temporary isolated tnix identity.
  programs.ssh.knownHosts.git-pinix = {
    hostNames = [ "git.${config.domain2}" ];
    publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBTIBiB9JYYtViI1IKK96pH+x3D63BQQgmZstc8jPBNp";
  };
}