TPX1.nix

# Edit this configuration file to define what should be installed on
# your system.  Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).

{ config, pkgs, ... }:

{
    imports = [ ./hardware-configuration.nix ];

    # Use the systemd-boot EFI boot loader.
    boot.loader.systemd-boot.enable = true;
    boot.loader.efi.canTouchEfiVariables = true;

    boot.extraModulePackages = [ config.boot.kernelPackages.evdi ];
    boot.initrd.kernelModules = [ "evdi" ];

    # Use latest kernel.
    boot.kernelPackages = pkgs.linuxPackages_6_17;

    boot.resumeDevice = "/dev/disk/by-label/swap";
    # Needed for myStream distribution directory creation.
    boot.kernel.sysctl."fs.protected_hardlinks" = false;

    swapDevices = [ { device = "/dev/disk/by-label/swap"; } ];

    networking.networkmanager = {
        enable = true;
        plugins = [ pkgs.networkmanager-openvpn ];
    };
    networking.hostName = "ida";

    # Set your time zone.
    time.timeZone = "Australia/Brisbane";

    # The global useDHCP flag is deprecated, therefore explicitly set to false here.
    # Per-interface useDHCP will be mandatory in the future.
    networking.useDHCP = false;

    # Select internationalisation properties.
    i18n.defaultLocale = "en_US.UTF-8";

    fileSystems."/mnt/az-storage" =
        { device = "//ngv.file.core.windows.net/office";
            fsType = "cifs";
            options = ["nofail" "user" "vers=3.0" "credentials=/home/mounty/NGV/az-storage.cred" "dir_mode=0777" "file_mode=0777" "serverino"];
        };

    fileSystems."/mnt/mymedia" =
        { device = "172.16.47.8:/Media";
            fsType = "nfs";
            options = [ "nofail" "user" "nfsvers=3" "ro" "x-systemd.requires=openvpn-office.service" "x-systemd.automount" "x-systemd.idle-timeout=600" ];
        };

    services.xserver = {
        enable = true;
        videoDrivers = [ "displaylink" ];
        xkb.layout = "us";
    };

    services.desktopManager.gnome.enable = true;

    services.displayManager.gdm.enable = true;

    services.libinput.enable = true;

    services.printing.enable = true;

    nixpkgs.config.allowUnfree = true;
    nixpkgs.config.android_sdk.accept_license = true;

    # Enable sound.
    services.pulseaudio.enable = false;
    services.pipewire = {
        enable = true;
        pulse.enable = true;
    };

    services.httpd = {
        enable = false;
        adminAddr = "[email protected]";
        mpm = "prefork";
        phpPackage = pkgs.php82;
        extraModules = [ "deflate" ];
        enablePHP = true;

        virtualHosts."localhost" = {
            documentRoot = "/home/mounty/vault/vtigercrm";
            extraConfig = ''
                <FilesMatch \.php$>
                    SetHandler "proxy:unix:/run/phpfpm-nextcloud/nextcloud.sock|fcgi://localhost/"
                </FilesMatch>
                <Directory />
                DirectoryIndex index.php
                Require all granted
                </Directory>
            '';
            # want ssl + a let's encrypt certificate? add `forceSSL = true;` right here
        };
    };

    users.users.mounty = {
        description = "Michael Mounteney";
        group = "users";
        uid = 573;
        home = "/home/mounty";
        homeMode = "700";
        shell = pkgs.bash;
        createHome = false;
        extraGroups = [ "wheel" "scanner" "lp" ]; # Enable ‘sudo’ for the user.
    };

    users.groups.trove = {
        gid = 1002;
    };

    # For mystream
    users.users.trove = {
        isNormalUser = true;
        name = "trove";
        description = "Mystream content owner";
        group = "trove";
        uid = 1002;
        createHome = false;
        shell = pkgs.shadow;
    };

    # List packages installed in system profile. To search, run:
    # $ nix search wget
    environment.systemPackages = with pkgs; [
        # hardware and firmware
        displaylink
        pciutils usbutils efibootmgr f2fs-tools glmark2
        # CLI
        nix-index binutils-unwrapped
        mariadb.client postgresql
        file
        powershell
        gnupg unzip zip zlib.dev unrar
        tcpdump
        jq
        tree
        azure-cli
        loki grafana-loki
        # Programming CLI
        gcc15 rustc rustup cargo nodejs jdk openjdk kotlin php83
        jujutsu
        git gh mercurial vim-full subversion fossil
        # python python3Full
        (python312.withPackages(ps: with ps; [
            pip
            setuptools
            psycopg2
            flask-sqlalchemy
            sqlalchemy
            flask
            requests
            websocket-client
            paramiko
        ]))
        jetbrains.idea-ultimate maven gradle spring-boot-cli android-studio-full
        awscli stripe-cli
        # Desktop
        gnome-screenshot
        gnome-tweaks
        shotwell
        gnome-sound-recorder
        gnumeric
        libreoffice
        simplescreenrecorder
        vlc
        tigervnc
        gimp
        ffmpeg
        wine
        anki
        dosbox
        # mystream
        yt-dlp
        # Network CLI
        bind wget curl openssl putty inetutils networkmanager teamviewer x11vnc
        # Documentation
        graphviz
        (pkgs.texlive.combine {
            inherit (pkgs.texlive) scheme-full pgf ;
        })
        # Browsers
        firefox chromium
    ];

    programs.geary.enable = false;

    programs.nix-ld.enable = true;

    services.postgresql = {
        enable = true;
        package = pkgs.postgresql_14;
        dataDir = "/home/postgres";
        enableTCPIP = true;
        initialScript = pkgs.writeText "backend-initScript" ''
            CREATE ROLE mediaman WITH LOGIN PASSWORD 'zem56$W7' CREATEDB;
            CREATE DATABASE mystream;
            GRANT ALL PRIVILEGES ON DATABASE mystream TO mediaman;
            '';
    };

    services.teamviewer.enable = true;

    programs.evolution = {
        enable = true;
        plugins = [ pkgs.evolution-ews ];
    };

    # Some programs need SUID wrappers, can be configured further or are
    # started in user sessions.
    # programs.mtr.enable = true;
    # programs.gnupg.agent = {
    #   enable = true;
    #   enableSSHSupport = true;
    # };
    programs.command-not-found.enable = true;

    services.ntp.enable = true;

    services.openssh = {
        enable = true;
        settings = {
            PasswordAuthentication = false;
        };
        ports = [ 3887 ];
    };

    systemd.services.dlm.wantedBy = [ "multi-user.target" ];

    # Open ports in the firewall.
    # networking.firewall.allowedTCPPorts = [ ... ];
    # networking.firewall.allowedUDPPorts = [ ... ];
    # Or disable the firewall altogether.
    networking.firewall.enable = false;

    # Enables deployment of Kitten to Azure with private net and DNS
    networking.extraHosts = ''
10.245.0.10 ngv-rabbit.azurewebsites.net ngv-rabbit.scm.azurewebsites.net
10.245.0.9  ngv-kitten.azurewebsites.net ngv-kitten.scm.azurewebsites.net
10.245.0.8  wifi-hotspot.azurewebsites.net wifi-hotspot.scm.azurewebsites.net
10.245.0.7  wifi-hotspot-admin.azurewebsites.net wifi-hotspot-admin.scm.azurewebsites.net
10.245.0.4  5p.azurewebsites.net 5p.scm.azurewebsites.net
172.16.255.34   tuleap.ngv.com.au
3.106.222.95    vtest.ngv.com.au
192.168.177.26  logan.mycamp.local
    '';

    # This value determines the NixOS release from which the default
    # settings for stateful data, like file locations and database versions
    # on your system were taken. It‘s perfectly fine and recommended to leave
    # this value at the release version of the first install of this system.
    # Before changing this value read the documentation for this option
    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
    system.stateVersion = "25.05";
}