#
# Note:
# I could've import the wifi configuration and use it here, but I haven't
# figured out an elegant (enough) way to do it while keeping my secrets
# encrypted.
#
let
  sources = import ../../npins;
in
{
  pkgs,
  lib,
  modulesPath,
  ...
}:
{
  imports = [
    ../nixosModules/common/system-nixconf.nix
    ../nixosModules/common/sudo-conf.nix

    (modulesPath + "/installer/cd-dvd/installation-cd-minimal.nix")
  ];

  nix.settings = {
    extra-substituters = [ "https://leana8959.cachix.org" ];
    extra-trusted-substituters = [ "https://leana8959.cachix.org" ];
    extra-trusted-public-keys = [
      "leana8959.cachix.org-1:CxQSAp8lcgMv8Me459of0jdXRW2tcyeYRKTiiUq8z0M="
    ];
    experimental-features = [
      "nix-command"
      "flakes"
    ];
  };

  nixpkgs = {
    overlays = map import [
      ../overlays/agenix.nix
      ../overlays/disko.nix
      ../overlays/nur.nix
      ../overlays/nix-tree.nix

      ../packages/overlay.nix
    ];
  };

  system.nixos =
    let
      rev = lib.substring 0 8 sources.nixpkgs.revision;
    in
    {
      versionSuffix = "-git:${rev}";
      revision = rev;
    };

  isoImage.squashfsCompression = "zstd -Xcompression-level 3";

  environment.systemPackages = [
    pkgs.disko
    pkgs.git
    pkgs.pastebinit # for sharing cli output & debugging
    pkgs.hdparm # to ATA secure wipe disks
    pkgs.btop
  ];

  networking.firewall.allowedTCPPorts = [ 8080 ]; # in case you wanna nc

  programs.tmux.enable = true;
  users.users.nixos.shell = pkgs.fish;
  programs.fish.enable = true;

  networking = {
    networkmanager.enable = lib.mkForce false;
    wireless = {
      enable = true;
      userControlled.enable = true;
    };
  };
  # Wireless Regulatory Domain
  # https://community.frame.work/t/framework-nixos-linux-users-self-help/31426/77
  hardware.wirelessRegulatoryDatabase = true;
  boot.extraModprobeConfig = ''
    options cfg80211 ieee80211_regdom="US"
  '';

  # If we run out of memory during building, the machine would hang, and that sucks.
  # Nothing worse than restarting the installation from scratch
  services.earlyoom.enable = true;
}