nixos-conf/modules/roles/base.nix

{
  config,
  pkgs,
  lib,
  nixpkgs-flake,
  ...
}:
{
  options.custom = {
    base.enable = lib.mkOption {
      type = lib.types.bool;
      default = true;
    };
    networking.guaPref = lib.mkOption {
      type = with lib.types; nullOr (strMatching "^[0-9a-zA-Z:]+$");
      default = null;
      description = "IPv6 GUA Prefix to use in other confs";
    };
    sshKeys = lib.mkOption {
      type = with lib.types; attrsOf str;
      default = { };
      description = "attrSet of SSH public keys";
    };
  };

  config = {
    custom = {
      networking.guaPref = "2001:14ba:a090:39";
      sshKeys = {
        vili-bw-main = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJowj9IJIgYjDwZm5mEttiwvPfu1dd4eVTHfaDnbwcOV";
        cert-store = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKNhPvGogPY/O6kIqrpbz0EcK4L5QQShvD+vuyk7FxFd";
        ci = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFgT2MGhvvJkWSNCfN0my/lNsTQtTV6+OcTHBSPVlGFA";
        forgejo = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG74oN4MnrCm/rm1WyYy7M7Lv1qMRgcy3sDCgj6YN2zE";
        gaming = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM5HaiVVOfb8l19aVGG1CTkZ25G439Llg4aieZdKFzSq";
        # TODO Helium
        idacloud = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGbOwFM599I7trhizhUe1ZpnXf8q4Uz3zgAnMCwwCf0K";
        lithium = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBRtE6KCyD6BFfzff9cuD2ZhEdPKEgp+WGsD0s81736J";
        opnsense = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBsctvJR4JOVoTAas0+lb8662EXFsQVNozTntnR7o5R1";
        nextcloud = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPvVPRMrYsacSWyVSFFydgIB9vSiu5gKs7Pn+jipTGpV";
        siit-dc = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCp67Rr03FH0DGhl6d2w/otBNaC5sI1y6rt5Gfi2tP6";
        syncthing = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII8s/x8NcdOHPVcTSuVj+X9/J+qbuZEB792YaOG0CUzD";
        vaultwarden = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII10aYyPOgpd+WAtgSyomH3sE6Cq54GftVm5xeC8KKlz";
        zfs-backup = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOWGvIc4sq+WzPqT2y003zga3StMgj7F8vwTjNkZ//d8";
      };
    };

    ######################################## Packages ###############################################
    environment.systemPackages = with pkgs; [
      tmux
      git
      vim
      p7zip
      tree
      ripgrep
      btop
      dig
      termshark

      age
      ssh-to-age
      sops
      minisign
      pwgen
      ssss
    ];

    ######################################## ZSH configuration ######################################
    users.defaultUserShell = pkgs.zsh;
    environment.shells = with pkgs; [ zsh ];
    programs.zsh = {
      enable = true;
      autosuggestions.enable = true;
      syntaxHighlighting.enable = true;
      ohMyZsh = {
        enable = true;
        plugins = [
          "history-substring-search"
          "tmux"
        ];
        theme = "af-magic";
      };
      interactiveShellInit = ''
        ZSH_TMUX_AUTOSTART=false
        ZSH_TMUX_AUTOQUIT=false
        ZSH_TMUX_CONFIG=/etc/tmux.conf
      '';
      promptInit = ''
        if [ "$SHLVL" != 1 ]; then 
          setopt PROMPT_SUBST
          RPROMPT+='[depth-''${SHLVL}]'
        fi
      '';
    };

    ######################################## tmux configuration #####################################
    programs.tmux.enable = true;
    programs.tmux.extraConfig = ''
      unbind C-b
      set -g prefix M-w
      bind M-w send-prefix

      bind s split-window -v
      bind v split-window -h

      # Smart pane switching with awareness of Vim splits.
      bind -n C-h run "(tmux display-message -p '#{pane_current_command}' | grep -iq nvim && tmux send-keys C-h) || tmux select-pane -L"
      bind -n C-j run "(tmux display-message -p '#{pane_current_command}' | grep -iq nvim && tmux send-keys C-j) || tmux select-pane -D"
      bind -n C-k run "(tmux display-message -p '#{pane_current_command}' | grep -iq nvim && tmux send-keys C-k) || tmux select-pane -U"
      bind -n C-l run "(tmux display-message -p '#{pane_current_command}' | grep -iq nvim && tmux send-keys C-l) || tmux select-pane -R"

      bind -n C-Left select-pane -L
      bind -n C-Right select-pane -R
      bind -n C-Up select-pane -U
      bind -n C-Down select-pane -D

      # resize panes more easily
      bind -r h resize-pane -L 10
      bind -r j resize-pane -D 10
      bind -r k resize-pane -U 10
      bind -r l resize-pane -R 10

      bind M-c attach -c "#{pane_current_path}" 

      set -s escape-time 0
    '';

    ######################################## SSH configuration ######################################
    services.openssh = {
      enable = true;
      settings.PasswordAuthentication = false;
    };
    users.users.root.openssh.authorizedKeys.keys = [ config.custom.sshKeys.vili-bw-main ];

    ######################################## Localization ###########################################
    i18n.defaultLocale = "en_US.UTF-8";

    i18n.extraLocaleSettings = {
      LC_ADDRESS = "fi_FI.UTF-8";
      LC_IDENTIFICATION = "fi_FI.UTF-8";
      LC_MEASUREMENT = "fi_FI.UTF-8";
      LC_MONETARY = "fi_FI.UTF-8";
      LC_NAME = "fi_FI.UTF-8";
      LC_NUMERIC = "fi_FI.UTF-8";
      LC_PAPER = "fi_FI.UTF-8";
      LC_TELEPHONE = "fi_FI.UTF-8";
      LC_TIME = "fi_FI.UTF-8";
    };

    services.xserver.xkb = {
      layout = "us,";
      variant = "de_se_fi,";
    };
    console = lib.mkForce {
      font = "Lat2-Terminus16";
      useXkbConfig = true; # use xkbOptions in tty.
    };
    time.timeZone = "Europe/Helsinki";

    ######################################## Housekeeping ###########################################
    system.autoUpgrade = {
      enable = true;
      flake = ''"git+https://forgejo.sinerva.eu/VSinerva/nixos-conf.git?ref=main&shallow=1"'';
      dates = "04:00";
      randomizedDelaySec = "30min";
      allowReboot = true;
      rebootWindow = {
        lower = "03:30";
        upper = "05:00";
      };
    };

    nixpkgs.config.allowUnfree = true;
    nix = {
      channel.enable = false;
      gc = {
        automatic = true;
        options = "--delete-older-than 3d";
        dates = "05:00";
        randomizedDelaySec = "30min";
      };
      optimise = {
        automatic = true;
        dates = [ "06:00" ];
        randomizedDelaySec = "30min";
      };
      registry.nixpkgs.flake = nixpkgs-flake;

      settings = {
        auto-optimise-store = true;
        experimental-features = [
          "nix-command"
          "flakes"
        ];
        http2 = false;
      };
    };

    ######################################## Networking. ############################################
    networking = {
      # Easiest to use and most distros use this by default.
      networkmanager = {
        enable = true;
        # Use EUI-64 addresses by default, so that addresses are predictable
        settings."connection" = {
          "ipv4.dhcp-ipv6-only-preferred" = 1;
          "ipv6.addr-gen-mode" = 0;
        };
      };
      # IPv6 privacy addresses for outgoing traffic
      tempAddresses = "default";
    };
    services.clatd.enable = true;

    ######################################## Misc. ##################################################
    zramSwap.enable = true;

    users.mutableUsers = false; # Force all user management to happen throught nix-files

    boot.loader = {
      systemd-boot.enable = lib.mkDefault true;
      efi.canTouchEfiVariables = lib.mkDefault true;
      timeout = lib.mkDefault 0;
    };
  };
}