blumeops/nixos/ringtail/configuration.nix

{ config, pkgs, ... }:

{
  # Allow unfree packages (NVIDIA drivers, Steam)
  nixpkgs.config.allowUnfree = true;

  # Bootloader
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  # No TPM module on this board
  systemd.tpm2.enable = false;

  # Networking
  networking.hostName = "ringtail";
  networking.networkmanager.enable = true;

  # Time zone
  time.timeZone = "America/Los_Angeles";

  # Locale
  i18n.defaultLocale = "en_US.UTF-8";

  # NVIDIA proprietary drivers
  hardware.graphics.enable = true;
  services.xserver.videoDrivers = [ "nvidia" ];
  hardware.nvidia = {
    modesetting.enable = true;
    open = false; # Use proprietary driver for RTX 4080
    nvidiaSettings = true;
    package = config.boot.kernelPackages.nvidiaPackages.stable;
  };

  # Wayland / Sway
  programs.sway = {
    enable = true;
    wrapperFeatures.gtk = true;
    extraSessionCommands = ''
      export WLR_NO_HARDWARE_CURSORS=1
    '';
    extraPackages = with pkgs; [
      swaylock
      swayidle
      wezterm # terminal
      wmenu # app launcher
      mako # notifications
      grim # screenshots
      slurp # region selection
    ];
  };
  security.polkit.enable = true;
  security.sudo.wheelNeedsPassword = false;

  # Enable greetd as display manager for sway
  services.greetd = {
    enable = true;
    settings = {
      default_session = {
        command = "${pkgs.tuigreet}/bin/tuigreet --time --cmd 'sway --unsupported-gpu'";
        user = "greeter";
      };
    };
  };

  # PipeWire for audio
  services.pipewire = {
    enable = true;
    alsa.enable = true;
    pulse.enable = true;
  };

  # Fish shell
  programs.fish.enable = true;

  # 1Password (modules handle CLI group/setgid and polkit for GUI integration)
  programs._1password.enable = true;
  programs._1password-gui = {
    enable = true;
    polkitPolicyOwners = [ "eblume" ];
  };

  # Steam
  programs.steam = {
    enable = true;
    dedicatedServer.openFirewall = true;
  };

  # Tailscale
  services.tailscale = {
    enable = true;
    extraUpFlags = [ "--accept-routes" "--ssh" ];
  };

  # SSH
  services.openssh = {
    enable = true;
    settings = {
      PasswordAuthentication = false;
      PermitRootLogin = "no";
    };
  };

  # User account
  users.users.eblume = {
    isNormalUser = true;
    shell = pkgs.fish;
    extraGroups = [ "wheel" "networkmanager" "video" ];
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILmh1SSCdDAyu3vkSQH7kAXEPDi8APyjo9JXDTjtha2j"
    ];
  };

  # System packages
  environment.systemPackages = with pkgs; [
    git
    python3 # required for Ansible
    vim
    htop
    curl
    wget
    chezmoi
    neovim
    eza
    fd
    fzf
    zoxide
    starship
    atuin
    bat
    ripgrep
    mise
    gcc
    gnumake
    pkg-config
    openssl
    gnupg
  ];

  # Allow running dynamically linked binaries (mise-installed runtimes, etc.)
  programs.nix-ld.enable = true;

  # Fonts
  fonts.packages = with pkgs; [
    nerd-fonts.victor-mono
  ];

  # Home Manager (minimal — chezmoi owns dotfiles, this is ringtail-specific)
  home-manager.useGlobalPkgs = true;
  home-manager.useUserPackages = true;
  home-manager.users.eblume = {
    home.stateVersion = "25.11";

    wayland.windowManager.sway = {
      enable = true;
      config = {
        terminal = "wezterm";
        modifier = "Mod4";
        bars = [{ command = "waybar"; }];
        input = {
          "*" = {
            xkb_options = "ctrl:nocaps";
          };
        };
      };
    };

    programs.waybar = {
      enable = true;
      settings = [{
        layer = "top";
        position = "top";
        modules-left = [ "sway/workspaces" "sway/mode" ];
        modules-center = [ "sway/window" ];
        modules-right = [ "pulseaudio" "network" "clock" "tray" ];
        tray = { spacing = 8; };
        clock = { format = "{:%a %b %d  %H:%M}"; };
        network = {
          format-wifi = "{essid} ({signalStrength}%)";
          format-ethernet = "{ifname}";
          format-disconnected = "disconnected";
        };
        pulseaudio = {
          format = "{volume}% {icon}";
          format-icons = { default = [ "" ]; };
        };
      }];
    };
  };

  # Ensure mounted drives are owned by eblume
  systemd.tmpfiles.rules = [
    "d /mnt/games 0755 eblume users -"
    "d /mnt/storage1 0755 eblume users -"
    "d /mnt/storage2 0755 eblume users -"
  ];

  # Enable nix flakes
  nix.settings.experimental-features = [ "nix-command" "flakes" ];

  # NixOS release
  system.stateVersion = "25.11";
}