dotfiles/nixos/systems/omen/default.nix

# SPDX-FileCopyrightText: 2022 Richard Brežák <richard@brezak.sk>
#
# SPDX-License-Identifier: LGPL-3.0-or-later
{ inputs, lib', config, ... }:
let
  inherit (lib')
    flip
    mapAttrs
    singleton
    loadSecrets
    mkAfter;

  config' = config;
in
{
  flake.nixosConfigurations.omen = inputs.nixpkgs.lib.nixosSystem {
    system = "x86_64-linux";
    lib = lib';

    specialArgs = {
      config' = config';
      inputs' = inputs;
      secret = loadSecrets inputs.secret;
    };

    modules = singleton
      ({ pkgs, lib, config, secret, ... }:
        {
          imports = [
            ../../common/steam.nix
            ../../common/sound.nix
            ./xserver.nix
            ./grub.nix
            ./networking.nix
            ./filesystems.nix
            ./hardware.nix
            ./users.nix
            ./nixpkgs.nix
            ./firewall.nix
            ./microvm.nix
            ./impermenance.nix
            ./numen.nix
            # ./test-vm.nix

            inputs.dwarffs.nixosModules.dwarffs
            inputs.microvm.nixosModules.host
            inputs.notnft.nixosModules.default
            inputs.self.nixosModules.notnft
            inputs.self.nixosModules.microvm-extras-host
            inputs.impermenance.nixosModules.impermanence
          ];

          _module.args.nixinate = {
            host = secret.network.ips.omen.vpn or "";
            sshUser = "main";

            buildOn = "local";
            substituteOnTarget = true;
            hermetic = false;
            nixOptions = [
              "--override-input secret path://$HOME/dotfiles/secret"
            ];
          };

          services.fwupd.enable = true;

          services.syncthing = {
            enable = true;
            user = "main";
            group = "main";
          };

          services.sshd.enable = true;

          # Makes QEMU recompile https://github.com/NixOS/nixpkgs/issues/221056
          boot.binfmt.emulatedSystems = [
            "aarch64-linux"
            "riscv64-linux"
          ];

          time.timeZone = "Europe/Amsterdam";
          system.stateVersion = "23.05";

          virtualisation.podman.enable = true;
          virtualisation.podman.dockerCompat = true;
        virtualisation.podman.defaultNetwork.settings.subnets = [
          {
            gateway = "10.88.0.1";
            subnet = "10.88.0.0/16";
          }
        ];
      });
  };
}