{ config, pkgs, ... }:

{
  imports =
    [ # Include the results of the hardware scan.
      ./hardware.nix
    ];

  boot = {
    supportedFilesystems = [ "nfs" ];
    kernelPackages = pkgs.linuxPackages_rpi4;
    kernelParams = [ "cgroup_enable=memory" "cgroup_enable=cpuset" "cgroup_memory=1" ];
    loader = {
      grub.enable = false;
      generic-extlinux-compatible.enable = true;
    };
  };

  swapDevices = [
    {
      device = "/var/lib/swapfile";
      size = 8*1024;
    }
  ];

  nix = {
    settings = {
      auto-optimise-store = true;
      experimental-features = ["nix-command" "flakes"];
    };
    gc = {
      automatic = true;
      dates = "weekly";
      options = "--delete-older-than 30d";
    };
    # Free up to 1GiB whenever there is less than 100MiB left.
    extraOptions = ''
      min-free = ${toString (100 * 1024 * 1024)}
      max-free = ${toString (1024 * 1024 * 1024)}
      '';
  };

  networking = {
    hostName = "seattle";
    domain = "gmem.ca";
    firewall = {
      trustedInterfaces = ["tailscale0"];
      checkReversePath = "loose";
      allowedTCPPorts = [ 22 80 443 6443 10250 ];
      allowedUDPPorts = [ 41641 80 443 ];
      enable = false;
    };
    nftables.enable = false;
  };

  time.timeZone = "Europe/London";

  users.users.gsimmer = {
    isNormalUser = true;
    extraGroups = [ "wheel" ];
    packages = with pkgs; [
      tree
    ];
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILIztwQxt+jqroFONSgq+xzPMuE2I5Dq/zWPQ8RcTYJr"
      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAICCc6k8tl2ahB3HtjpGK403Wkk+nQKgIhSgdBXxmXdsEAAAABHNzaDo="
      "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMO7u+6hBN3XJfRFZCxADyLJfI8zGO2pj9AxkF0FecSR8GFuzP77wyUzmHosQcxe/P/N1TeNdfIDCatogqft9w4="
    ];
  };

  environment.systemPackages = with pkgs; [
    vim
    wget
    htop
    git
    screen
    nix-output-monitor
    tailscale
    nfs-utils
    libraspberrypi
  ];

  services = {
    rpcbind.enable = true;
    openssh.enable = true;
    tailscale.enable = true;
    k3s = {
      enable = true;
      role = "server";
      extraFlags = toString [
        "--secrets-encryption --disable=traefik,servicelb"
      ];
    };
  };

  hardware = {
    bluetooth = {
      enable = true;
      powerOnBoot = true;
    };
  };

  system.stateVersion = "23.11"; # dId YoU rEaD tHe CoMmEnT?

}