nix

{ config, pkgs, lib, modulesPath, ... }:
{
  networking = {
    hostName = "portal";
    networkmanager.enable = true;
  };

  time.timeZone = "Pacific/Auckland";
  i18n = {
    defaultLocale = "en_NZ.UTF-8";
    extraLocaleSettings = {
      LC_ADDRESS = "en_NZ.UTF-8";
      LC_IDENTIFICATION = "en_NZ.UTF-8";
      LC_MEASUREMENT = "en_NZ.UTF-8";
      LC_MONETARY = "en_NZ.UTF-8";
      LC_NAME = "en_NZ.UTF-8";
      LC_NUMERIC = "en_NZ.UTF-8";
      LC_PAPER = "en_NZ.UTF-8";
      LC_TELEPHONE = "en_NZ.UTF-8";
      LC_TIME = "en_NZ.UTF-8";
    };
  };
  services = {
    displayManager.gdm.enable = true;
    desktopManager.gnome.enable = true;
    pulseaudio.enable = false;
    pipewire = {
      enable = true;
      alsa.enable = true;
      alsa.support32Bit = true;
      pulse.enable = true;
    };
    openssh.enable = true;
  };
  security.rtkit.enable = true;
  users.users.fsnkty = {
    isNormalUser = true;
    description = "Madison";
    extraGroups = [ "networkmanager" "wheel" ];
    packages = with pkgs; [
      firefox
      vscode
    ];
  };

  nixpkgs = {
    config.allowUnfree = true;
    hostPlatform = "x86_64-linux";
  };

  environment.systemPackages = with pkgs; [
    vim
    wget
  ];


  imports =
    [
      (modulesPath + "/installer/scan/not-detected.nix")
    ];

  hardware.cpu.intel.updateMicrocode = true;
  boot = {
    loader = {
      systemd-boot.enable = true;
      efi.canTouchEfiVariables = true;
    };
    initrd = {
      availableKernelModules = [ "xhci_pci" "ahci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
      systemd.enable = true;
      luks.devices = {
        "rootcrypt" = {
          device = "/dev/disk/by-uuid/4b906d09-a291-448f-b93f-ad8688ef6a6d";
          crypttabExtraOpts = [ "tpm-device=auto" ];
        };
        "swapcrypt" = {
          device = "/dev/disk/by-uuid/d4ef99d7-eeb8-4a9b-bfee-c9f4bf45cfe0";
          crypttabExtraOpts = [ "tpm-device=auto" ];
        };
      };
    };
    kernelModules = [ "kvm-intel" ];
  };


  fileSystems = {
    "/" = {
      device = "/dev/mapper/rootcrypt";
      fsType = "ext4";
    };
    "/boot" = {
      device = "/dev/disk/by-uuid/52A5-10D0";
      fsType = "vfat";
      options = [ "fmask=0077" "dmask=0077" ];
    };
  };
  swapDevices = [{ device = "/dev/mapper/swapcrypt"; }];

  system.stateVersion = "25.11";
  # fingerprint scanner
  nixpkgs.overlays = [
    (final: prev: {
      libfprint = prev.libfprint.overrideAttrs (old: {
        pname = "libfprint-vfs009x";
        # version = "1.94.9+vfs009x";
        src = final.fetchgit {
          url = "https://gitlab.archlinux.org/gugah/libfprint.git";
          rev = "450e6aea0f5c92b3719d910c0defb2c85b0746df"; # refs/head/vfs009x
          sha256 = "sha256-Rm62zo2PRO1GlN8I9+r7MOl9q4AlUixrD1Y13Of8Xmw=";
        };
        buildInputs = (old.buildInputs or [ ]) ++ [ final.nss ];
        # Keep any patches Nixpkgs already applies to libfprint
        patches = old.patches or [ ];
      });
    })
  ];
  systemd.services.fprintd = {
    wantedBy = [ "multi-user.target" ];
    serviceConfig.Type = "simple";
  };
  services.fprintd = {
    enable = true;
    tod.enable = false;
  };
}