dotfiles/nixos/configuration.nix

# Edit this configuration file to define what should be installed on
# your system.  Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).

{ config, pkgs, ... }:

{
  imports = [
    # Include the results of the hardware scan.
    ./hardware-configuration.nix
    ./framework.nix
    <home-manager/nixos>
  ];

  # Bootloader.
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  boot.loader.efi.efiSysMountPoint = "/boot/efi";

  boot.tmp.cleanOnBoot = true;

  # Networking
  networking.hostName = "pierre"; # Define your hostname.
  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.

  # Configure network proxy if necessary
  # networking.proxy.default = "http://user:password@proxy:port/";
  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";

  # Enable networking
  networking.networkmanager.enable = true;
  networking.extraHosts = "109.238.11.111 nuage-v1.une-frouzins.fr";

  # Wildcard *.dev.local → 127.0.0.1, requis par gezy-local (Traefik route les
  # sous-domaines clients). systemd-resolved ne sait pas répondre en wildcard :
  # dnsmasq écoute sur 127.0.0.1:53 (le stub resolved est sur 127.0.0.53:53) et
  # resolved ne lui délègue que la zone dev.local.
  services.dnsmasq = {
    enable = true;
    resolveLocalQueries = false;
    settings = {
      listen-address = "127.0.0.1";
      bind-interfaces = true;
      no-resolv = true;
      address = "/dev.local/127.0.0.1";
    };
  };
  services.resolved.settings.Resolve = {
    DNS = "127.0.0.1";
    Domains = "~dev.local";
  };

  # Set your time zone.
  time.timeZone = "Europe/Paris";

  # Select internationalisation properties.
  i18n.defaultLocale = "en_US.UTF-8";

  i18n.extraLocaleSettings = {
    LC_ADDRESS = "fr_FR.UTF-8";
    LC_IDENTIFICATION = "fr_FR.UTF-8";
    LC_MEASUREMENT = "fr_FR.UTF-8";
    LC_MONETARY = "fr_FR.UTF-8";
    LC_NAME = "fr_FR.UTF-8";
    LC_NUMERIC = "fr_FR.UTF-8";
    LC_PAPER = "fr_FR.UTF-8";
    LC_TELEPHONE = "fr_FR.UTF-8";
    LC_TIME = "fr_FR.UTF-8";
  };

  # Configure keymap in X11
  services.xserver = {
    enable = true;
    xkb = {
      layout = "fr";
      variant = "bepo";
    };

    windowManager = {
      i3 = {
        enable = true;
      };
    };
  };
  services.displayManager = {
    defaultSession = "none+i3";
  };

  # Configure console keymap
  console.keyMap = "fr";

  # Define a user account. Don't forget to set a password with ‘passwd’.
  users.users.pierre = {
    isNormalUser = true;
    description = "Pierre";
    extraGroups = [
      "networkmanager"
      "wheel"
      "audio"
      "docker"
      "video"
      "lpadmin"
    ];
    shell = pkgs.zsh;
    packages = with pkgs; [ ];
  };
  home-manager.users.pierre = import /home/pierre/dotfiles/home.nix;

  # List packages installed in system profile. To search, run:
  # $ nix search wget
  environment.systemPackages = with pkgs; [
    thunderbolt

    # Basics
    docker
    gitFull
    vim

    # Sound
    blueman
    bluez-tools

    # VPN - see https://www.wireguard.com/install/
    wireguard-tools
  ];
  virtualisation.docker.enable = true;

  # Some programs need SUID wrappers, can be configured further or are
  # started in user sessions.
  # programs.mtr.enable = true;
  # programs.gnupg.agent = {
  #   enable = true;
  #   enableSSHSupport = true;
  # };
  programs.zsh.enable = true; # see https://github.com/NixOS/nixpkgs/issues/20548#issuecomment-261965667
  hardware.acpilight.enable = true;
  hardware.i2c.enable = true;

  programs.nix-ld = {
    enable = true;
    libraries = with pkgs; [
      fnm
      stdenv.cc.cc.lib
    ];
  };

  # Printing
  services.printing = {
    enable = true;
    drivers = with pkgs; [
      epson-escpr # Epson Stylus SX230
      gutenprint # Brother MFC-9330CDW (couleur, fallback si driverless KO)
    ];
  };

  # Découverte imprimantes réseau (Bonjour/mDNS)
  services.avahi = {
    enable = true;
    nssmdns4 = true;
    openFirewall = true;
  };

  # Désactive la mise en veille automatique du système (suspend/hibernate à l'idle)
  services.logind = {
    lidSwitchExternalPower = "ignore"; # ignorer fermeture couvercle quand branché
    settings.Login.IdleAction = "ignore";
  };

  # List services that you want to enable:
  services.nscd.enable = true;
  services.tlp.enable = true;
  services.upower.enable = true; # keyboard backlight
  services.gnome.at-spi2-core.enable = true; # see https://github.com/NixOS/nixpkgs/pull/49636/files
  services.gnome.gnome-keyring.enable = true; # see https://nixos.wiki/wiki/Visual_Studio_Code#Error_after_Sign_On
  services.blueman.enable = true;
  services.udisks2.enable = true;
  services.resolved.enable = true;
  services.gvfs.enable = true; # to view MTP devices in file manager - https://www.perplexity.ai/search/how-to-browse-files-from-bus-0-QWBoYG1gRLu3uMRqFSzw9A

  # VPN LundiMatin (NetBird, serveur https://vpn.lundimatin.fr, auth SSO LM).
  # L'URL du serveur se pose une seule fois en runtime — netbird 0.72 lit son profil
  # actif dans /var/lib/netbird/default.json, pas dans le config.json géré par le module :
  #   sudo netbird up -m https://vpn.lundimatin.fr
  services.netbird = {
    enable = true; # service netbird.service + interface wt0 + CLI netbird
    ui.enable = false; # CLI uniquement (le module active le tray par défaut si X11 est présent)
    useRoutingFeatures = "client"; # accepte les routes vers les réseaux internes LM (reverse path filtering en loose)
  };

  # Prevent coredump issues with Antigravity - https://www.perplexity.ai/search/systemd-coredump-high-cpu-on-n-LUnRQViaRuiDn1LR06hU8w#2
  systemd.coredump = {
    enable = true;
    settings.Coredump = {
      Storage = "none";
      ProcessSizeMax = "50M";
      MaxUse = "100M";
    };
  };

  # Enable the OpenSSH daemon.
  # services.openssh.enable = true;

  # Open ports in the firewall.
  # Ports: 9003 - Xdebug
  networking.firewall.allowedTCPPorts = [ 9003 ];
  networking.firewall.allowedUDPPorts = [ 9003 ];
  # Or disable the firewall altogether.
  # networking.firewall.enable = false;
  # https://github.com/nix-community/nix-direnv/
  nix.extraOptions = ''
    keep-outputs = true
    keep-derivations = true
  '';
  nix.settings.extra-experimental-features = [
    "nix-command"
    "flakes"
  ];

  # Cache binaire de https://github.com/lukasl-dev/pi.nix (cf. programs/pi.nix)
  nix.settings.extra-substituters = [ "https://pi.cachix.org" ];
  nix.settings.extra-trusted-public-keys = [
    "pi.cachix.org-1:lGeoGJaZ5ZDabuRzkcD5EBTNnDM4HJ1vqeOxlWk1Flk="
  ];

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "22.05"; # Did you read the comment?

}