# Generic system-level config. Reusable across hosts — nothing machine- or
# user-specific here. The user account, hostname and system.stateVersion live in
# the per-host inventory (hosts/<host>/), not in this module.

{ config, lib, pkgs, ... }:

{
  nix.settings.experimental-features = [ "nix-command" "flakes" ];
  # Deduplicate identical store paths via hardlinks.
  nix.settings.auto-optimise-store = true;
  # Weekly GC of generations older than 30 days (frees disk + prunes stale boot
  # entries). Flat age cutoff — Nix has no snapper-style tiered retention.
  nix.gc = {
    automatic = true;
    dates = "weekly";
    options = "--delete-older-than 30d";
  };

  # Bootloader systemd-boot much simpler than GRUB.
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  # Show only the newest 5 generations in the boot menu (display cap only; GC
  # above does the actual deletion).
  boot.loader.systemd-boot.configurationLimit = 5;

  # Use latest kernel.
  boot.kernelPackages = pkgs.linuxPackages_latest;

  # Configure network connections interactively with nmcli or nmtui.
  networking.networkmanager.enable = true;

  networking.firewall = {
    allowedTCPPorts = [
      22000  # syncthing sync transport (TCP)
    ];
    allowedUDPPorts = [
      22000  # syncthing sync transport (QUIC)
      21027  # syncthing LAN discovery
    ];
  };

  # Time zone. Template default — override per host/region.
  time.timeZone = "Europe/Berlin";

  # Internationalisation properties. Template defaults — override per region.
  i18n.defaultLocale = "en_US.UTF-8";
  console = {
    font = "Lat2-Terminus16";
    keyMap = "de";
  };

  # Programs.
  programs.zsh.enable = true;
  programs.hyprland.enable = true;
  programs.dconf.enable = true;

  # Packages installed in system profile.
  environment.systemPackages = with pkgs; [
    curl
    git
    neovim
    wget
  ];
  nixpkgs.config.allowUnfree = true;

  # Install nice font.
  fonts.packages = with pkgs; [
    nerd-fonts.jetbrains-mono
  ];

  # Enable sound.
  services.pipewire = {
    enable = true;
    alsa.enable = true;
    alsa.support32Bit = true;
    pulse.enable = true;
  };
  security.rtkit.enable = true;

  # Cache sudo credentials for 30 min per terminal (default 5). Tradeoff: an
  # unlocked, unattended terminal can sudo without re-auth for that window.
  security.sudo.extraConfig = "Defaults timestamp_timeout=30";

  # Login manager.
  services.greetd = {
    enable = true;
    settings = {
      default_session = {
        command = "${pkgs.tuigreet}/bin/tuigreet --time --remember --cmd start-hyprland";
        user = "greeter";
      };
    };
  };

  # Unlock the login keyring with the login password at the greetd prompt,
  # so the Secret Service is open without a second passphrase.
  security.pam.services.greetd.enableGnomeKeyring = true;

  # XDG portals (screen sharing, file pickers, and so on). The GTK portal (for
  # file dialogs) is added at the home-manager layer, not here: home-manager's
  # Hyprland module pins the portal search dir to the user profile, so a portal
  # listed in this system-level extraPortals is never seen. See modules/home.nix.
  xdg.portal = {
    enable = true;
    extraPortals = [ pkgs.xdg-desktop-portal-hyprland ];
  };
}