nix-config/hosts/pi5/configuration.nix

# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page, on
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).

{ config, lib, pkgs, ... }:

let
  user = "matt";
  password = "$y$j9T$EkPXmsmIMFFZ.WRrBYCxS1$P0kwo6e4.WM5DsqUcEqWC3MrZp5KfCjxffraMFZWu06";
  SSID = "Joey's Jungle 5G";
  wifiSecrets = "kR8v&3Qd"; #config.sops.secrets."wifi".path;
  interface = "wlan0";
  timezone = "America/Chicago";
  hostname = "pi5";
in
{
  imports = [
    # ./boot.nix
    ./hardware-configuration.nix
    ./impermanence.nix
    ./bootconfig.nix
    # ./sops.nix
    # ../default.nix
  ];

  raspberry-pi-nix.board = lib.mkForce "bcm2712";

  # Enable nix flakes and nix-command tools
  nix = {
    settings = {
      substituters = [
        # "https://cache.mjallen.dev"
        "https://nixos-raspberrypi.cachix.org"
        "https://nix-community.cachix.org"
        "https://cache.nixos.org/"
      ];
      trusted-public-keys = [
        # "cache.mjallen.dev-1:IzFmKCd8/gggI6lcCXsW65qQwiCLGFFN9t9s2iw7Lvc="
        "nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI="
        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
      ];
      warn-dirty = lib.mkForce false;
      experimental-features = lib.mkForce [
        "nix-command"
        "flakes"
      ];
      trusted-users = lib.mkDefault [
        "root"
        "@wheel"
        user
      ];
    };
  };
  # Configure nixpkgs
  # Enable non free
  nixpkgs.config.allowUnfree = lib.mkForce true;

  # Hardware configs
  hardware = {
    # Bluetooth
    bluetooth.enable = lib.mkDefault true;

    # Enable all firmware
    enableAllFirmware = lib.mkForce true;
  };
 
  services.xserver = {
    enable = false;
    desktopManager = {
      budgie.enable = false;
    };
    displayManager = {
      lightdm.enable = false;
    };
  };

  hardware = {
    raspberry-pi."4".fkms-3d.enable = false;
    raspberry-pi."4".apply-overlays-dtmerge.enable = false;
    raspberry-pi."4".audio.enable = false;
    raspberry-pi."4".bluetooth.enable = false;
    raspberry-pi."4".dwc2.enable = false;
    raspberry-pi."4".xhci.enable = false;
  };

  # Set your time zone.
  time.timeZone = timezone;

  networking = {
    hostName = hostname;

    defaultGateway.address = "10.0.1.1";
    nameservers = [ "10.0.1.1" ];

    firewall = {
      enable = true;
      allowPing = true;
    };
  };

  systemd.services.btattach = {
    before = [ "bluetooth.service" ];
    after = [ "dev-ttyAMA0.device" ];
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      ExecStart = "${pkgs.bluez}/bin/btattach -B /dev/ttyAMA0 -P bcm -S 3000000";
    };
  };

  environment.systemPackages = with pkgs; [
    argononed
    vim
    libraspberrypi
    raspberrypi-eeprom
    raspberrypifw
    raspberrypiWirelessFirmware
    raspberrypi-armstubs
    htop
    git
  ];

  services.openssh.enable = true;

  programs.nix-index = {
    enable = true;
    enableBashIntegration = true;
    enableZshIntegration = true;
  };

  security = {
    rtkit.enable = lib.mkDefault true;

    # configure sudo
    sudo.enable = lib.mkDefault false;
    sudo-rs = {
      enable = lib.mkDefault true;
      extraRules = [
        {
          commands = [
            {
              command = "${pkgs.systemd}/bin/systemctl suspend";
              options = [ "NOPASSWD" ];
            }
            {
              command = "${pkgs.systemd}/bin/reboot";
              options = [ "NOPASSWD" ];
            }
            {
              command = "${pkgs.systemd}/bin/poweroff";
              options = [ "NOPASSWD" ];
            }
          ];
          groups = [ "wheel" ];
        }
      ];
    };
  };

  users = {
    mutableUsers = false;
    users."${user}" = {
      isNormalUser = true;
      initialHashedPassword = password;
      extraGroups = [
        "wheel"
        "docker"
      ];
      shell = pkgs.zsh;
    };
  };
}