workstations.nix

{
  inputs,
  config,
  pkgs,
  pkgs-stable,
  lib,
  ...
}:
{
  # Define trusted users
  nix = {
    gc = {
      # Automatic garbage collection
      automatic = true;
      dates = "weekly";
      options = "--delete-older-than 7d";
    };
    settings = {
      auto-optimise-store = true; # Optimise the nix store
      allowed-users = [ "@wheel" ]; # only allow those in the `wheel` group to use the package manager
      experimental-features = [
        "nix-command"
        "flakes"
      ];
      trusted-users = [
        "root"
        "@wheel"
      ];
    };
    package = pkgs.nix;
  };

  # Syncthing
  services.syncthing = {
    enable = true;
    dataDir = "home/devraza";
    openDefaultPorts = true;
    configDir = "/home/devraza/.config/syncthing";
    user = "devraza";
    group = "users";
    guiAddress = "127.0.0.1:8384";
  };

  # Fingerprint
  services.fprintd = {
    enable = true;
    tod = {
      enable = true;
      driver = pkgs.libfprint-2-tod1-goodix;
    };
  };

  # Virtual machines
  programs.virt-manager.enable = true;
  virtualisation.libvirtd.enable = true;

  # Hyprland
  programs.hyprland = {
    enable = true;
    package = inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.hyprland;
    portalPackage =
      inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.xdg-desktop-portal-hyprland;
  };

  # Steam
  programs.steam = {
    enable = true;
    gamescopeSession.enable = true;
  };

  # Shared kernel + related configuration
  boot = {
    kernelPackages = pkgs.linuxPackages_zen;

    consoleLogLevel = 1;
    loader = {
      timeout = 0;
      efi = {
        canTouchEfiVariables = true;
        efiSysMountPoint = "/boot";
      };
      systemd-boot.enable = true;
    };
    kernelParams = [
      "quiet"
      "splash"

      "amdgpu.dcdebugmask=0x10"
      
      "drm.edid_firmware=DP-2:edid/DP-2.bin"
      "drm.edid_firmware=HDMI-A-1:edid/HDMI-A-1.bin"
    ];
    # Clean /tmp on boot, obviously
    tmp.cleanOnBoot = true;
  };
  
  # Add custom EDIDs
  hardware.firmware = [
  (
    pkgs.runCommand "edid.bin" { } ''
      mkdir -p $out/lib/firmware/edid
      cp ${../assets/firmware/DP-2.bin} $out/lib/firmware/edid/DP-2.bin
    ''
  )
  (
    pkgs.runCommand "edid.bin" { } ''
      mkdir -p $out/lib/firmware/edid
      cp ${../assets/firmware/HDMI-A-1.bin} $out/lib/firmware/edid/HDMI-A-1.bin
    ''
  )
  ];

  # Create swapfile
  swapDevices = [
    {
      device = "/var/lib/swapfile";
      size = 8 * 1024;
    }
  ];

  # Rules to allow keyboard to be configured on Linux
  services.udev.extraRules = ''
    SUBSYSTEM=="usb", ATTR{idVendor}=="41e4", ATTR{idProduct}=="2116", MODE="0666"
    KERNEL=="hidraw*", ATTRS{idVendor}=="41e4", ATTRS{idProduct}=="2116", MODE="0666"
  '';

  # For some exclusive programs
  services.flatpak.enable = true;

  # Bluetooth
  hardware.bluetooth = {
    enable = true;
    powerOnBoot = true;
  };

  # Fuse allow other users
  programs.fuse.userAllowOther = true;

  # Remove unused default packages
  environment.defaultPackages = lib.mkForce [ ];

  # Enable polkit
  security = {
    apparmor.enable = true;
    polkit = {
      enable = true;
      extraConfig = ''
        polkit.addRule(function(action, subject) {
          var YES = polkit.Result.YES;
          var permission = {
            // udisks2:
            "org.freedesktop.udisks2.filesystem-mount": YES,
            "org.freedesktop.udisks2.encrypted-unlock": YES,
            "org.freedesktop.udisks2.eject-media": YES,
            "org.freedesktop.udisks2.power-off-drive": YES,
            // udisks2 if using udiskie from another seat (e.g. systemd):
            "org.freedesktop.udisks2.filesystem-mount-other-seat": YES,
            "org.freedesktop.udisks2.filesystem-unmount-others": YES,
            "org.freedesktop.udisks2.encrypted-unlock-other-seat": YES,
            "org.freedesktop.udisks2.encrypted-unlock-system": YES,
            "org.freedesktop.udisks2.eject-media-other-seat": YES,
            "org.freedesktop.udisks2.power-off-drive-other-seat": YES
          };
          if (subject.isInGroup("storage")) {
            return permission[action.id];
          }
        });
      '';
    };
  };

  # Tablet
  hardware.opentabletdriver = {
    enable = true;
    package = pkgs-stable.opentabletdriver;
  };

  # Don't shutdown when power button is short-pressed
  services.logind.settings.Login = {
    HandlePowerKey = "ignore";
  };

  # Allow unfree packages
  nixpkgs.config.allowUnfree = true;

  # Printing
  hardware.sane.enable = true; # Enable support for SANE scanners
  services.printing.enable = true; # enables printing support via the CUPS daemon
  services.avahi = {
    enable = true; # runs the Avahi daemon
    nssmdns4 = true; # enables the mDNS NSS plug-in
  };

  time.timeZone = "Europe/London"; # Set time zone.

  # Security
  security = {
    rtkit.enable = true; # make PipeWire real-time capable
    pam = {
      services.hyprlock = { };
    };

    # sudo
    sudo.enable = false;
    sudo-rs = {
      enable = true;
      execWheelOnly = true;
    };
  };

  # Networking
  services.dbus.enable = true;
  networking = {
    networkmanager = {
      enable = true;
      plugins = [ 
        pkgs.networkmanager-openvpn 
      ];
    };
    nameservers = [ "9.9.9.9" ];
    firewall = {
      enable = true;
      rejectPackets = true;
      checkReversePath = false;
    };
  };

  # Overlay mesh network
  services.tailscale.enable = true;

  # Sound via PipeWire
  services.pipewire = {
    enable = true;
    alsa.enable = true;
    alsa.support32Bit = true;
    pulse.enable = true;
  };

  # Define user 'devraza'
  users.users.devraza = {
    isNormalUser = true;
    extraGroups = [
      "wheel"
      "uinput"
      "libvirtd"
      "input"
      "video"
      "audio"
      "networkmanager"
    ];
  };

  # Enable dconf - for gtk
  programs.dconf.enable = true;
  # pinentry-gnome3 fix
  services.dbus.packages = [ pkgs.gcr ];

  # Graphics configuration
  hardware = {
    graphics = {
      enable = true;
      enable32Bit = true;
    };
    amdgpu = {
      opencl.enable = true;
    };
  };

  # Enable and make 'fish' the default user shell
  programs.fish.enable = true;
  users.defaultUserShell = pkgs.fish;

  # uPower & Power profiles
  services.upower.enable = true;
  services.power-profiles-daemon.enable = true;
  
  # DBus service for automounting disks
  services.udisks2.enable = true;
}