{ config, pkgs, modulesPath, lib, system, ... }:

{
  imports = [
    (modulesPath + "/profiles/qemu-guest.nix")
    (modulesPath + "/profiles/minimal.nix")
    # If for some reason "minimal" fails...
    #(modulesPath + "/profiles/base.nix")
  ];

  config = {
    boot.kernelPackages = pkgs.linuxPackages_latest;
    
    # Use the boot drive for grub
    boot.loader.grub.enable = lib.mkDefault true;
    boot.loader.grub.devices = [ "nodev" ];
    
    boot.growPartition = lib.mkDefault true;
    
    # Workaround for busted ZFS kernels
    #boot.supportedFilesystems = {
    #  zfs = lib.mkForce false;
    #};

    # Allow remote updates with flakes and non-root users
    nix.settings.trusted-users = [ "root" "@wheel" ];
    nix.settings.experimental-features = [ "nix-command" "flakes" ];

    # Provide a default hostname
    networking.hostName = lib.mkDefault "bubo";
    
    # Activate firewall
    networking.firewall.enable = true;
    
    # Open firewall ports
    networking.firewall.allowedTCPPorts = [ 80 443 2112  ];

    # Time Zone
    time.timeZone = "America/Chicago";

    # configuration.nix
    
    # Hermes Agent
    # services.hermes-agent = {
    #   enable = true;
    #   settings.model.default = "opencode/claude-haiku-4-5";
    #   environmentFiles = [ config.sops.secrets."hermes-env".path ];
    #   addToSystemPackages = true;
    # };
    
    # Enable QEMU Guest for Proxmox
    services.qemuGuest.enable = lib.mkDefault true;
    
    #OpenSSH
    security.sudo.wheelNeedsPassword = false; # Don't ask for passwords
    services.openssh = {
      enable = true;
      settings.PasswordAuthentication = false;
      settings.KbdInteractiveAuthentication = false;
      ports = [ 2112 ];
    };
    programs.ssh.startAgent = true;
    
    #SOPS
    # sops.defaultSopsFile = ../secrets/secrets.yaml;
    # sops.defaultSopsFormat = "yaml";
    # sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
     # sops.secrets."nebula-sync-primary" = {
       # owner = "nebula";
     # };
     # sops.secrets."nebula-sync-replicas" = {
       # owner = "nebula";
     # };
    #sops.age.keyFile = "/home/shawnb/Development/falcon_nest/sops/age/keys.txt";
    #sops.secrets."nebula-sync" = {
    #  owner = config.users.users.nebula.name;
    #};

    # Some sane packages we need on every system
    environment.systemPackages = with pkgs; [
      vim # for emergencies
      git # for pulling nix flakes
      zsh
      bat
      eza
      
    ];

    environment.shells = with pkgs; [ zsh ];
    users.defaultUserShell = pkgs.zsh;
    
    programs.zsh = {
      shellAliases = {
        #.. = "cd ..";
        h = "cd ~";
        ls = "eza --icons -l -T -L=1";
        cat = "bat";
      };
      enable = lib.mkDefault true;
      autosuggestions.enable = lib.mkDefault true;
    };
    
    #oh-my-zsh
    programs.zsh.ohMyZsh = {
      enable = lib.mkDefault true;
      theme = lib.mkDefault "jtriley";
    };

    # Default filesystem
    fileSystems."/" = lib.mkDefault {
      device = "/dev/disk/by-label/nixos";
      autoResize = true;
      fsType = "ext4";
    };

    nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
    system.stateVersion = lib.mkDefault "26.05";
    
    # Clean Nix up after upgrades.
    programs.nh = {
      enable = true;
      clean.enable = true;
      clean.extraArgs = "--keep 5";
    };

    # Add an admin user
    users.users.shawnb = lib.mkDefault {
      isNormalUser = true;
      hashedPassword = "";
      description = "Shawn Borton";
      extraGroups = [ "networkmanager" "wheel" ];
      openssh.authorizedKeys.keys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILgyiCfvu21kVTfRyKjzpH+93k7Jsf+EqLfN6NtolHnf tech@shilohsvillage.com"
      ];
    };
  };
}