sfos/common/default.nix

{
  config,
  inputs,
  pkgs,
  agenix,
  ...
}: {
  deployment = {
    targetHost = "<PLACEHOLDER>";
    targetPort = 22;
    targetUser = "root";
    buildOnTarget = true;
  };

  networking = {
    hostName = "<PLACEHOLDER>";
    nftables.enable = true;
    firewall = {
      allowedTCPPorts = [22 80 443];
      allowedUDPPorts = [config.services.tailscale.port];
    };
  };
  imports = [
    agenix.nixosModules.default
    inputs.nixos-facter-modules.nixosModules.facter
    {config.facter.reportPath = ./facter.json;}
    inputs.disko.nixosModules.disko
    ./hardware-configuration.nix
    ./disko-config.nix
    ./base-system.nix
    ./nix.nix
    ./nomad.nix
  ];

  boot = {
    supportedFilesystems = ["btrfs" "ntfs" "vfat" "ext4"];
    loader.grub = {
      enable = true;
    };
  };

  # age.secrets.docker_auth_json = {
  #   file = ./secrets/docker_ghcr_auth_config_json.age;
  #   path = "/run/containers/0/auth.json";
  # };

  age.secrets.tailscale_auth_key = {
    file = ./secrets/tailscale_auth_key;
  };

  environment.systemPackages = with pkgs; [
    nomad_1_9
  ];

  #
  # TEST: authentication to private repo
  #
  # environment.variables = {
  #   XDG_RUNTIME_DIR = "/var/run/user/0";
  # };

  # Define a systemd service to create files in /var/run/user/0
  # systemd.services."create-incus-ghcr-auth-file" = {
  #   description = "Create ghcr.io auth file for incus to retrieve private images";
  #   after = ["default.target"];
  #   wantedBy = ["default.target"];
  #   serviceConfig = {
  #     ExecStart = ''${pkgs.bashInteractive}/bin/bash -c 'echo {\\"auths\\":{ \\"ghcr.io\\": {\\"auth\\": \\"YWNhbG9pYXJvOiBnaHBfVnN4dzc4YXZ6N0lBeXQyejVrcGpZQTJXV21XbUZNMzlZdkMxIA==\\"}}} > /var/run/user/0/containers/auth.json' '';
  #     ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p /var/run/user/0/containers";
  #     Restart = "no";
  #   };
  # };
  #
  # /TEST: authentication to private repo
  #

  users.users = {
    root = {
      openssh.authorizedKeys.keys = ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQD1LwyUmY8yaaIfPKn9aUIsbm8NkcLvx8MOILtKubMxOvnJ+ZkOQnqve/KE+VNdvOzlZgnnLA24ZAeM5fD8n/WFVjDRsKqXVAfZOIygm2/P1RzEK5+AoVOeIC25DhizNGJ0pE8F4aSVTmTtOq5kOf1bTSuVhv3p/k6ZusrzBI2HOEOUg/sfs3Q1L7wHDHTA5qxqYACLebGocq0KqWPW4GTJ67XEMiNIENBh4EEEDTaeQZjRomeeR0ssDlrNAabf+vp+dxEtyHXS9dPznCFUIh7KyCx1oKLBl/O3B2NuVycXdo2yGpPGF6iKC6HW6lBHkYWfmgunQ4NOZWpbFFF0nT7K/kbFjmQKn3h7xuH3wXqs+iGXlDCQ1c/7YKarrD/JOsyWN/qHj9nto5QE40GZZRqhO1i16jCgMTyk0VLwZ5Eq6+zAKBKBQ2t/aFov4i05LuM3geg3LO4BoyQnP/ikuDb4ENRb1+wlJp9kCk2YKZeLwcgBXYg9xkXpX5ZnQl9E26s= adriano@zenity"];
    };
    sfos = {
      isNormalUser = true;
      extraGroups = ["wheel"];
      # TODO Initial password and authorized keys need to come from .env, perhaps using nix-edit
      initialPassword = "Test.123";
      openssh.authorizedKeys.keys = ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQD1LwyUmY8yaaIfPKn9aUIsbm8NkcLvx8MOILtKubMxOvnJ+ZkOQnqve/KE+VNdvOzlZgnnLA24ZAeM5fD8n/WFVjDRsKqXVAfZOIygm2/P1RzEK5+AoVOeIC25DhizNGJ0pE8F4aSVTmTtOq5kOf1bTSuVhv3p/k6ZusrzBI2HOEOUg/sfs3Q1L7wHDHTA5qxqYACLebGocq0KqWPW4GTJ67XEMiNIENBh4EEEDTaeQZjRomeeR0ssDlrNAabf+vp+dxEtyHXS9dPznCFUIh7KyCx1oKLBl/O3B2NuVycXdo2yGpPGF6iKC6HW6lBHkYWfmgunQ4NOZWpbFFF0nT7K/kbFjmQKn3h7xuH3wXqs+iGXlDCQ1c/7YKarrD/JOsyWN/qHj9nto5QE40GZZRqhO1i16jCgMTyk0VLwZ5Eq6+zAKBKBQ2t/aFov4i05LuM3geg3LO4BoyQnP/ikuDb4ENRb1+wlJp9kCk2YKZeLwcgBXYg9xkXpX5ZnQl9E26s= adriano@zenity"];
    };
  };

  services = {
    # TODO caddy needs a plugin that watches the nomad node list for specific tags that cause them to be reverse proxied
    # from this host system
    caddy = {
      enable = true;
      # package = pkgs.caddy.withPlugins {
      #   plugins = ["github.com/acaloiaro/caddy-incus-upstreams@v0.0.0-20241228235755-786cd3b6a9dc"];
      #   hash = "sha256-yjqXgo7WiJPBVmN3+O8Wq9Nxd1xU8KrXW7Hv7Elcf7I=";
      # };
      # virtualHosts = {
      #   "https://adrianofyi.incus.adriano.fyi:443" = {
      #     extraConfig = ''
      #        reverse_proxy {
      #       	dynamic incus
      #       }
      #     '';
      #   };
      # };
    };
    openssh.enable = true;
    tailscale = {
      enable = true;
      authKeyFile = config.age.secrets.tailscale_auth_key.path;
    };
  };
  system.stateVersion = "24.05";
}