# MANUAL: On client machines generate signing keys:
#   nix-store --generate-binary-cache-key some-name /persist/manual/nix/nix-cache-key.sec /persist/manual/nix/nix-cache-key.pub
#
# Trust other machines and add the substituters:
#   nix.binaryCachePublicKeys = [ "some-name:AzNW1MOlkNEsUAXS1jIFZ1QCFKXjV+Y/LrF37quAZ1A=" ];
#   nix.binaryCaches = [ "https://test.example/nix-cache" ];

{
  config,
  lib,
  pkgs,
  ...
}:
{
  imports = [
    ./hardware-configuration.nix
    ./vm_disk.nix
  ];

  config = {
    networking =
      let
        interface = "enp0s2";
      in
      {
        # Generate with `head -c4 /dev/urandom | od -A none -t x4`
        hostId = "6fbf418b";

        hostName = "hydra"; # Define your hostname.

        interfaces = {
          "${interface}" = {
            ipv4.addresses = [
              {
                address = "10.215.1.219";
                prefixLength = 24;
              }
            ];

            ipv6.addresses = [
              {
                address = "2620:11f:7001:7:ffff:ffff:0ad7:01db";
                prefixLength = 64;
              }
            ];
          };
        };
        defaultGateway = "10.215.1.1";
        defaultGateway6 = {
          # address = "2620:11f:7001:7::1";
          address = "2620:11f:7001:7:ffff:ffff:0ad7:0101";
          inherit interface;
        };

        dhcpcd.enable = lib.mkForce false;
        useDHCP = lib.mkForce false;
      };

    time.timeZone = "America/New_York";
    i18n.defaultLocale = "en_US.UTF-8";

    me.boot.enable = true;
    me.boot.secure = false;
    me.mountPersistence = true;
    boot.loader.timeout = lib.mkForce 0; # We can always generate a new ISO if we need to access other boot options.

    me.optimizations = {
      enable = true;
      arch = "znver4";
      # build_arch = "x86-64-v3";
      system_features = [
        "gccarch-znver4"
        "gccarch-skylake"
        "gccarch-kabylake"
        # "gccarch-alderlake" missing WAITPKG
        "gccarch-x86-64-v3"
        "gccarch-x86-64-v4"
        "benchmark"
        "big-parallel"
        "kvm"
        "nixos-test"
      ];
    };

    # Mount tmpfs at /tmp
    boot.tmp.useTmpfs = true;

    # Enable TRIM
    # services.fstrim.enable = lib.mkDefault true;

    # nix.optimise.automatic = true;
    # nix.optimise.dates = [ "03:45" ];
    # nix.optimise.persistent = true;

    me.image_based_appliance.enable = lib.mkForce false;

    environment.systemPackages = with pkgs; [
      htop
      git # for building on hydra
      tmux # for building on hydra
      nix-output-monitor # for building on hydra
    ];

    # nix.sshServe.enable = true;
    # nix.sshServe.keys = [ "ssh-dss AAAAB3NzaC1k... bob@example.org" ];

    # Override garbage collection to keep things longer
    # Automatic garbage collection
    nix.gc = lib.mkForce {
      automatic = true;
      persistent = true;
      dates = "weekly";
      # randomizedDelaySec = "14m";
      options = "--delete-older-than 60d";
    };

    # The default limit of files is 1024 which is too low for some nix builds.
    #
    # Check with `ulimit -n`
    security.pam.loginLimits = [
      {
        domain = "*";
        item = "nofile";
        type = "-";
        value = "8192";
      }
    ];

    # systemd.user.extraConfig = "DefaultLimitNOFILE=8192";
    # systemd.services."user@11400".serviceConfig.LimitNOFILE = "8192";

    me.build_in_ram.enable = true;
    me.dont_use_substituters.enable = true;
    me.hydra.enable = true;
    me.minimal_base.enable = true;
    me.nix_worker.enable = true;
  };
}
