infra/nix/os/profiles/graphical/system.nix

{
  pkgs,
  lib,
  ...
}: {
  networking.networkmanager = {
    enable = true;
    dns = "systemd-resolved";
    unmanaged = [
      "interface-name:veth*"
      "interface-name:virbr*"
      "interface-name:br*"
      "interface-name:*vbox*"
      "interface-name:*cni*"
    ];
  };
  networking.usePredictableInterfaceNames = false;

  services.resolved.enable = true;

  # hardware related services
  services.illum.enable = true;
  services.pcscd.enable = false;
  hardware = {
    bluetooth.enable = true;
    pulseaudio = {
      enable = true;
      package = pkgs.pulseaudioFull;
      support32Bit = true;
    };
  };
  # required for running blueman-applet in user sessions
  services.dbus.packages = with pkgs; [blueman dconf];
  services.blueman.enable = true;

  services.xserver = {
    enable = true;
    libinput.enable = true;
    libinput.touchpad.naturalScrolling = true;

    videoDrivers = [
      "qxl"
      "modesetting"
      "ati"
      "cirrus"
      "intel"
      "vesa"
      "vmware"
      "modesetting"
    ];
    layout = "us";
    xkbVariant = "altgr-intl";
    xkbOptions = "nodeadkeys";

    desktopManager = {
      # FIXME: gnome should be moved to user session
      gnome.enable = true;

      xterm.enable = true;
      plasma5.enable = false;
    };

    displayManager = {
      gdm.enable = true;

      autoLogin = {
        enable = true;
        user = "steveej";
      };
    };
  };

  # gnome, most of it is disabled and ideally it could live entirely in the user's home config
  programs.gpaste.enable = false;
  programs.gnome-terminal.enable = false;
  programs.gnome-documents.enable = false;
  programs.gnome-disks.enable = false;

  services.gnome = {
    gnome-online-miners.enable = lib.mkForce false;
    games.enable = false;
    gnome-remote-desktop.enable = false;
    gnome-user-share.enable = false;
    rygel.enable = false;
    sushi.enable = false;
    tracker.enable = false;
    tracker-miners.enable = false;

    gnome-browser-connector.enable = false;
    gnome-initial-setup.enable = false;

    # FIXME: gnome should be moved to home config
    gnome-settings-daemon.enable = true;
    core-os-services.enable = true;
    at-spi2-core.enable = true;
    evolution-data-server.enable = true;
    gnome-online-accounts.enable = true;
    gnome-keyring.enable = lib.mkForce false;
  };

  # FIXME: gnome should be moved to user session
  services.gvfs.enable = true;
  programs.seahorse.enable = true;
  programs.dconf.enable = true;

  environment.gnome.excludePackages =
    (with pkgs; [
      orca
      gnome-photos
      gnome-tour
    ])
    ++ (with pkgs.gnome; [
      cheese # webcam tool
      gnome-music
      gnome-terminal
      gedit # text editor
      epiphany # web browser
      geary # email reader
      evince # document viewer
      gnome-characters
      totem # video player
      tali # poker game
      iagno # go game
      hitori # sudoku game
      atomix # puzzle game
    ]);

  # More Services
  environment.systemPackages = [pkgs.gnome.adwaita-icon-theme pkgs.gnomeExtensions.appindicator];
  services.udev.packages = [pkgs.libu2f-host pkgs.yubikey-personalization pkgs.android-udev-rules];
  services.udev.extraRules = ''
    # OnePlusOne
    ATTR{idVendor}=="05c6", ATTR{idProduct}=="6764", SYMLINK+="libmtp-%k", MODE="660", GROUP="audio", ENV{ID_MTP_DEVICE}="1", ENV{ID_MEDIA_PLAYER}="1", TAG+="uaccess"
    ATTR{idVendor}=="05c6", ATTR{idProduct}=="6765", SYMLINK+="libmtp-%k", MODE="660", GROUP="audio", ENV{ID_MTP_DEVICE}="1", ENV{ID_MEDIA_PLAYER}="1", TAG+="uaccess"

    # Plantronics BackBeat PRO
    SUBSYSTEM=="usb", ATTR{idVendor}=="047f", ATTR{idProduct}=="011a", GROUP="users", MODE="0777"
    SUBSYSTEM=="usb", ATTR{idVendor}=="047f", ATTR{idProduct}=="fffe", GROUP="users", MODE="0777"
    SUBSYSTEM=="usb", ATTR{idVendor}=="047f", ATTR{idProduct}=="0001", GROUP="users", MODE="0777"

    # Yubikey 4/5 U2F+CCID
    SUBSYSTEM=="usb", ATTR{idVendor}=="1050", ATTR{idProduct}=="0406", ENV{ID_SECURITY_TOKEN}="1", GROUP="wheel"
  '';

  services.samba.enable = true;
  services.samba.extraConfig = ''
    client max protocol = SMB3
  '';

  services.logind.lidSwitchExternalPower = "ignore";

  services.printing = {
    enable = true;
    drivers = with pkgs; [mfcl3770cdwlpr mfcl3770cdwcupswrapper];
  };
}