infra/nix/os/devices/steveej-t14/system.nix

{
  pkgs,
  lib,
  config,
  nodeName,
  ...
}: let
  passwords = import ../../../variables/passwords.crypt.nix;
in {
  nix.settings = {
    substituters = [
      "https://holochain-ci.cachix.org"
      # "https://cache.holo.host/"
    ];
    trusted-public-keys = [
      "holochain-ci.cachix.org-1:5IUSkZc0aoRS53rfkvH9Kid40NpyjwCMCzwRTXy+QN8="
      # "cache.holo.host-1:lNXIXtJgS9Iuw4Cu6X0HINLu9sTfcjEntnrgwMQIMcE="
      # "cache.holo.host-2:ZJCkX3AUYZ8soxTLfTb60g+F3MkWD7hkH9y8CgqwhDQ="
    ];

    extra-experimental-features = ["impure-derivations"];
    system-features = ["recursive-nix" "big-parallel"];
  };

  networking.bridges."virbr1".interfaces = [];
  networking.interfaces."virbr1".ipv4.addresses = [
    {
      address = "10.254.254.254";
      prefixLength = 24;
    }
  ];

  networking.firewall.enable = true;
  services.openssh.openFirewall = false;

  # TODO: upstream feature for inverse rule to work: `! --in-interface zt+`
  networking.firewall.interfaces."eth+".allowedTCPPorts = [
    22 

    # syncthing
    22000

    # iperf3
    5201
  ];
  networking.firewall.interfaces."eth+".allowedUDPPorts = [ 
    # syncthing
    22000 21027
  ];

  networking.firewall.logRefusedConnections = false;
  networking.usePredictableInterfaceNames = false;

  services.fwupd.enable = true;

  services.fprintd.enable = true;
  security.pam.services = {
    login.fprintAuth = true;
    sudo.fprintAuth = true;
  };

  # virtualization
  virtualisation = {
    libvirtd = {enable = true;};

    virtualbox.host = {
      enable = false;
      addNetworkInterface = false;
    };

    podman = {
      enable = true;
      dockerCompat = true;
      # defaultNetwork.dnsname.enable = true;
    };
  };

  services.samba.extraConfig = ''
    # client min protocol = NT1
  '';

  security.pki.certificateFiles = ["${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"];

  services.xserver.videoDrivers = lib.mkForce ["amdgpu"];
  services.xserver.serverFlagsSection = ''
    Option "BlankTime" "0"
    Option "StandbyTime" "0"
    Option "SuspendTime" "0"
    Option "OffTime" "0"
  '';

  time.timeZone = lib.mkForce passwords.timeZone.stefan;

  hardware.ledger.enable = true;

  services.zerotierone = {
    enable = true;
    joinNetworks = [
      "93afae5963c547f1"
      passwords.zerotier.dweb2023.networkId
    ];
  };
}