nixos-4screen/hosts/sam-4screen-desktop/configuration.nix

{ config, pkgs, lib, ... }:

{
  imports = [
    ./hardware-configuration.nix
  ];

  # ---
  # Nix (enable flakes on the installed system)
  # ---
  nix.settings.experimental-features = [ "nix-command" "flakes" ];

  # ---
  # Bootloader / kernel
  # ---
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  # Known-good baseline from niri-4screen.md
  boot.kernelParams = [ "intel_iommu=off" "dev_mem_signed_off=1" ];

  # ---
  # Identity
  # ---
  networking.hostName = "sam-4screen-desktop";
  time.timeZone = "Australia/Sydney";

  # ---
  # Networking
  # ---
  networking.networkmanager.enable = true;

  # Static IP policy:
  # - Static IP must be on Wi-Fi SSID "Aussie Broadband 8729"
  # - Do NOT store Wi-Fi secrets (PSK) in git-tracked Nix files
  #
  # Approach:
  # - Connect to Wi-Fi normally via nmtui/nmcli/GUI (credentials stored locally by NM)
  # - On activation, this dispatcher script enforces the static IP/DNS/gateway
  #   only for that SSID on interface wlp4s2.
  environment.etc."NetworkManager/dispatcher.d/10-wlp4s2-static-ip-aussie-broadband-8729".source =
    pkgs.writeShellScript "10-wlp4s2-static-ip-aussie-broadband-8729" ''
      set -euo pipefail

      IFACE="$1"
      STATUS="$2"

      TARGET_ID="Aussie Broadband 8729"
      NMCLI="${pkgs.networkmanager}/bin/nmcli"

      # Only touch the Wi-Fi interface you specified.
      if [[ "$IFACE" != "wlp4s2" ]]; then
        exit 0
      fi

      # Apply on pre-up/up so settings are in place as early as possible.
      case "$STATUS" in
        pre-up|up) ;;
        *) exit 0 ;;
      esac

      # NetworkManager dispatcher provides these env vars.
      # If they are missing, we can't safely target the right connection.
      if [[ -z "''${CONNECTION_UUID:-}" ]]; then
        exit 0
      fi

      # Ensure it is actually a Wi-Fi connection.
      TYPE="$("$NMCLI" -g connection.type connection show "$CONNECTION_UUID" 2>/dev/null || true)"
      if [[ "$TYPE" != "802-11-wireless" ]]; then
        exit 0
      fi

      # Determine the connection "id" (name). This is typically the SSID, but not always.
      CONN_ID="$("$NMCLI" -g connection.id connection show "$CONNECTION_UUID" 2>/dev/null || true)"
      if [[ "$CONN_ID" != "$TARGET_ID" ]]; then
        exit 0
      fi

      # Enforce your confirmed static IPv4 configuration.
      "$NMCLI" connection modify "$CONNECTION_UUID" \
        ipv4.method manual \
        ipv4.addresses "192.168.20.27/24" \
        ipv4.gateway "192.168.20.1" \
        ipv4.dns "192.168.20.35 192.168.20.13" \
        ipv4.ignore-auto-dns yes \
        ipv6.method auto

      # NOTE:
      # This modifies the connection profile. If the connection is already "up",
      # you may need to reconnect once for all settings to apply immediately:
      #   nmcli connection down "$CONNECTION_UUID"
      #   nmcli connection up "$CONNECTION_UUID"

      exit 0
    '';

  environment.etc."NetworkManager/dispatcher.d/10-wlp4s2-static-ip-aussie-broadband-8729".mode = "0755";

  # ---
  # Users
  # ---
  programs.zsh.enable = true;

  users.users.sam = {
    isNormalUser = true;
    description = "Sam";
    extraGroups = [ "wheel" "networkmanager" "video" "render" ];
    shell = pkgs.zsh;
  };

  # greetd runs the greeter session as this user; it must exist.
  users.groups.greeter = { };
  users.users.greeter = {
    isSystemUser = true;
    group = "greeter";
    home = "/var/lib/greeter";
    createHome = true;
  };

  # ---
  # SSH
  # ---
  services.openssh.enable = true;
  services.openssh.openFirewall = true;
  # Defaulting to keys-only for safety. If you explicitly want password auth for the migration,
  # flip this to true.
  services.openssh.settings.PasswordAuthentication = false;

  # Explicitly enable firewall (keep SSH as the only opened port via openFirewall above).
  networking.firewall.enable = true;

  # ---
  # dconf (helps portals/GTK apps)
  # ---
  programs.dconf.enable = true;

  # Polkit is commonly required for a smooth experience with portals and desktop actions,
  # especially in minimal Wayland sessions.
  security.polkit.enable = true;

  # ---
  # Firmware / microcode (stability)
  # ---
  hardware.enableRedistributableFirmware = true;
  hardware.cpu.intel.updateMicrocode = true;

  # ---
  # OpenGL (important for NVIDIA Wayland apps)
  # ---
  hardware.opengl = {
    enable = true;
    driSupport = true;
    driSupport32Bit = true;
  };

  # ---
  # Audio (PipeWire)
  # ---
  security.rtkit.enable = true;
  services.pipewire = {
    enable = true;
    pulse.enable = true;
    alsa.enable = true;
    alsa.support32Bit = true;
    wireplumber.enable = true;
  };

  # ---
  # Swap (zram; no hibernation)
  # ---
  zramSwap.enable = true;

  # ---
  # Docker (DEFER for now)
  # ---
  virtualisation.docker.enable = false;

  # ---
  # Mounts
  # ---
  fileSystems."/data" = {
    device = "/dev/disk/by-uuid/27febd74-20aa-4a3a-92c1-6fdd1ad7e88e";
    fsType = "ext4";
    options = [ "nofail" "x-systemd.device-timeout=1s" ];
  };

  # ---
  # Niri + login (greetd)
  # ---
  services.greetd = {
    enable = true;
    settings = {
      default_session = {
        user = "greeter";
        command =
          "${pkgs.greetd.tuigreet}/bin/tuigreet --time --remember --cmd ${
            lib.escapeShellArg "${pkgs.niri}/bin/niri --session"
          }";
      };
    };
  };

  # Wayland portals (refine later if screencast needs a different backend)
  xdg.portal = {
    enable = true;
    extraPortals = [
      pkgs.xdg-desktop-portal-gtk
      pkgs.xdg-desktop-portal-gnome
    ];
  };

  # Minimal system packages needed for the session and core usability
  environment.systemPackages = with pkgs; [
    niri
    greetd.tuigreet
    xwayland
    wl-clipboard
    grim
    slurp
  ];

  # ---
  # NVIDIA (simple, first-boot stable config; PRIME tuning later)
  # ---
  services.xserver.videoDrivers = [ "nvidia" ];
  hardware.nvidia.modesetting.enable = true;
  hardware.nvidia.nvidiaSettings = true;
  hardware.nvidia.nvidiaPersistenced = true;

  # ---
  # NixOS release compatibility
  # ---
  system.stateVersion = "24.05";
}