{ config, pkgs, ... }:

{
  imports =
    [ 
      ./hardware-configuration.nix
      ../../modules
    ];

  networking.hostName = "nixbook"; 
  system.stateVersion = "26.05"; 

  boot.initrd.luks.devices."luks-082cc474-c00a-46c5-b140-4b7ccc2e6958".device = "/dev/disk/by-uuid/082cc474-c00a-46c5-b140-4b7ccc2e6958";

  services.power-profiles-daemon.enable = true;

  hardware.bluetooth.powerOnBoot = false;

  users.users.djai.packages = with pkgs; [
    steam
  ];

  # BELOW IS OLD!! remove as we make more modular
  # custom certificates
  # TODO: move certs to secrets, make this a module not a host based thing
  security.pki.certificateFiles = [
    ./certs/npm-caddy-private.crt
    ./certs/npm-caddy-public.crt
    ./certs/npm-caddy-shared.crt
  ];

  # TODO: move to secrets
  # tunnel
  networking.wg-quick.interfaces = {
    npm = {
      address = ["10.8.0.3/32"];
      privateKeyFile = "/root/wireguard-keys/npm";
      peers = [{
        publicKey = "YlQfDLqOET0RCTfbeRTDUicF/RA6dic/ThHLy25w4nQ=";
        presharedKeyFile = "/root/wireguard-keys/npm_preshared";
        allowedIPs = ["10.9.11.0/24" "10.8.0.0/24"];
        endpoint = "wg-easy.u.djairo.dev:51820";
        persistentKeepalive = 25;
      }];
    };
  };
}