Sovran_SystemsOS/configuration.nix

{ config, pkgs, lib, ... }:

{
  imports = [
    ./modules/modules.nix
  ];

  # ── Boot ────────────────────────────────────────────────────
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  boot.loader.efi.efiSysMountPoint = "/boot/efi";
  boot.kernelPackages = pkgs.linuxPackages_latest;
  boot.kernelParams = [ "quiet" "loglevel=3" "rd.systemd.show_status=false" "udev.log_level=3" ];
  boot.blacklistedKernelModules = [ "rxrpc" ];

  # ── Filesystems ─────────────────────────────────────────────
  fileSystems."/run/media/Second_Drive" = {
    device = "LABEL=BTCEcoandBackup";
    fsType = "ext4";
    options = [ "nofail" ];
  };

  fileSystems."/boot/efi".options = [ "umask=0077" "defaults" ];

  # ── Nix Settings ────────────────────────────────────────────
  nix.settings = {
    experimental-features = [ "nix-command" "flakes" ];
    download-buffer-size = 524288000;

    # Network resilience for cache.nixos.org (Fastly) flakiness.
    connect-timeout = 10;          # fail-fast on dead TCP connects (default: 0 = unlimited)
    stalled-download-timeout = 90; # default 300s; retry sooner on stalled transfers
    download-attempts = 7;         # default 5
    http-connections = 25;         # cap concurrency (helps MTU/middlebox paths)
    fallback = true;               # build locally if a substitute can't be fetched
  };

  # ── Networking ──────────────────────────────────────────────
  networking.hostName = "nixos";
  networking.networkmanager.enable = true;
  networking.firewall.enable = true;
  networking.firewall.allowedUDPPorts = [ 5353 ];

  # ── Avahi (mDNS) ───────────────────────────────────────────
  services.avahi = {
    enable = true;
    hostName = "sovransystemsos";
    nssmdns4 = true;
    publish = { enable = true; addresses = true; };
  };

  # ── Locale / Time ──────────────────────────────────────────
  time.timeZone = null;
  i18n.defaultLocale = lib.mkDefault "en_US.UTF-8";
  i18n.supportedLocales = [
    "en_US.UTF-8/UTF-8"
    "en_GB.UTF-8/UTF-8"
    "es_ES.UTF-8/UTF-8"
    "fr_FR.UTF-8/UTF-8"
    "de_DE.UTF-8/UTF-8"
    "pt_BR.UTF-8/UTF-8"
    "ja_JP.UTF-8/UTF-8"
    "zh_CN.UTF-8/UTF-8"
    "ko_KR.UTF-8/UTF-8"
    "ru_RU.UTF-8/UTF-8"
    "ar_SA.UTF-8/UTF-8"
    "hi_IN/UTF-8"
  ];

  # ── Desktop ────────────────────────────────────────────────
  services.displayManager.gdm.enable = true;
  services.displayManager.gdm.autoSuspend = false;
  services.desktopManager.gnome.enable = true;
  services.printing.enable = true;
  systemd.enableEmergencyMode = false;
  environment.gnome.excludePackages = [ pkgs.gnome-tour ];
  security.pam.services.gdm-password.enableGnomeKeyring = true;
  security.pam.services.gdm-autologin.enableGnomeKeyring = true;

  # Declaratively guarantee the GNOME Keyring default pointer exists.
  # Defining the full path ensures root doesn't accidentally lock the user out of .local
  systemd.tmpfiles.rules = [
    "d /home/free/.local 0700 free users -"
    "d /home/free/.local/share 0700 free users -"
    "d /home/free/.local/share/keyrings 0700 free users -"
    "f /home/free/.local/share/keyrings/default 0600 free users - login\n"
  ];


  # ── Audio ──────────────────────────────────────────────────
  services.pulseaudio.enable = false;
  security.rtkit.enable = true;
  services.pipewire = {
    enable = true;
    alsa.enable = true;
    alsa.support32Bit = true;
    pulse.enable = true;
  };

  # ── Users ──────────────────────────────────────────────────
  users.users.free = {
    isNormalUser = true;
    description = "free";
    extraGroups = [ "networkmanager" ];
  };

  services.displayManager.autoLogin.enable = false;

  # ── Flatpak ────────────────────────────────────────────────
  services.flatpak.enable = true;
  systemd.services.flatpak-repo = {
    wantedBy = [ "multi-user.target" ];
    after = [ "network-online.target" "nss-lookup.target" ];
    wants = [ "network-online.target" "nss-lookup.target" ];
    path = [ pkgs.flatpak ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      Restart = "on-failure";
      RestartSec = "15s";
    };
    unitConfig = {
      StartLimitIntervalSec = 120;
      StartLimitBurst = 5;
    };
    script = ''
      flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
    '';
  };

  # ── Packages ───────────────────────────────────────────────
  nixpkgs.config.allowUnfree = true;

  environment.systemPackages = with pkgs; [
    nftables
    git wget fish htop btop
    gnomeExtensions.transparent-top-bar-adjustable-transparency
    gnomeExtensions.dash-to-dock
    gnomeExtensions.vitals
    gnomeExtensions.pop-shell
    gnomeExtensions.just-perfection
    gnomeExtensions.appindicator
    gnomeExtensions.date-menu-formatter
    gnome-tweaks papirus-icon-theme
    ranger fastfetch gedit openssl pwgen
    aspell aspellDicts.en lm_sensors
    hunspell hunspellDicts.en_US
    synadm brave-origin dua
    gparted pv unzip parted screen zenity
    libargon2 gnome-terminal libreoffice-stable
    dig firefox wp-cli axel
    lk-jwt-service livekit-libwebrtc livekit
    matrix-synapse age onlyoffice-desktopeditors
    tor-browser
  ];

  # ── Shell ──────────────────────────────────────────────────
  programs.nixvim = {
    enable = true;
    colorschemes.catppuccin.enable = true;
    plugins.lualine.enable = true;
  };

  programs.bash.promptInit = "fish";
  programs.fish = { enable = true; promptInit = "fastfetch"; };

  # ── PostgreSQL base ────────────────────────────────────────
  # Shared cluster for Nextcloud (nextclouddb) + Matrix Synapse.
  # Sized for the README's Server + Desktop recommendation (32 GB RAM,
  # 500 GB NVMe OS + 2 TB NVMe timechain). Postgres shares the box with
  # Bitcoin Core, Electrs, LND, MariaDB, PHP-FPM and GNOME, so
  # shared_buffers stays below the 25%-of-RAM dedicated-server rule.
  # Fixes Nextcloud 35 Database checks (pg.cache_hit_ratio,
  # pg.dead_tuples). Override in custom.nix for other hosts, e.g.:
  #   services.postgresql.settings.shared_buffers = lib.mkForce "512MB";
  services.postgresql = {
    enable = true;
    authentication = lib.mkForce ''
      local   all   all                 trust
      host    all   all   127.0.0.1/32  trust
      host    all   all   ::1/128       trust
    '';
    settings = {
      # Memory — fixes low buffer cache hit ratio (stock default is
      # 128MB shared_buffers). effective_cache_size is only a planner
      # hint, not an allocation, so it can be generous.
      # NOTE: changing shared_buffers requires a Postgres restart.
      shared_buffers = "2GB";
      effective_cache_size = "12GB";
      maintenance_work_mem = "512MB";
      work_mem = "32MB";
      wal_buffers = "64MB";

      # Checkpoints — spread write bursts out on NVMe. Reload-only.
      min_wal_size = "1GB";
      max_wal_size = "4GB";
      checkpoint_completion_target = 0.9;

      # Autovacuum — the stock 60s naptime can't keep up with
      # Nextcloud's and Synapse's write-heavy tables (filecache,
      # activity, jobs, state). Reload-only.
      autovacuum_naptime = "30s";
      autovacuum_vacuum_scale_factor = 0.05;
      autovacuum_analyze_scale_factor = 0.025;
      autovacuum_max_workers = 4;

      # NVMe planner assumptions (README: NVMe OS + data disks).
      random_page_cost = "1.1";
      effective_io_concurrency = 200;
    };
  };

  # ── Backups ────────────────────────────────────────────────
  services.rsnapshot = {
    enable = true;
    extraConfig = ''
snapshot_root	/run/media/Second_Drive/BTCEcoandBackup/NixOS_Snapshot_Backup
retain	hourly	5
retain	daily	5
backup	/home/	localhost/
backup	/var/lib/	localhost/
backup	/etc/nixos/	localhost/
backup	/etc/nix-bitcoin-secrets/	localhost/
    '';
    cronIntervals = {
      daily = "50 21 * * *";
      hourly = "0 * * * *";
    };
  };

  # ── Cron ───────────────────────────────────────────────────
  # The legacy njalla.sh root cron job has been replaced by the systemd timer
  # defined in modules/core/njalla.nix (sovran-ddns-update.timer).  Cron is
  # retained so that rsnapshot and other module-defined cron jobs continue to run.

  # ── Tor ────────────────────────────────────────────────────
  services.tor = { enable = true; client.enable = true; torsocks.enable = true; };

  # ── Garbage Collection ─────────────────────────────────────
  nix.gc = { automatic = true; dates = "weekly"; options = "--delete-older-than 7d"; };

  system.stateVersion = "22.05";
}